---
name: bastille-network
description: Configure persistent host networking for Bastille and the Warden control-plane on FreeBSD. Use when creating or validating the warden0 bridge, making bridge setup survive reboot, or aligning rc.conf with the canonical 192.168.100.0/24 Warden network.
---

# Bastille Network

Use this skill for persistent host networking that Bastille and Warden depend
on.

## Canonical host network

- bridge: `warden0`
- host gateway: `192.168.100.1/24`
- Warden subnet: `192.168.100.0/24`
- control-plane IP: `192.168.100.100`
- workers: `192.168.100.101+`

## Scope

This skill is for:

- host bridge creation
- bridge renaming to `warden0`
- `rc.conf` persistence
- reboot-safe validation

This skill is not for:

- `pf` NAT rules
- Bastille jail creation
- ZFS dataset management

Use `warden-pf` for firewall/NAT and `warden-zfs` for storage.
Use `freebsd-admin` for `gateway_enable`, `sysctl`, and other machine-wide
system changes.

## Workflow

1. Read `references/bridge-model.md`
2. If you need `rc.conf` lines, read `references/rc-conf.md`
3. If you need troubleshooting, read `references/troubleshooting.md`
4. Prefer the scripts in `scripts/` to render and validate the host bridge setup

## Safe defaults

- keep one canonical bridge: `warden0`
- keep one canonical gateway: `192.168.100.1/24`
- make persistence explicit in `rc.conf`
- validate with `ifconfig` after any change
