From 068851600350d56652182c2b713c0ffcb1c59da1 Mon Sep 17 00:00:00 2001 From: Codex Date: Tue, 4 Aug 2026 12:04:54 +0300 Subject: [PATCH] docs(device-edge): add B2 public pilot runbook --- .../DEVICE_EDGE_B2_PUBLIC_PILOT_RUNBOOK.md | 106 ++++++++++++++++++ 1 file changed, 106 insertions(+) create mode 100644 device-plane/docs/DEVICE_EDGE_B2_PUBLIC_PILOT_RUNBOOK.md diff --git a/device-plane/docs/DEVICE_EDGE_B2_PUBLIC_PILOT_RUNBOOK.md b/device-plane/docs/DEVICE_EDGE_B2_PUBLIC_PILOT_RUNBOOK.md new file mode 100644 index 0000000..8f0df8d --- /dev/null +++ b/device-plane/docs/DEVICE_EDGE_B2_PUBLIC_PILOT_RUNBOOK.md @@ -0,0 +1,106 @@ +# Device Edge B2 public pilot runbook + +Status: router/NAT is **not configured** by this document. It is a one-pilot, +human-operated exposure gate for the already accepted Mini relay. It never +changes Synology, Gelios, VPN, Device Plane command transport or device +ownership. + +## Exact traffic path + +```text +ARUSNAVI B2 pilot + -> public IPv4 : TCP/9921 + -> provider router : TCP/9921 -> 192.168.1.151:9921 + -> Deco X55 : TCP/9921 -> 192.168.71.253:9921 + -> Mini IPvlan relay + -> restricted private backhaul + -> Synology Gateway 127.0.0.1:9921 +``` + +The observed Deco WAN is `192.168.1.151` with gateway `192.168.0.1`; it is an +RFC1918 address. Therefore this is a double-NAT topology. A Deco rule alone +cannot make the tracker reachable from the internet. + +## Immutable safety boundary + +- Forward **TCP only**, external and internal port `9921`. +- Deco target is exactly `192.168.71.253`, never the Mini host + `192.168.68.54` and never Synology. +- Do not enable DMZ, UPnP, port ranges, UDP, 443 forwarding or any catch-all + rule. +- Do not remove, replace or edit the Gelios monitoring route. +- The relay accepts connections only from a public IPv4 source, keeps + quarantine-only discovery and has no command transport. A LAN client will + intentionally be rejected; that is not a test failure. +- The rule must be deleted again if the single pilot is abandoned or the + expected quarantine evidence is not obtained. + +## Gate 1 — DNS and public address + +1. Determine the actual public IPv4 on the provider-facing edge. Do not use + `192.168.0.1`, `192.168.1.151`, `192.168.68.1` or `192.168.71.253` as a + DNS answer: all are private addresses. +2. Point `device.nodedc.ru` to that public IPv4 only if the tracker UI accepts + a hostname. Otherwise configure the public IPv4 directly. +3. If the provider router has no public WAN IPv4, or an internet check still + cannot reach it after both rules below, stop. This is provider CGNAT/bridge + territory: request a public IPv4 or a bridge/forwarding option from the + provider. Do not introduce a VPS as an unreviewed workaround. + +## Gate 2 — provider router + +On the upstream/provider router, create one port-forward rule: + +| Field | Value | +| --- | --- | +| Name | `NDC B2 pilot to Deco` | +| Protocol | `TCP` | +| External port | `9921` | +| Target address | `192.168.1.151` | +| Target port | `9921` | + +Save only that rule. It targets the Deco WAN address, not a service host. + +## Gate 3 — Deco X55 + +In the Deco mobile app: **More → Advanced → NAT Forwarding → Port Forwarding → +Add**. Create exactly: + +| Field | Value | +| --- | --- | +| Name | `NDC B2 pilot` | +| Protocol | `TCP` | +| External port | `9921` | +| Internal IP | `192.168.71.253` | +| Internal port | `9921` | + +If the app forces a client selection, select the IPvlan relay only if its +address is shown as `192.168.71.253`. Do not select the Mini host or any NAS. +If the UI will not accept the fixed IPvlan address, stop and record that fact; +do not substitute a DHCP address. + +## Gate 4 — ARUSNAVI B2 route + +Use one known pilot B2 and one unused monitoring-server slot. Configure an +additional route with the documented **INTERNAL** protocol and the public +hostname/IP from Gate 1, TCP port `9921`. Preserve the existing Gelios route in +its current slot. The ARUSNAVI account password stays in the operator surface; +it is not entered into Foundry, Device Plane or the relay. + +The device IMEI observed in `HEADER2` is a claimed identifier only. It becomes +a quarantine discovery, not an owned device and never a command target. + +## Acceptance and failure handling + +The first valid HEADER/PACKAGE through the pilot route must produce a masked, +quarantine-only discovery in Device Control Core and the existing Gelios map +path must continue independently. Do not issue a device command. + +On any unexpected behavior, remove the two NAT rules in reverse order: + +1. remove the Deco `NDC B2 pilot` rule; +2. remove the provider-router `NDC B2 pilot to Deco` rule. + +This ends external reachability while leaving the Mini, VPN, backhaul, +Synology and Gelios unchanged. Do not use a LAN port probe as acceptance: the +relay correctly rejects private source addresses.