VPN-GW-RU unified admin console

… dry-run drift: — — Help

Dashboard

VPN Clients (first-class managed objects)

A client is created once; the private key is shown exactly once and is never stored, logged or exported. A second copy requires an explicit key rotation. Addresses always come from the canonical plan — reserved ranges are never issued. ?
id name comment managed DNS 

  


  

    
LAN Resources (internal destinations)

    
Host, subnet or service. Optionally restrict to a protocol and
      ports (TCP 445, TCP 80/443, UDP, ICMP). The id is the security identity;
      name and comment are editable labels.
      ?
      ?

    

    

    

      id 
      name 
      kind 
      CIDR 
      protocol 
      ports 
      mode 
      
    

    
LAN Groups

    

    

      id 
      members 
      comment 
      
    

  


  

    
LAN Access Policies (default DENY)

    
A client reaches only what is explicitly granted. Denied local
      traffic is dropped before routing and can never leave as Internet traffic.
      ?
      ?

    

    

    

      subject 
      grants 
      
      
      
    

    

  


  

    
Internet Policies (chain: primary › foreign fallback › terminal)

    
Change of the Internet Exit never changes LAN permissions, and
      the Internet kill-switch never blocks a granted LAN resource.
      ?
      ?
      ?

    

    

  


  

    
AUTO Profiles & decision engine

    
AUTO chooses the Path with the explainable score, honouring
      hysteresis, hold-down, delayed failback and a minimum improvement.
      ?

    

    

  


  

    
Exits & Paths

    

    
Technical identifiers (marks, routing tables, transport
      identities) are shown in the debug/details view only.

    

  


  

    
Proxy Profiles (browser / site / application layer)

    
Stable HTTP CONNECT + SOCKS5 listeners on the trusted LAN/VPN.
      An AUTO Path change needs no browser or application change. The internal egress
      address is never shown — only “configured: yes/no”.
      ?

    

    

    

      id 
      name 
      mode 
      exit 
      path 
      
    

  


  

    
Domains / PAC (exact / suffix → stable profile)

    

    

      pattern 
      kind 
      target 
      priority 
      
    

    

    
Internal sites (split DNS / hairpin)
      ?
      ?

    

    

    

    

      hostname 
      internal IP 
      kind 
      ports 
      CDN/shared 
      
      
    

    

  


  

    
Managed Guests (Proxmox LXC / QEMU egress)

    
A managed guest reaches the Internet only through
      vpn-gw-ru as its real L3 gateway. The managed source address is a
      resolved attribute, never the guest identity; no secrets are shown.
      Enrollment is PREVIEW-first.
      ?

    

    

    

    

      VMID 
      type 
      cluster 
      pattern 
      exit 
      mode 
      
      
    

    

  


  

    
Domain Routing (Phase 14B — templates, lists, personal rules)

    
Transparent domain-aware routing: an enrolled client's Internet
      flow is classified by sniffed hostname, mapped to a logical Traffic Class by
      system rules › personal overrides › assigned templates ›
      client default, and steered by the existing Exit/Path
      policy engine. Xray never chooses the physical Exits; LAN/internal destinations
      never enter Xray.
      ?

    


    

      
      
      
      
      
    


    

      
Global gate:
        
        
        

      
Traffic Classes (class → Internet Policy → effective Path)

      

      
Enrolled clients

      

      
System mandatory rules (cannot be overridden)

      

      
Config generation / drift

      

      
?
        ?

    


    

    

    

    
  


  

    
Traffic Analytics (per-client telemetry, separate traffic.db)

    
Connection history is collected only for clients whose
      logging mode is not OFF. Public source and destination IPs are
      stored on purpose when logging is enabled; there is no TLS interception, no URL or
      path and no request body. Byte totals come from the WireGuard peer counters and are
      shown as client totals only — Xray exposes no per-flow or per-domain
      volume, so none is shown.
      ?

    

      period
      
      
      
      
      
      
      
      
    

    

      
      
      
      
      
      
    


    

      

      
Connections by TrafficClass / Exit / Path

      

      
Top domains (Connections)

      

      
Top destination IPs (Connections)

      

    


    

    

    

    

    
  


  

    
Monitoring & Alerts

    
Availability windows with no collected data are shown as
      “no data yet”; history is never invented.
      ?

    

    

    
Kernel engine (applied state)

    

  


  

    
Audit Log (every policy mutation)

    

    
Recent AUTO switches

    

    

  


  

    
Backups / Recovery

    
Controller state is backed up on a timer and a restore drill is
      part of the deployment. See scripts/phase12-controller-backup.sh and
      scripts/phase12-restore-drill.sh.
      ?

    

  


  

    
Settings (controller-owned only)

    
PREVIEW › APPLY › VERIFY › ROLLBACK. The view
      shows desired, effective, kernel and drift.
      No arbitrary shell, raw nft/iptables, raw SQL, private key dump or OS setting is
      reachable here.

    

    

      setting 
      value