# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

---

# REPORT — S3 appendix: CGNAT smoke test (operational validation, docs-only in this repo) (2026-07-04)

Ran the deferred S3 appendix: the one open transport caveat in `06-offsite-connectivity.md` §7 —
does plain-WireGuard (box dials out + `PersistentKeepalive=25`) establish and **hold** a mapping
through a mobile-carrier NAT? Executed live on **felhom-pve** (`demo-felhom`, agent v0.64.0) with a
USB-tethered Xiaomi Mi 11i. No code touched; the only host changes were runtime `ip`/`dhclient`
one-shots, all reverted to the Phase-0 baseline at the end.

**Method (surgical, SSH-safe):** kept the box on its wired default; steered **only** ep0's `/32`
out the phone so just the tunnel's outer UDP traversed the carrier NAT. Neutralized the phone's
RA-provided IPv6 + pinned ep0→v4 so the tunnel took the **v4/NAT** path (not un-NATed v6). 32-min
idle soak sampling handshake age every 30 s. Full restore verified against the captured baseline.

**Findings:**
- **Uplink:** phone got a **public mobile IPv4** (`84.225.188.131`, Magyar Telekom) — a real
  single-NAT traversal (phone tether NAT), **not** true CGNAT `100.64/10`. Recorded as such.
- **Handshake/PBS:** established over the mobile NAT path (endpoint v4 `167.233.158.164:443`);
  in-tunnel ping 4/4 ~57 ms; PBS login page reachable **after** the MTU fix.
- **MTU (actionable):** outer path MTU ~**1400 B** → shipped `wg-felhom` MTU 1420 **black-holed
  bulk data** (ping/handshake healthy, PBS page empty). MTU **1340** (= 1400 − 60) restored it;
  1360 failed. Recorded in §4.3 with an **OPEN DECISION**: permanent fleet-wide lower MTU vs
  connection-type-dependent (1420 fixed-line / ≤1340 mobile, or MSS clamp).
- **Soak:** 64 samples, max handshake age 125 s (normal rekey), **zero stalls**, final ping after
  32 min idle with no bounce → **mapping held on keepalive alone.**
- **v6 trap:** a dual-stack mobile uplink made `wg-quick` prefer the endpoint AAAA and ride
  un-NATed IPv6 until v4 was forced (recorded in §4.2).

**Doc edits (this commit):** `06-offsite-connectivity.md` — §7 open-validation **CLOSED**;
§4.3 MTU mobile finding + open decision; §4.4 keepalive 32-min mobile hold; §4.2 dual-stack v6
trap; §8 S6 row updated. Runbook: `RUNBOOK-s3-cgnat-smoke`.

**Still open:** true-CGNAT-SIM retest (deferred, low risk — "when able"); the §4.3 MTU
permanent-vs-per-connection decision; S4 PBS-over-tunnel; S5 DR consume; S6 tunnel-health alerting.