nimmo/nixos-config

Watch

Fork 0

Validate phone full-tunnel egress through Vega over Nebula #49

New issue

Closed

opened 2026-07-04 20:52:20 +01:00 by nimmo · 1 comment

nimmo commented

2026-07-04 20:52:20 +01:00

Owner

Goal

Prove that the phone can use Nebula to send IPv4 traffic and DNS through Vega from off-LAN, and document any client-specific quirks discovered during validation.

Context

The mobile client must be tested from a real off-LAN path because the public bootstrap and exit-node behavior are only meaningful away from the home network.

Acceptance Checklist

Connect the phone to Nebula from mobile data or another off-LAN network.
Confirm the phone reaches Vega over Nebula using the forwarded public UDP 4242 path.
Confirm DNS resolves through 10.10.0.2 while the tunnel is active.
Confirm public IPv4 egress appears as the home connection rather than the phone’s direct uplink.
Confirm home LAN services remain reachable while the full tunnel is active.
Record any Mobile Nebula quirks such as default-route entry limitations or required split-route workarounds.

Verification

Capture the observed behavior needed to re-test later: route mode used, DNS setting used, and the success criteria for “home egress is active”.

## Goal Prove that the phone can use Nebula to send IPv4 traffic and DNS through Vega from off-LAN, and document any client-specific quirks discovered during validation. ## Context The mobile client must be tested from a real off-LAN path because the public bootstrap and exit-node behavior are only meaningful away from the home network. ## Acceptance Checklist - Connect the phone to Nebula from mobile data or another off-LAN network. - Confirm the phone reaches Vega over Nebula using the forwarded public UDP 4242 path. - Confirm DNS resolves through 10.10.0.2 while the tunnel is active. - Confirm public IPv4 egress appears as the home connection rather than the phone’s direct uplink. - Confirm home LAN services remain reachable while the full tunnel is active. - Record any Mobile Nebula quirks such as default-route entry limitations or required split-route workarounds. ## Verification Capture the observed behavior needed to re-test later: route mode used, DNS setting used, and the success criteria for “home egress is active”.

nimmo added this to the Nebula Mesh Network milestone

2026-07-04 20:52:20 +01:00

nimmo added the

host:fleet

project:nebula-mesh-network

phase:validation

labels

2026-07-04 20:52:20 +01:00

nimmo commented

2026-07-05 10:37:37 +01:00

Author

Owner

Validated successfully from the phone over 4G.

Observed configuration and behavior:

Route mode: split IPv4 default routes 0.0.0.0/1 and 128.0.0.0/1 via Vega (10.10.0.2).
Discovery: only the public lighthouse (10.10.0.1 → 195.20.255.115:4242) is statically mapped; Vega must be learned dynamically.
Off-LAN path: Vega received a direct phone handshake from the carrier address and could ping 10.10.0.30 with 0% loss.
DNS: Mobile Nebula requires manually setting resolver 10.10.0.2.
Mesh service validation: http://lyra.mesh:9999 resolves and works while connected.

Quirks fixed during validation:

Nebula 1.10 requires an inbound local_cidr rule for unsafe-route traffic.
Pinning Vega to 192.168.8.108:4242 prevents off-LAN discovery and causes repeated handshake timeouts.

Relevant commits: 3b4f8a5, 0c1bf45.

Validated successfully from the phone over 4G. Observed configuration and behavior: - Route mode: split IPv4 default routes `0.0.0.0/1` and `128.0.0.0/1` via Vega (`10.10.0.2`). - Discovery: only the public lighthouse (`10.10.0.1` → `195.20.255.115:4242`) is statically mapped; Vega must be learned dynamically. - Off-LAN path: Vega received a direct phone handshake from the carrier address and could ping `10.10.0.30` with 0% loss. - DNS: Mobile Nebula requires manually setting resolver `10.10.0.2`. - Mesh service validation: `http://lyra.mesh:9999` resolves and works while connected. Quirks fixed during validation: - Nebula 1.10 requires an inbound `local_cidr` rule for unsafe-route traffic. - Pinning Vega to `192.168.8.108:4242` prevents off-LAN discovery and causes repeated handshake timeouts. Relevant commits: `3b4f8a5`, `0c1bf45`.

nimmo closed this issue

2026-07-05 10:37:42 +01:00

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

nimmo/nixos-config#49

No description provided.

Rows
Columns