A VPN client on a laptop that quietly captured Node0's own routes
- date
- 20260830
- what happened
- A full-tunnel VPN client running on an administrator's laptop silently captured the routes to every Node0 destination reachable through the site's normal routing, while leaving the local gateway and general internet access working. The symptom looked exactly like every firewall and internal segment being down at once, except that the same destinations stayed reachable over the site's separate remote-access tunnel throughout.
- what it cost
- Time nearly spent chasing a fabric-wide outage theory, on a day that had already produced one real fault of a similar shape earlier, which made the false alarm more plausible than it should have been.
- what changed
- A fast discriminating check was written down: a genuine site-wide fault also takes down the separate remote-access path to the same hosts and does not leave general internet access untouched while every internal segment goes dark. A VPN client capturing routes does both.
- the check now
- Before troubleshooting an apparent site-wide outage from a laptop, query the routing table for an internal address and confirm the gateway is the expected local interface rather than a tunnel interface, and check whether an independent path to the same host still works.
A consumer VPN client, running for an entirely unrelated reason, general internet privacy on a personal laptop, reached into that laptop’s routing table and sent every request bound for the internal network through itself, with no warning and no obvious toggle responsible.
The resulting symptom on 20260830, every internal destination down while the local network and the internet worked fine, is exactly the shape a real firewall failure would produce. The coincidence that a genuinely unrelated firewall problem had happened earlier the same day made the wrong diagnosis more tempting rather than less. The evidence appeared to corroborate a theory that already had a plausible cause attached to it.
Two things separate the two cases quickly. The first is that a full-tunnel VPN takes the internal routes and leaves the internet alone, which is backwards from an infrastructure failure. If the site’s routing were really down, the independent remote-access tunnel into the same hosts would be down too, and it was not. The second is a single command. Ask the operating system which interface a route to an internal address actually resolves through, and read the answer: the expected local network interface, or a tunnel interface that has no business carrying it.
The fix takes ten seconds once you know to run it, and the value of writing it down is entirely in making the symptom-to-cause mapping available before the next person spends twenty minutes on the infrastructure. It belongs near the top of any troubleshooting checklist for “everything internal is down but the internet is fine”, because the machine you are troubleshooting from is part of the system under test.
Source: node0 lessons v0.1, lesson 4.17. Sanitized: checklist v0.1, 20260921; VPN vendor, addresses; voice pass 20260921. Part of oznog.com/node0.