WiFi Gateway Migration

New gateway installed 2026-08-25 evening · dashboard updated 19:10 PT · FORWARDS LIVE · Public IP changed → 24.4.141.142

Port forwards — DONE ✅ (via admin tool, 19:05 PT)

Duma set these directly at http://10.0.0.1 (Advanced → Port Forwarding) — the Xfinity app was never needed. Verified from an external server (IONOS VPS):

port	to	for	external test
`443/tcp`	capetown .85	Caddy — gpu/ai/fatty/request/sfo	OPEN · gpu 200 ✓
`80/tcp`	capetown .85	ACME fallback	OPEN
`6666/tcp`	duma .33	SSH — mirror.sahirm.com	OPEN
`51820/udp`	capetown .85	WireGuard — vpn.sahirm.com	added — awaits peer handshake

Gotcha found: a forward whose target IP isn't an active lease gets silently dropped despite "Success!" — the 6666 rule had to be re-added after this VM re-leased .33.

Domain map — what lives where

domain	routes to	needs forward?	status
`mirror.sahirm.com`:6666	SFO VM (Duma) SSH	6666/tcp → sahir-ubuntu-vm	up (verified external)
`vpn.sahirm.com`:51820	capetown WireGuard	51820/udp → capetown	forwarded — peers reconnect on next handshake
`gpu.sahirm.com`	capetown Caddy → Jetson ASR (10.0.0.55)	443/tcp → capetown	up (200 external)
`ai / fatty / gptr / request / sfo`.sahirm.com	capetown Caddy → various services	443/tcp → capetown	up (via 443 forward)
`bots.sahirm.com`	capetown Caddy (Dynu A → 10.0.0.85, LAN/VPN-only)	none	unaffected
`artifact.sahirm.com`	IONOS VPS (162.222.204.108)	none — off-site	unaffected
`allan.sahirm.com`	Fitlet at Allan's house	none — off-site	unaffected

All capetown-fronted domains restored 19:05 PT once the 443 forward went in. mirror.sahirm.com:6666 SSH verified externally after this VM flipped back to .33.

Done (automated)

Recon: LAN subnet survived as 10.0.0.0/24; all ESXi VMs poweredOn; capetown / kigali / cairo / jetson / ESXi reachable
dnsupdater self-healed 18:22 PT → updated ai · fatty · gptr · request · sfo · vpn · gpu .sahirm.com to the new IP
mirror.sahirm.com (updater choked on it) — fixed by hand via Dynu API
IPv6 AAAA audit: nothing points at the old home prefix; the sahirm.com/www/ai AAAA records are Dynu's own parking infra (pre-existing)
Office Bridge mystery solved: reachable at .103 via SSH all along — Windows firewall blocks ping
Smart mirror back online at .125 (rejoined or wired)
gpu.sahirm.com triaged: service healthy, only the missing 443 forward blocked it — now restored
DHCP reservations set via admin tool (19:00 PT): duma→.33, capetown→.85, kigali→.144, cairo→.83, Home Assistant→.222 (identified via ESXi: MAC ad:15:4c), jetson→.55, OFFICE-BRIDGE→.103, mirror pi→.125, S25 Ultra→.69. Found & fixed half-broken "Reserved IP with blank address" entries on all the VMs.
This VM flipped .192 → .33 (lease bounce) — bot-tracker, docs, cross-bot SSH all valid again with zero edits
All 4 port forwards created + verified from IONOS VPS (443/80/6666 confirmed open; 51820 rule in place)
Gateway admin credential saved to Vaultwarden ("Xfinity Gateway Admin (10.0.0.1)"); Vaultwarden itself verified healthy (unlock + sync + write OK)

Still needs Sahir

WiFi: if the SSID/password differs from the old network, either recreate the old SSID+password or re-provision the remaining WiFi devices (S25 Ultra still off-network)
Phone rejoin → .69 reservation already waiting for its known MAC (note: if the phone uses per-network randomized MAC on a new SSID, the reservation needs a re-do with the new MAC)
Optional: disable xfinitywifi public hotspot in the app
Optional: WireGuard remote peers (laptop/phone off-LAN) — restart the tunnel once to re-handshake vpn.sahirm.com

Watching / verify after

Verify MagicMirror display renders (pi is pingable again)
Home Assistant confirmed at .222 (reserved); IoT device sweep still pending
Phone rejoin → reserve .69 (ADB skill hardcodes it)
bots.sahirm.com outside-403 re-test (previous test hit the dead IP)
dnsupdater next cycles — all home records = 24.4.141.142

Network state + MAC cheat sheet

The ESXi VMs all share VMware's 00:0c:29 MAC prefix and look identical in the Xfinity app. Fix: tap device → Device Details (shows MAC) → Edit Device Name. Match by the bolded hex bytes: