CHG-0063: The Core Router’s Untagged LAN Loses Its Flat-Network Address #

Summary #

The core router’s untagged lan interface still carries 192.168.10.1/23, the address of the flat network that CHG-0001 replaced with VLANs. Its post-migration step to clear it was never done. Nothing uses it: the switch port to re0 is a trunk with native VLAN 999, so no untagged frame reaches lan in normal operation; Kea has no subnet for it; and on 2026-11-12 the router’s ARP table held no address in 192.168.10.0/23 but its own. Recovery of the router is from its console and its management address 10.20.99.1, not from the untagged LAN.

After this change lan stays assigned and enabled, as the parent of every VLAN, with no IPv4 address.

Goal #

• lan (re0) is enabled, with IPv4 configuration type None and no address.
• Every VLAN interface keeps its address, and the core router answers at 10.20.99.1.
• No route, rule or ARP entry for 192.168.10.0/23 remains on the router.
• Kea still hands out leases on its VLAN subnets.

Scope #

In scope: the IPv4 address on lan. Out of scope: the lan assignment itself and re0, which every VLAN rides on; the anti-lockout rule; the Kea reservation 192.168.10.20 (vyos-rt01), tracked in the Reconciliation plan, which turned out to be gone already (see Outcome).

Risk and impact #

Prerequisites #

• Backups taken: make backup-router, sealed into the inventory
• Console access to dv02cor002p01 (Mini DisplayPort monitor, USB keyboard)
• Vault decrypted, collections built

Procedure #

Step 1: Back up the router #

Not disruptive.

Run:

cd ansible-collection-deevnet.net && make backup-router

Verify:

1. The file it names is staged in ansible-inventory-deevnet/backups/mobile/dv02cor002p01/.

Undo: none needed.

Step 2: Clear the address on lan #

Disruptive only if done wrong; nothing uses the address.

Run: in the core router’s GUI, Interfaces → [LAN]: set IPv4 Configuration Type to None, leave Enable ticked, Save, then Apply changes.

Verify:

1. ping -c1 10.20.99.1 answers, from management and from trusted.
2. The read-only interface audit shows lan with no address and every VLAN with its own.
3. A Wi-Fi client on trusted gets a lease and reaches the internet.

Undo: Undo Step 2

Step 3: Back up the router again #

Run: make backup-router, and commit both backups through an inventory pull request.

Verification #

Every item under Goal holds, checked from clients and the router’s API, not from Ansible.

Undo #

Undo Step 2 #

In the GUI, Interfaces → [LAN]: IPv4 Configuration Type back to Static IPv4, address 192.168.10.1/23, Save, Apply changes. If the GUI is unreachable, restore the Step 1 backup from the console, as rehearsed in CHG-0061.

To close #

This change closes when every item below is done. One line each: the steps and the check.

• Step 1: router backed up (the 2026-11-11 backup; see Departures)
• Step 2: address cleared on lan
• Step 3: router backed up again
• Verification: Goal holds from clients and the router’s API

Outcome #

Completed after the change has run.

Departures from the plan #

• No fresh backup before Step 2. The router’s last backup, from 2026-11-11, is the pre-change state; nothing else changed on the router in between.
• Ping to 10.20.99.1 from management does not answer, and did not before. The router’s log shows it blocked by the default deny: since CHG-0007 management reaches the router itself on 443 and 22 only. Verification used 443 instead.

Follow-ups #

• Core Router console recovery checked the router with ping -c1 10.20.99.1, which the zone policy blocks from management. It and five other runbook pages now check ARP or the router’s port 443 instead.