=== STEP_033D APPLY CANARY RUNTIME === timestamp=20260708-111338 package=/opt/router-ops/apply-packages/20260708-111006_step033c3_canary_eth2_plan intent: runtime nft canary only: 10.200.0.1 on VM101 eth1 -> mark 0x203 -> vpn3 forbidden: UCI changes, firewall reload, broad production marking, network restart === BEFORE VM101 === Wed Jul 8 11:13:38 UTC 2026 === nft canary before === router_egress_canary_absent === ip rule before === 0: from all lookup local 10013: from all fwmark 0x203 lookup 203 10014: from all fwmark 0x204 lookup 204 10015: from all fwmark 0x205 lookup 205 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === route unmarked === 1.1.1.1 from 10.200.0.1 dev vpn1 table 200 cache iif eth1 === route marked === 1.1.1.1 from 10.200.0.1 dev vpn3 table 203 mark 0x203 cache iif eth1 === vpn3 before === interface: vpn3 endpoint: 95.211.68.119:45176 latest handshake: 1 minute, 6 seconds ago transfer: 5.37 KiB received, 14.61 KiB sent === uci pending before === === DEPLOY APPLY/ROLLBACK === deploy APPLY_CANARY_VM100_ETH2_TO_VPN3_RUNTIME.sh deploy ROLLBACK_CANARY_VM100_ETH2_TO_VPN3_RUNTIME.sh === ACTION: APPLY RUNTIME CANARY NFT RULE === Apply runtime canary: VM100 eth2/10.200.0.1 -> VM101 eth1 -> mark 0x203 -> vpn3 canary rule added table inet router_egress_canary { chain prerouting { type filter hook prerouting priority mangle; policy accept; iifname "eth1" ip saddr 10.200.0.1 meta mark set 0x00000203 counter packets 0 bytes 0 comment "STEP_033D_VM100_ETH2_TO_VPN3" } } 0: from all lookup local 10013: from all fwmark 0x203 lookup 203 10014: from all fwmark 0x204 lookup 204 10015: from all fwmark 0x205 lookup 205 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default 1.1.1.1 from 10.200.0.1 dev vpn3 table 203 mark 0x203 cache iif eth1 APPLY_CANARY_RC=0 === CANARY TEST FROM VM100 eth2 === Wed Jul 8 11:13:41 UTC 2026 === ping -I eth2 1.1.1.1 === PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=54 time=52.592 ms 64 bytes from 1.1.1.1: seq=1 ttl=54 time=52.202 ms 64 bytes from 1.1.1.1: seq=2 ttl=54 time=52.217 ms 64 bytes from 1.1.1.1: seq=3 ttl=54 time=52.344 ms 64 bytes from 1.1.1.1: seq=4 ttl=54 time=52.549 ms --- 1.1.1.1 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 52.202/52.380/52.592 ms PING_VM100_I_ETH2_AFTER_RC=0 === route get source 10.200.0.1 === 1.1.1.1 from 10.200.0.1 via 10.201.0.2 dev eth0 uid 0 cache === AFTER VM101 VERIFY === Wed Jul 8 11:13:46 UTC 2026 === nft canary after === table inet router_egress_canary { chain prerouting { type filter hook prerouting priority mangle; policy accept; iifname "eth1" ip saddr 10.200.0.1 meta mark set 0x00000203 counter packets 5 bytes 420 comment "STEP_033D_VM100_ETH2_TO_VPN3" } } === ip rule after === 0: from all lookup local 10013: from all fwmark 0x203 lookup 203 10014: from all fwmark 0x204 lookup 204 10015: from all fwmark 0x205 lookup 205 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === table 200 after === default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 === table 203 after === default dev vpn3 scope link === route unmarked after === 1.1.1.1 from 10.200.0.1 dev vpn1 table 200 cache iif eth1 === route marked after === 1.1.1.1 from 10.200.0.1 dev vpn3 table 203 mark 0x203 cache iif eth1 === vpn1/vpn3 pings after === PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=57 time=53.331 ms 64 bytes from 1.1.1.1: seq=1 ttl=57 time=53.397 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 53.331/53.364/53.397 ms PING_VM101_vpn1_RC=0 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: seq=0 ttl=55 time=52.218 ms 64 bytes from 1.1.1.1: seq=1 ttl=55 time=51.964 ms --- 1.1.1.1 ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max = 51.964/52.091/52.218 ms PING_VM101_vpn3_RC=0 === vpn3 after === interface: vpn3 endpoint: 95.211.68.119:45176 latest handshake: 1 minute, 16 seconds ago transfer: 6.24 KiB received, 15.49 KiB sent === uci pending after === === rollback script === -rwx------ 1 root root 162 Jul 8 11:13 /root/router-ops-step033d-canary/ROLLBACK_CANARY_VM100_ETH2_TO_VPN3_RUNTIME.sh === STEP_033D RESULT === apply_canary_rc=0 ping_vm100_i_eth2_after_rc=0 ping_vm101_vpn1_rc=0 ping_vm101_vpn3_rc=0 nft_rule_lines=2 nft_counter_lines=1 rule203_lines=1 table200_default_vpn1_lines=1 table203_default_vpn3_lines=1 unmarked_route_vpn1_lines=1 marked_route_vpn3_lines=1 uci_pending_lines=0 decision=PASS_CANARY_RUNTIME_APPLIED