WAN health probe: ICMP loss and RTT from the physical link, bypassing the host VPN #413

New issue

Closed

opened 2026-10-08 17:02:23 -04:00 by mysticalsoap · 0 comments

mysticalsoap commented

2026-10-08 17:02:23 -04:00

Owner

Wanted

A continuous ICMP probe to a fixed anycast target (1.1.1.1 and 9.9.9.9, both so a single target's blip is distinguishable) from the physical link, bypassing the host VPN, recorded as loss and RTT with history, plus an alert on sustained loss.

Constraints found

blackbox-exporter already runs and its ICMP prober needs no capability here: Docker opens net.ipv4.ping_group_range in the container netns (verified 0 2147483647 inside blackbox-exporter, uid 0 image). cap_drop: ALL stays.
blackbox sits on bridges, so its packets are forwarded and captured by aqomui's /1 route override while the tunnel is up. The probe would measure the tunnel, not the link.
aqomui's network bypass entries (aqomui#116) steer by source subnet plus optional tcp/udp and port; parse_network_entry rejects anything else, so icmp cannot be expressed today.
Tables 11 and 12 hold only default via 192.168.0.1 dev enp5s0, so a bare-subnet entry sends everything from that subnet out the physical link, container-to-container included. A bare entry is only safe for a subnet whose members never talk to other containers on it.

Options

Extend aqomui: accept proto: icmp (no port) in parse_network_entry and the rule builder, then one entry 172.18.7.0/24 icmp (blackbox's default-route subnet, shared with gluetun; nothing else there pings). Smallest change, one blackbox instance, probe targets added to blackbox.yml as an icmp module.
Dedicated probe bridge: a second, probe-only blackbox on its own pinned subnet that sorts first among its non-internal networks, with a bare aqomui entry for that subnet. No aqomui change, but a second exporter and a subnet that must never host anything that talks to other containers.

Option 1 preferred. Either way, targets by IP so no DNS crosses the bypass.

Not covered

UDP loss. A dns module probe over UDP would need a udp 53 entry, which also captures blackbox's lookups to AdGuard and sends them out enp5s0. ICMP loss is the baseline that was missing; UDP can follow if ICMP ever disagrees with the tunnel symptoms.

🤖 Generated with Claude Code

Follow-up from #176 (host NIC counters landed in #412). Counters say how much went through enp5s0; nothing says whether the raw uplink was healthy. Every tunnel-loss investigation so far (aqomui#118, #156) had no baseline for "was it the ISP link or the tunnel". ## Wanted A continuous ICMP probe to a fixed anycast target (1.1.1.1 and 9.9.9.9, both so a single target's blip is distinguishable) from the physical link, bypassing the host VPN, recorded as loss and RTT with history, plus an alert on sustained loss. ## Constraints found - blackbox-exporter already runs and its ICMP prober needs no capability here: Docker opens `net.ipv4.ping_group_range` in the container netns (verified `0 2147483647` inside blackbox-exporter, uid 0 image). `cap_drop: ALL` stays. - blackbox sits on bridges, so its packets are forwarded and captured by aqomui's `/1` route override while the tunnel is up. The probe would measure the tunnel, not the link. - aqomui's network bypass entries (aqomui#116) steer by source subnet plus optional `tcp`/`udp` and port; `parse_network_entry` rejects anything else, so `icmp` cannot be expressed today. - Tables 11 and 12 hold only `default via 192.168.0.1 dev enp5s0`, so a bare-subnet entry sends *everything* from that subnet out the physical link, container-to-container included. A bare entry is only safe for a subnet whose members never talk to other containers on it. ## Options 1. **Extend aqomui**: accept `proto: icmp` (no port) in `parse_network_entry` and the rule builder, then one entry `172.18.7.0/24 icmp` (blackbox's default-route subnet, shared with gluetun; nothing else there pings). Smallest change, one blackbox instance, probe targets added to `blackbox.yml` as an `icmp` module. 2. **Dedicated probe bridge**: a second, probe-only blackbox on its own pinned subnet that sorts first among its non-internal networks, with a bare aqomui entry for that subnet. No aqomui change, but a second exporter and a subnet that must never host anything that talks to other containers. Option 1 preferred. Either way, targets by IP so no DNS crosses the bypass. ## Not covered UDP loss. A `dns` module probe over UDP would need a `udp 53` entry, which also captures blackbox's lookups to AdGuard and sends them out enp5s0. ICMP loss is the baseline that was missing; UDP can follow if ICMP ever disagrees with the tunnel symptoms. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

mysticalsoap referenced this issue from a commit

2026-10-08 17:40:30 -04:00

monitoring: ICMP probe of the WAN link from the physical interface

mysticalsoap referenced this issue from a pull request that will close it,

2026-10-08 17:55:26 -04:00

monitoring: ICMP probe of the WAN link from the physical interface #415

mysticalsoap closed this issue

2026-10-08 17:56:55 -04:00