The Dreamwall appliance sits at 192.168.1.1 and handles:
| Service | External Endpoint | Internal Target |
|---|---|---|
| SSH to PVE1 | 108.31.169.90:2225 | 192.168.1.90:22 |
| SSH to PVE2 | 108.31.169.90:2226 | 192.168.1.9:22 |
10.50.XX.20)10.51.XX.0/24 per pod, gateway 10.51.XX.1 (that pod's pfSense PodXX-GW, VMs 300–319)| IP | Host | Role |
|---|---|---|
| 192.168.1.1 | Dreamwall | Edge firewall / gateway |
| 192.168.1.9 | PVE2 | Secondary hypervisor |
| 192.168.1.42 | crc-wiki-01 | Wiki.js documentation |
| 192.168.1.51 | crc-guac-gateway-01 | Guacamole (student access) |
| 192.168.1.55 | crc-proxy-gateway-01 | Nginx reverse proxy |
| 192.168.1.61 | crc-ai-ide-01 | OpenHands + CyberLab Portal |
| 192.168.1.90 | PVE1 | Primary hypervisor |
| 192.168.1.103 | crc-awx-k8s-01 | AWX automation server |
| 192.168.1.169 | crc-lms-001 | Learning Management System |
| 192.168.1.227 | crc-pbs-001 | Proxmox Backup Server |
PVE1 acts as the router between the management LAN and the lab network:
vmbr0 interface: 192.168.1.90 (management)pod01net interface: 10.50.1.1 (lab gateway)Students reach their pod's pfSense UI from a browser inside their own
PODXX-SRV member-server desktop, at http://10.51.XX.1 (Pod 06 → http://10.51.6.1). Sign-in
uses the instructor-provided firewall credentials.
There is no Guacamole tile for the firewall. The 20 PODXX-GW connections were
created with protocol http, which guacd does not implement
(Support for protocol "http" is not installed), so clicking one failed and the
tile's autoretry looped. Those tiles are hidden from students; the connection
objects still exist for administrators. PodXX-GW remains the firewall's name in
diagrams and in Proxmox.
Both documented paths to pfSense were dead:
10.50.XX.0/24, while each pfSense10.51.XX.0/24, and nothing routed between them.Routing is now a boot-persistent service on the Guacamole/gateway host
(192.168.1.51, VM 100), which is attached to all 20 pod bridges:
pod-routing.service → /usr/local/sbin/pod-routing.sh, enabled and active.10.51.XX.2/24 on that pod's interface, a SNAT to thatDOCKER-USER ACCEPT rules scoped to the single matching10.50.1.10/32 (DC01, directory services) may reach every pod's10.51.XX.0/24, because all students currently share that desktop. After thePODXX-SRV.