From 3768657b915c0d184d58943742d9651b9fd02018 Mon Sep 17 00:00:00 2001 From: Michal Date: Sun, 16 Aug 2026 16:49:27 +0100 Subject: [PATCH] chore(migration): firewalls resolve via 8.8.8.8/8.8.4.4 Matches the DNS the USG used on its WAN (wan_dns1/wan_dns2), replacing the 10.0.0.194 I had set earlier. Applied to both boxes and saved; VRRP unchanged (MASTER/BACKUP), NTP still synced, no config drift. /config/modes/unifi.boot was RE-CAPTURED on both afterwards. It had been taken before this change, so the escape hatch would have quietly reverted the resolver on any rollback -- a snapshot is only an escape hatch for the state it was taken from. Two things recorded in the runbook: - The boxes' name resolution now depends on the internet, so between unplugging the USG and PPPoE establishing they have no DNS. Harmless: nothing in the switch resolves a name, and the health checks use DNS precisely to prove the WAN came up. - Internal ad.itaz.eu names still resolve via Google, because that zone is published publicly with private addresses in it (nas001 -> 10.0.0.194, kvm-macstudio1 -> 192.168.3.8). So no conditional forward was needed -- though it is worth knowing the internal topology is public. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01DMVzWZgiKW2wquf5z8S1yH --- migration/CUTOVER.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/migration/CUTOVER.md b/migration/CUTOVER.md index 784f2fd..d666063 100644 --- a/migration/CUTOVER.md +++ b/migration/CUTOVER.md @@ -156,8 +156,15 @@ USG, and debug with the internet back on. LoT — they get their addresses from VyOS now. - **DHCP leases last 24h (86400s).** A device that does not renew promptly keeps its old address for a while. That is fine, not a symptom. -- **The firewalls resolve via `10.0.0.194`**, not the USG. That was changed - ahead of time precisely so they keep DNS when the USG goes away. +- **The firewalls resolve via `8.8.8.8` / `8.8.4.4`** — matching the DNS the USG + used on its WAN. This means their own name resolution now depends on the + *internet* being up, so between unplugging the USG and PPPoE establishing, + the boxes have no DNS at all. That is expected and harmless: they only need + DNS for NTP hostnames, and the switch's own health checks use it precisely to + prove the WAN came up. Nothing in the switch itself resolves a name. +- Internal `ad.itaz.eu` names still resolve through Google, because that zone is + published publicly with private addresses in it (`nas001` → `10.0.0.194`, + `kvm-macstudio1` → `192.168.3.8`). Convenient here; worth knowing it is public. - **The USG was a DNS resolver** for every VLAN except LoT. VyOS now runs `dns forwarding` in its place. If names stop resolving but IPs still work, that is where to look.