# Zero-Leak Verification & Troubleshooting Runbook
## Validation Test Battery & Operational Diagnostics

This runbook provides empiric packet capture verification procedures, end-to-end connectivity tests, and diagnostic playbooks to validate that the ThinkPad T490 edge gateway is 100% invisible to the friend's Wi-Fi network with zero broadcast/multicast leakage.

---

## 1. 6-Part `tcpdump` Zero-Leak Validation Suite

Run these tests on the **ThinkPad T490** while generating active internet traffic and downloads inside Proxmox VMs.

### Test 1: Rogue DHCP Server & Broadcast Snooping
*Objective: Prove that `dnsmasq` or internal DHCP offers/requests never escape over the Wi-Fi interface (`wlan0`).*

```bash
sudo tcpdump -i wlan0 -nn -vvv "(port 67 or port 68)"
```
- **Pass Criteria**: You should observe **0 packets** during normal operation, or strictly T490's own DHCP client renewal to `10.0.0.1`.
- **Fail Criteria**: Any DHCP Offer, ACK, or request mentioning `172.16.100.X` or `192.168.45.X`.

---

### Test 2: Un-NATed Private IP Leakage Detection
*Objective: Prove that no internal homelab packets egress `wlan0` without SNAT.*

```bash
sudo tcpdump -i wlan0 -nn "src net 172.16.100.0/24 or src net 192.168.45.0/24"
```
- **Pass Criteria**: **0 packets captured** while streaming video or running `curl` inside VM `192.168.45.101`.
- **Fail Criteria**: Any packet with a source IP of `172.16.100.X` or `192.168.45.X` appearing on `wlan0`.

---

### Test 3: Broadcast, Multicast & Discovery Bleed Test
*Objective: Prove zero mDNS, LLMNR, NetBIOS, SSDP, or WS-Discovery broadcasts escape onto the friend's Wi-Fi network.*

```bash
sudo tcpdump -i wlan0 -nn "udp port 5353 or udp port 5355 or udp port 137 or udp port 138 or udp port 1900 or udp port 3702 or ip multicast or ip broadcast"
```
- **Pass Criteria**: **0 packets captured**.
- **Fail Criteria**: Any outbound discovery packet egressing `wlan0`.

---

### Test 4: ARP Isolation & Proxy ARP Verification
*Objective: Confirm that T490 never responds to ARP queries on `wlan0` for internal IP addresses.*

```bash
sudo tcpdump -i wlan0 -e -nn "arp"
```
- **Pass Criteria**: Only ARP queries/replies for the T490's own Wi-Fi IP (e.g. `10.0.0.142`) and the AP gateway (`10.0.0.1`). Proxmox physical MAC addresses must **never** appear in `wlan0` frames.

---

### Test 5: ICMP Redirect Suppression Test
*Objective: Confirm the Linux kernel never sends Type 5 ICMP redirects when forwarding homelab traffic.*

```bash
sudo tcpdump -i wlan0 -nn "icmp[icmptype] == icmp-redirect"
```
- **Pass Criteria**: **0 packets captured**.

---

### Test 6: Friend LAN Lateral Isolation Test
*Objective: Verify that VMs cannot probe, scan, or access personal devices on the friend's `10.0.0.0/24` LAN.*

Execute inside any Proxmox VM (e.g. `192.168.45.101`):
```bash
# Ping friend's router directly
ping -c 3 10.0.0.1     # Should be DROPPED by nftables forward filter

# Ping friend's personal laptop
ping -c 3 10.0.0.50    # MUST TIME OUT

# HTTP probe to friend router web UI
curl -m 3 http://10.0.0.1 # MUST TIME OUT

# External Internet connectivity
curl -m 3 https://1.1.1.1 # MUST SUCCEED (Returns 200/301)
```

---

## 2. Path MTU & Throughput Validation

Verify that TCP MSS Clamping prevents packet fragmentation stalls:

```bash
# Inside VM 192.168.45.101:
curl -I https://speed.cloudflare.com/__down?bytes=10000000
```
If the download completes at full line-speed without stalling, Path MTU discovery and MSS clamping are operating properly.

---

## 3. Operational Troubleshooting Playbook

| Symptom | Probable Cause | Diagnostic Command | Remediation |
| :--- | :--- | :--- | :--- |
| **VMs cannot access Internet** | Kernel IP forwarding disabled on T490 or Proxmox | `sysctl net.ipv4.ip_forward` | Run `sudo sysctl -w net.ipv4.ip_forward=1` on both nodes. |
| **VMs cannot resolve domain names** | DNS server unreachable or blocked | `dig @1.1.1.1 google.com` inside VM | Check `dnsmasq` status on T490 (`systemctl status dnsmasq`) and `nftables` input chain rules. |
| **Proxmox GUI unreachable over Tailscale** | Subnet route not approved | Tailscale Admin Console | Go to Tailscale Admin Console -> Edit Route Settings -> Enable `192.168.45.0/24`. |
| **Wi-Fi connection drops after idle** | Wi-Fi power saving enabled | `iw wlan0 get power_save` | Add `options iwlwifi power_save=0` to `/etc/modprobe.d/iwlwifi.conf` and restart. |
| **T490 sleeps when lid is closed** | `logind` ignoring override or sleep target active | `systemctl status systemd-logind` | Run `sudo systemctl mask sleep.target suspend.target hibernate.target`. |