fix(doctor): the gateway does not answer ping — by design, so stop asking #43

Merged

dan-claude-bot merged 1 commit from fix/doctor-gateway-ping into main

2026-07-14 11:59:27 +00:00

dan-claude-bot commented

2026-07-14 11:58:37 +00:00

(Migrated from github.com)

Fifth false alarm, caught live on the drill host immediately after #42 let the probe section run to completion for the first time:

  DIRTY cannot even reach the gateway — this is routing, not DNS
  OK    resolves deb.debian.org — DNS works

Verdict
  1 problem(s) — this host is NOT fit to drill.

A verdict of not fit to drill on a host that resolves DNS through the gateway it just called unreachable.

Why the ping can never succeed

claudebox-firewall.sh protects the host's own sockets from its boxes — that is its job:

udp dport { 53, 67 } accept
tcp dport 53 accept
drop                      ← ICMP echo to 10.87.0.1, every time, on purpose

So "can the box ping the gateway" is a probe whose failure is the designed state. It does not measure routing; it measures the firewall doing its job, and calls that a fault.

The fix

Probe routing the way the README states the contract: a box reaches the public internet. curl https://1.1.1.1 by address — DNS not involved, gateway traversed as a router (FORWARD path, which is open) rather than as a destination (INPUT path, which is closed by design). The DNS-failure branch reuses that one probe's result instead of running the identical curl a second time.

With this, the doctor on the live host should finally read clean — fit to drill, with issue #33's pin verified in the same breath:

  OK    claudenet has a pinned resolver (raw.dnsmasq: no-resolv;server=1.1.1.1;…)
  OK    reaches 1.1.1.1 by address — egress routing is fine
  OK    resolves deb.debian.org — DNS works

🤖 Generated with Claude Code

Fifth false alarm, caught live on the drill host immediately after #42 let the probe section run to completion for the first time: ``` DIRTY cannot even reach the gateway — this is routing, not DNS OK resolves deb.debian.org — DNS works Verdict 1 problem(s) — this host is NOT fit to drill. ``` A verdict of *not fit to drill* on a host that resolves DNS **through the gateway it just called unreachable**. ## Why the ping can never succeed `claudebox-firewall.sh` protects the host's own sockets from its boxes — that is its job: ``` udp dport { 53, 67 } accept tcp dport 53 accept drop ← ICMP echo to 10.87.0.1, every time, on purpose ``` So "can the box ping the gateway" is a probe whose failure is the **designed state**. It does not measure routing; it measures the firewall doing its job, and calls that a fault. ## The fix Probe routing the way the README states the contract: *a box reaches the public internet.* `curl https://1.1.1.1` by address — DNS not involved, gateway traversed as a router (FORWARD path, which is open) rather than as a destination (INPUT path, which is closed by design). The DNS-failure branch reuses that one probe's result instead of running the identical curl a second time. With this, the doctor on the live host should finally read **clean — fit to drill**, with issue #33's pin verified in the same breath: ``` OK claudenet has a pinned resolver (raw.dnsmasq: no-resolv;server=1.1.1.1;…) OK reaches 1.1.1.1 by address — egress routing is fine OK resolves deb.debian.org — DNS works ``` 🤖 Generated with [Claude Code](https://claude.com/claude-code)

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/box#43

No description provided.