Christoph Emsenhuber 909e604ea6 TP23 Stufe 6: Bypass-Sperre-Entwurf abgelegt (log-only + reject), NICHT deployt ...

Zwei RouterOS-Skripte fuer die DNS-Bypass-Sperre der TP5-forward-Kette,
gespiegelt am TP5-Etappen-Stil (idempotent, place-before, Auto-Revert):
- phaseA: Substrat (dns-resolvers/dns-bypass-exempt/jit-dns-bypass) +
  Exempt/JIT-Accepts + log-only TP5-WOULD-DROP-DNS.
- phaseB: reject icmp-port-unreachable + Auto-Revert-Scheduler.

Freigegeben 2026-09-11, bewusst NICHT deployt (Christoph remote, hartes
Vor-Ort-Gate). Zwei Live-Verifikationen vor dem Deploy im Dateikopf markiert:
Egress-Accept-Anker der forward-Kette + Exempt-IPs des dev-MacBooks
(MikroMCP war beim Schreiben zu allen Geraeten tot -> nicht geraten).
log-only wird beim Deploy als gc-Transaktion gefuehrt.

Runbook-Zeiger auf beide Dateien ergaenzt.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-09-12 11:50:22 +02:00

..

cf-backup

Stand der Parallelsession eingesammelt (TP39 archiviert, TP41-Backup, TP25 ap2-Verdacht)

2026-09-01 09:20:03 +02:00

messdaten

TP25: Transaktion-State committed + Messrunden 2026-09-04

2026-09-04 19:43:28 +02:00

nas-vlan20

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

portainer-upgrade-20260828

Portainer 2.40 → 2.42.0 Bump + portainer-mcp projektspezifisch

2026-08-28 21:17:52 +02:00

research

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-marker

TP25: Klick-Konsole auf N Clients + Pin-UI

2026-09-04 14:18:07 +02:00

transaktionen

TP25: Transaktion-State committed + Messrunden 2026-09-04

2026-09-04 19:43:28 +02:00

allnet-ge8-trunk-klickanleitung.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

call-quality-diagnosis.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

call-quality-handout.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

cf-tunnel-mapping.md

TP44: cf-tunnel-mapping §0 Live-Kopf + §10-16 als ARCHIV eingeklappt

2026-09-08 15:50:31 +02:00

core-switch-prep.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

doku-cleanup-session.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

firmware-flash-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-20260822-naechste-schritte.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-20260823-session.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-20260824-session.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-20260825-agh-dns-cutover.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-20260826-agh-dns-cutover.md

handoff: 2026-08-26 — AdGuard DNS-Cutover fortsetzen (TP23/TP31)

2026-08-26 17:51:07 +02:00

handoff-20260826-tp31-suffix-sweep.md

handoff: 2026-08-26 — TP31 Schritt 4 fortsetzen + Suffix-Sweep

2026-08-26 20:58:51 +02:00

handoff-20260827-hubert-und-altlasten.md

aufräumen: Inventar-Pipeline stillgelegt, Root-handoff ins docs/, README präzisiert

2026-08-27 21:34:58 +02:00

handoff-20260827-inventur-und-architektur.md

Korrektur: bf-infra HAT ein Gitea-Remote (Inventur-Aussage vom 08-27 ueberholt)

2026-08-30 11:43:24 +02:00

handoff-20260828-mcp-bestand-und-performance.md

MCP-Bestand korrigiert + Mac-mini-Performance-Restriktion

2026-08-28 18:40:05 +02:00

handoff-20260828-mcp-cleanup-und-shelly-tote.md

handoff: 2026-08-28 — MCP-Cleanup, shelly-mcp-Tote, nächste Schritte

2026-08-28 14:40:08 +02:00

handoff-20260828-portainer-bump-und-mcp.md

Portainer 2.40 → 2.42.0 Bump + portainer-mcp projektspezifisch

2026-08-28 21:17:52 +02:00

handoff-20260828-pre-opencode-migration.md

handoff: pre-opencode-migration, backups done, plan open, mid-action correction received

2026-08-28 15:18:06 +02:00

handoff-20260828-session-a-projektstatus.md

TP35 Schicht 6: /projektstatus-Skill in opencode aktiviert + Doku

2026-08-28 19:15:02 +02:00

handoff-20260828-terpene-mcp-migration-cf-tokens.md

Handoff 2026-08-28 (Abends): terpene W1-W7 + globale MCP-Migration + CF-Token-Diagnose

2026-08-28 23:51:46 +02:00

handoff-20260830-ap3.md

TP28: ap3 (cAP ax) live als CAP, ap1 funkstill, Compliance 130/130 ueber 5 Geraete

2026-08-30 17:54:07 +02:00

handoff-20260831-fund-e-hebel1-gezogen.md

sshpass -p repo-weit weg + vier TP15-Cutover-Skripte archiviert

2026-08-31 08:34:08 +02:00

handoff-20260831-tp16.3-paragraph2-3-durch.md

Merge main + nervous-williams; Drift-Zuschreibung korrigiert

2026-08-31 19:34:40 +02:00

handoff-20260831-tp16.3-vorort-session.md

Merge remote-tracking branch 'origin/claude/nervous-williams-acf000' into claude/stoic-khayyam-09b644

2026-08-31 19:33:14 +02:00

handoff-20260831-tp27-upgrade-und-hebel1-befund.md

TP25 Fund E: Hebel 1 gescheitert, TP27 durchgezogen, Fund B entwarnt

2026-08-31 15:27:57 +02:00

handoff-20260831-wlan-fund-e.md

TP25 Fund E: Befund nach einer Nacht Logging -- Reauth-Schleife haengt an ft=yes, Hebelreihenfolge korrigiert

2026-08-31 07:57:36 +02:00

handoff-20260901-fund-e-hebel1-zurueckgebaut.md

TP25 Fund E: Hebel 1 widerlegt und zurueckgebaut -- Ringpuffer-Messfehler korrigiert

2026-09-01 09:21:46 +02:00

handoff-20260901-n8n-mcp-ssrf.md

n8n-mcp SSRF-Fix: permissive + in Portainer-Stack 174 gefaltet

2026-09-01 21:04:11 +02:00

handoff-20260901-tp16.3-paragraph5-flip-durch.md

TP16.3 §6 Abbau durch, TP GESCHLOSSEN (User zog §6 vor)

2026-09-01 01:08:34 +02:00

handoff-20260901-tp25-ap2-verdacht.md

Stand der Parallelsession eingesammelt (TP39 archiviert, TP41-Backup, TP25 ap2-Verdacht)

2026-09-01 09:20:03 +02:00

handoff-20260901-tp41-followup.md

TP41 abschließen: Google/GitHub ✅, FB abgesagt; Geli CF-seitig fertig (zt-humans-Enrollment + geli-Policy live geprüft)

2026-09-01 20:42:41 +02:00

handoff-20260901-tp41.md

TP41: T5-Anleitung (IdP-Callbacks) + TP30 Posten #7 (Terpene-Keystore-PW-Leak)

2026-09-01 19:20:52 +02:00

handoff-20260901-tp42-naming.md

TP41: T4/T3/T2 durch (zt-svc, WARP-intern .36/.37, vw/admin 404 origin); Token-Altlast geklärt; TP42 angelegt

2026-09-01 19:19:52 +02:00

handoff-20260902-cf-estate-nautobot-ssot.md

TP44: Überholt-Zeiger auf falsche CF_API_TOKEN-Gotcha (Handoff 09-02)

2026-09-11 10:58:18 +02:00

handoff-20260902-tp25-fund-e-messung.md

TP25 Fund E geschlossen: 7.24.1 war die Ursache, nicht ft-over-ds

2026-09-02 08:44:32 +02:00

handoff-20260903-tp25-tp28-kanalplan-messung.md

Handoff 2026-09-03: TP25/TP28 Kanalplan live, In-situ-Messung in naechster Session

2026-09-03 21:38:44 +02:00

handoff-20260904-tp25-konsole-n-clients.md

TP25: Klick-Konsole auf N Clients + Pin-UI

2026-09-04 14:18:07 +02:00

handoff-20260906-tp37-34-36-plan.md

TP44 nachgezogen + TP37/34/36-Plan (native Modelle, erst planen)

2026-09-06 22:32:20 +02:00

handoff-20260910-tp44-teilb-sync-live.md

TP44 Teil B durch: Prosa auf ✅ + Handoff (Sync live, täglicher Job)

2026-09-10 11:15:13 +02:00

handoff-cf-tunnel-1033.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-doku-session-20260818.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-tp6-session.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-tp25-session-20260821.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

hw-refresh-requirements.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

ip-plan.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

manual-flash-howto.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

matter-pairing-infra-ssid-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

mcp-host-policy.md

MCP-Bestand korrigiert + Mac-mini-Performance-Restriktion

2026-08-28 18:40:05 +02:00

routerboot-firmware-klickanleitung.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

session-20260828-decisions.md

drift-korrektur: Auth-Sanierung (Bearer) gehört in TP16.3, nicht als Vorab-Notiz

2026-08-28 17:18:16 +02:00

session-briefing-20260828.md

session-briefing-20260828.md: TL;DR + Lese-Reihenfolge für neue Sessions

2026-08-28 17:33:23 +02:00

sonos-inventar.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

teilprojekte-archiv.md

TP43 reopened: interne BF-Namen über WG am dw — Entscheidung DHCP-Multi [.36/.37/public]

2026-09-11 13:53:41 +02:00

teilprojekte.md

TP43 ✅ umgesetzt: dw-FritzBox-DNS auf FB-Upstream .36/.37 + Rebind-Ausnahme

2026-09-11 14:59:30 +02:00

tp2.1-omada-switch-standalone-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp5-deny-by-default-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-auswertung.py

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-bufferbloat-messung.sh

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-call-run.sh

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-messung-tutorial.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-monitor-core.sh

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-praemisse-messrunbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp7-mdns.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp10-context-digest.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp10-vpn-migration.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp13-botschafts-wlan-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp14.4-cf-access-token-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp15-ap-reset-handoff-20260808.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp15-core-swap-session-handoff-prompt.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp15-core-swap-session-handover.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp15-crs326-session-handoff-prompt.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp15-session-summary-20260808.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp16.1-session-handoff-prompt.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp16.1-warp-mesh-native-crs326.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp16.3-bf-public-ap-connector-runbook.md

TP16.3 §6 Abbau durch, TP GESCHLOSSEN (User zog §6 vor)

2026-09-01 01:08:34 +02:00

tp16.3-nautobot-mesh-only-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp16.3-paragraph5-session-handoff-prompt.md

Uebergabeprompt §5: Repo-Stand, verifizierter Live-Stand, TP30 vertagt

2026-08-31 19:43:24 +02:00

tp17-shelly-go-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp17.1-shelly-gen4-funkmigration-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp19-vlan1-cudy-teardown-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp23-stufe6-bypass-sperre-runbook.md

TP23 Stufe 6: Bypass-Sperre-Entwurf abgelegt (log-only + reject), NICHT deployt

2026-09-12 11:50:22 +02:00

tp25-gehweg-auswertung.py

TP25/TP28: Walk-Harness auf N Geräte, Analyzer generalisiert, AP-Map-Fix

2026-09-04 12:42:30 +02:00

tp25-pin-multi.sh

TP25: Multi-Pin-Tool tp25-pin-multi.sh (band-genaues Pinnen, N Clients je 1 AP)

2026-09-04 13:56:55 +02:00

tp25-pin-s22.sh

TP25/TP28: Walk-Harness auf N Geräte, Analyzer generalisiert, AP-Map-Fix

2026-09-04 12:42:30 +02:00

tp25-runde-20260822-2330-auswertung.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp25-runde-20260822-auswertung.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp25-runde.sh

TP25: Klick-Konsole auf N Clients + Pin-UI

2026-09-04 14:18:07 +02:00

tp25-walk-messung.sh

TP25: Klick-Konsole auf N Clients + Pin-UI

2026-09-04 14:18:07 +02:00

tp25-wlan-roaming-messung-20260820.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp31-schritt5-runbook.md

TP16.3/TP31 Schritt 5: Vor-Ort-Runbook fuer bf-public-Connector (ap1/ap2/ap3)

2026-08-30 21:07:17 +02:00

tp41-t5-idp-callback-anleitung.md

TP41: T5-Anleitung (IdP-Callbacks) + TP30 Posten #7 (Terpene-Keystore-PW-Leak)

2026-09-01 19:20:52 +02:00

vlan1-rueckbau-howto-manuelle-schritte.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

vlan-plan.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

wifi-access-list-erklaert.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

wifi-p750w-coverage-and-map.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00