The back door
Reconstruction⚠ This is not a live capture: it is a condensed reconstruction, edited afterwards from the real transcript of the September 23 and 24, 2026 sessions. Ludo's prompts are quoted word for word, typos included, except the host name, replaced by the article's; tool output is rewritten and shortened, the timing is compressed and names are sanitized.
The problem already had a name in the lab: hosts plugged into two VLANs that answer from the right address but through the wrong leg, and a pfSense that drops what it sees coming back through the wrong door. The session picks the thread up again after a detour through the Mac. From the Mac, a 200 MB transfer goes through; from cloud-01, outside both networks, ping works and TCP fails. The first manual try sets no rule at all, because the variable never split under zsh. Redone through standard input, it gives the clean signature: failure, banner, failure.
Rules 100 and 101 go first on a witness, vm-02, then on all nine hosts through a
NixOS module, labo.dualHomed, after a manual try on each of the two other
wiring styles. Eighteen legs out of eighteen answer from cloud-01.
The next day, an SSH session from the Mac freezes. It is the case the agent had set aside the day before on the strength of a ten-second transfer, too short to ever meet a thirty-second idle timeout. Rule 102 fixes it. In the evening, the freeze is back on port 2222: the reply leaves from a Docker container, so from an address rule 102 never looks at. A connection mark and a rule 103 close that last door.
The mechanism, piece by piece, is in Corollary: Linux Answers Politely, but Through the Back Door; the failure itself is filmed for real in the real take.