---
name: lan-port-and-asymmetric-mgmt-access
description: Wired LAN port bridged into br0; never SSH to 10.42.0.1 from the upstream LAN (asymmetric path drops at ~125s)
metadata: 
  node_type: memory
  type: reference
  originSessionId: 319a7835-e94a-4021-a56f-dc5714162cf0
---

Two facts about reaching/managing wayback's LAN side.

**Wired LAN port.** `enx00e04c331140` is now a LAN port, bridged with the AP wlan into
`br0` (gateway 10.42.0.1/24, dnsmasq DHCP .10–.254). The 10.42.0.1 IP, NAT (`oifname != br0`),
and dnsmasq all moved off the wlan name onto `br0`. Files in `~/vanlink/ap/`:
`20-van-br0.netdev`, `21-van-br0.network`, `22-van-lan.network`; hostapd has `bridge=br0`
(hostapd, not networkd, enslaves the wlan — a station-mode wlan can't be bridged until AP mode).
Starlink (`enxd8ec5eeb3512`) is untouched and stays the failover WAN.

**Don't SSH to 10.42.0.1 from a host on the 192.168.10.0/24 LAN.** It's the LAN-side gateway IP;
a request from the upstream LAN comes *in* via ZeroTier (the only route to 10.42.0.0/24) but the
reply goes *out* `wlp1s0` directly (on-link metric 100 beats the ZT route metric 5000) — asymmetric.
The SSH session then dies at ~125s because the ZeroTier UDP transport's return-leg conntrack entry
(`nf_conntrack_udp_timeout_stream = 120`) expires with no return traffic. Confirmed, not worth fixing
(the connmark policy-routing fix was declined). Instead use DNS that matches location:
`wayback.lo.wrede.pvt` when local (direct LAN, symmetric, solid) or `wayback.zt.wrede.pvt` when
remote. See [[zerotier-managed-dns]] and [[wayback-campervan-ap]].