node-config(k3m1-ext): eno1 on DHCP as k3m1-ext, used only by traffic from its own address

Shipped: September 16, 2026 at 5:11 PM UTC
Author: Kamo
Commit: 9b3cbbc

k3m1's third cable is the port the shared bulk relay (postfix-orgs, 47.181.8.86) sends through. DHCP gives it an address and nothing else, so the main table is untouched; rule 1860 sends only traffic from that address to table 186 (eno1's router, with an unreachable floor); an nftables table of its own lets only SMTP in; ARP is pinned per NIC so the router never confuses it with eno49 (k3m1). Applied on k3m1 2026-09-16 (lease 192.168.4.56). README has the invariants and the two things never to run on this host.

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free Forever View Pricing