NODEDC_PLATFORM/device-plane/docs/DEVICE_EDGE_B2_PUBLIC_PILOT_RUNBOOK.md

Device Edge B2 public pilot runbook

Status: router/NAT is not configured by this document. It is a one-pilot, human-operated exposure gate for the already accepted Mini relay. It never changes Synology, Gelios, VPN, Device Plane command transport or device ownership.

Exact traffic path

ARUSNAVI B2 pilot
  -> public IPv4 : TCP/9921
  -> provider router : TCP/9921 -> 192.168.1.151:9921
  -> Deco X55 : TCP/9921 -> 192.168.71.253:9921
  -> Mini IPvlan relay
  -> restricted private backhaul
  -> Synology Gateway 127.0.0.1:9921

The observed Deco WAN is 192.168.1.151 with gateway 192.168.0.1; it is an RFC1918 address. Therefore this is a double-NAT topology. A Deco rule alone cannot make the tracker reachable from the internet.

Immutable safety boundary

• Forward TCP only, external and internal port 9921.
• Deco target is exactly 192.168.71.253, never the Mini host 192.168.68.54 and never Synology.
• Do not enable DMZ, UPnP, port ranges, UDP, 443 forwarding or any catch-all rule.
• Do not remove, replace or edit the Gelios monitoring route.
• The relay accepts connections only from a public IPv4 source, keeps quarantine-only discovery and has no command transport. A LAN client will intentionally be rejected; that is not a test failure.
• The rule must be deleted again if the single pilot is abandoned or the expected quarantine evidence is not obtained.

Gate 1 — DNS and public address

1. Determine the actual public IPv4 on the provider-facing edge. Do not use 192.168.0.1, 192.168.1.151, 192.168.68.1 or 192.168.71.253 as a DNS answer: all are private addresses.
2. Point device.nodedc.ru to that public IPv4 only if the tracker UI accepts a hostname. Otherwise configure the public IPv4 directly.
3. If the provider router has no public WAN IPv4, or an internet check still cannot reach it after both rules below, stop. This is provider CGNAT/bridge territory: request a public IPv4 or a bridge/forwarding option from the provider. Do not introduce a VPS as an unreviewed workaround.

Gate 2 — provider router

On the upstream/provider router, create one port-forward rule:

Field	Value
Name	NDC B2 pilot to Deco
Protocol	TCP
External port	9921
Target address	192.168.1.151
Target port	9921

Save only that rule. It targets the Deco WAN address, not a service host.

Gate 3 — Deco X55

In the Deco mobile app: More → Advanced → NAT Forwarding → Port Forwarding → Add. Create exactly:

Field	Value
Name	NDC B2 pilot
Protocol	TCP
External port	9921
Internal IP	192.168.71.253
Internal port	9921

If the app forces a client selection, select the IPvlan relay only if its address is shown as 192.168.71.253. Do not select the Mini host or any NAS. If the UI will not accept the fixed IPvlan address, stop and record that fact; do not substitute a DHCP address.

Gate 4 — ARUSNAVI B2 route

Use one known pilot B2 and one unused monitoring-server slot. Configure an additional route with the documented INTERNAL protocol and the public hostname/IP from Gate 1, TCP port 9921. Preserve the existing Gelios route in its current slot. The ARUSNAVI account password stays in the operator surface; it is not entered into Foundry, Device Plane or the relay.

The device IMEI observed in HEADER2 is a claimed identifier only. It becomes a quarantine discovery, not an owned device and never a command target.

Acceptance and failure handling

The first valid HEADER/PACKAGE through the pilot route must produce a masked, quarantine-only discovery in Device Control Core and the existing Gelios map path must continue independently. Do not issue a device command.

On any unexpected behavior, remove the two NAT rules in reverse order:

1. remove the Deco NDC B2 pilot rule;
2. remove the provider-router NDC B2 pilot to Deco rule.

This ends external reachability while leaving the Mini, VPN, backhaul, Synology and Gelios unchanged. Do not use a LAN port probe as acceptance: the relay correctly rejects private source addresses.