# Bastille Host Networking Troubleshooting

Use this file when `warden0` is missing or not configured correctly.

## Quick checks

```sh
ifconfig warden0
```

Expected:
- interface exists
- `inet 192.168.100.1`

```sh
sysrc -a | grep -E 'cloned_interfaces|ifconfig_bridge0_name|ifconfig_warden0'
```

Expected:
- bridge persistence lines exist

```sh
sysctl net.inet.ip.forwarding
```

Expected:
- `net.inet.ip.forwarding: 1`

## Common failure signatures

### `BRIDGE_EXISTS: false`

Likely cause:
- host bridge was created interactively but not persisted
- host rebooted
- bridge rename was never saved

### `BRIDGE_HAS_GATEWAY: false`

Likely cause:
- `warden0` exists but the address was never assigned
- wrong `rc.conf` line

### Jail has route but no internet

Likely cause:
- host forwarding disabled
- `gateway_enable` not set persistently

Response:
- set `gateway_enable="YES"` in `/etc/rc.conf`
- apply `sysctl net.inet.ip.forwarding=1`
- then continue to `warden-pf` for NAT validation

### VNET jail has correct IP but no default route

Likely cause:
- Bastille create path omitted the explicit Warden gateway

Observed pattern:
- jail has the expected `192.168.100.x/24` address
- `netstat -rn` inside the jail has no `default` entry

Response:
- recreate or provision with:
  - `-g 192.168.100.1`

### Archived console log shows `add net default: gateway 51.83.197.1 ... Invalid argument`

Interpretation:
- the jail boot sequence attempted to install the host uplink gateway
- that is the wrong gateway for the Warden subnet

Meaning:
- Bastille VNET creation is incomplete or wrong
- this is not a DNS or NAT problem yet

Response:
- fix the create path to use:
  - `-g 192.168.100.1`

### Successful VNET thick jail creation prints `e0a_*` and `e0b_*`

Interpretation:

- Bastille created the epair pair for the jail successfully
- this is a normal success signature, not an error

Typical examples:

- `e0a_db`
- `e0b_db`
- `e0a_bastille1`
- `e0b_bastille1`

If these appear together with `Applying template: default/vnet...` and
`Creating a thickjail...`, treat that as successful VNET bring-up evidence.
