Network & Firewall - One Mesh, Two Overlays, Three Postures

Network & Firewall - One Mesh, Two Overlays, Three Postures An architecture diagram generated by Archify. Internet · players, customers, scanners · Architecture component Internet players, customers, scanners reliablesite · LAX · 5 public IPs · 1733 iptables rules · WireGuard site mesh · wg0 10.99.0.0/24 · carries corosync · no mesh filtering reliablesite · LAX 5 public IPs · 1733 iptables rules no mesh filtering PVE-NYC001-Store · NYC · WG_IN / WG_FWD default-deny · WireGuard site mesh · wg0 10.99.0.0/24 · carries corosync · filtered mesh PVE-NYC001-Store · NYC WG_IN / WG_FWD default-deny filtered mesh Basement QDevice · 10.99.0.3 · behind home NAT · WireGuard site mesh · wg0 10.99.0.0/24 · carries corosync · unmanaged Basement QDevice 10.99.0.3 · behind home NAT unmanaged dracobyte-eu · Helsinki · INPUT 0 rules · FORWARD 7 · WireGuard site mesh · wg0 10.99.0.0/24 · carries corosync · standalone dracobyte-eu · Helsinki INPUT 0 rules · FORWARD 7 standalone LAX vnets · 10.10 / 20 / 30 / 40 / 50 .0.0/16 · Architecture component LAX vnets 10.10 / 20 / 30 / 40 / 50 .0.0/16 NYC vnets · 10.11 / 21 / 31 / 41 / 51 .0.0/16 · Architecture component NYC vnets 10.11 / 21 / 31 / 41 / 51 .0.0/16 EU vmbr1 · 10.32.0.0/24 flat · no SDN · Architecture component EU vmbr1 10.32.0.0/24 flat · no SDN Staff VPN · CT110 · 10.8.0.0/24 · 1 of 8 peers live · Architecture component · legacy Staff VPN · CT110 10.8.0.0/24 · 1 of 8 peers live legacy NetBird overlay · 100.65.0.0/16 · CT218 · US only · Architecture component · identity ACLs NetBird overlay 100.65.0.0/16 · CT218 · US only identity ACLs DNAT · 5 public IPs DNAT · 3 IPs DNAT · 95.217.112.247 vmbr1 VLAN tags 10-50 same tags, second octet +1 plain bridge, no VLAN zone corosync vote · both US hosts, never EU SNAT to 10.10.0.4 → every RFC1918 destination ipsets → LAX subnets ipsets → NYC subnets WireGuard site mesh · wg0 10.99.0.0/24 · carries corosync Legend Cloud Security External

A valid route proves nothing

  • • Both US hosts end FORWARD with a catch-all -s 10.0.0.0/8 -d 10.0.0.0/8 DROP
  • • Any new east-west flow needs an explicit ACCEPT placed ABOVE that DROP
  • • Two guests one L3 hop apart on the same hypervisor still get silently discarded
  • • This has been the root cause four separate times; ICMP passing proves nothing either

Three very different postures

  • • LAX: 1733 rules, of which 1553 are individual per-source-IP DROPs, and no enforced mesh filtering
  • • NYC: small ruleset but real default-deny inside WG_IN and WG_FWD
  • • EU: 0 INPUT rules and 7 FORWARD rules, all pointing at 10.32.0.30
  • • Every playbook writes IPv4 only - on EU, the one host with a v6 default route, that leaves services open over IPv6

Two overlays, not one

  • • The site mesh is static: reachability comes from WireGuard AllowedIPs
  • • NetBird is identity-driven, full-mesh, and exists only on the two US hosts
  • • NetBird masquerades: overlay traffic arrives as the per-VLAN host gateway, never as 100.65.x
  • • So source-IP allowlists written for 100.65.0.0/16 are silently dead on the VPN path