What and why
Found while writing ADR-0014 for #86; the finding is recorded there, the decision is not.
shiva — the iLO 4 BMC of the defended estate — sits on the segment that will hold the attackers. ADR-0014 puts ifrit's attack VM on ImaginationLAN (30), sharing a broadcast domain with Saruman's Windows domain because the techniques worth detecting are L2 and do not cross a router. That is the design. It also means the BMC of the box being defended, at 10.0.30.10 on firmware 2.82, is L2-adjacent to a Kali VM, and a BMC is not something that gets patched the way a guest does.
ADR-0014 closes the hypervisor management planes at the host — Proxmox firewall on Saruman and ifrit, 8006/8007/22 from Hicks only. The iLO has no equivalent: it is a separate device on its own port, reachable from anything on VLAN 30 that can ARP for it.
What it is coupled to
The only explicit pass on the ImaginationLAN interface exists because the iLO is there. ADR-0013's table:
| On interface |
Rule |
Purpose |
| 99 |
10.0.99.20 → 10.0.30.10:161-162/udp |
SNMP-Exporter scrapes the iLO |
| 30 |
10.0.30.10 → 10.0.99.20/udp |
the iLO's return path |
Moving shiva to Winterfell (99) deletes both rules and the exception, which leaves VLAN 30 with no cross-segment passes at all. Hicks already reaches 99, so console access from a workstation is unchanged.
The pieces, if yes
- The iLO's dedicated port moves from a Green (30) switch port to a Red (99) one.
neo is the MokerLink; the VLAN walk has the trap #87 carries.
- The Kea reservation for
shiva moves scopes. The BMC takes its address by DHCP, so without a reservation on the new scope the SNMP target breaks silently — the NOTE in network.md's VLAN 30 section already says so.
stacks/observability/prometheus/targets/snmp.yaml hard-codes 10.0.30.10 with vlan: "30". New address, new label.- The two firewall rules above come out; ADR-0013's table and
restore-the-firewall.md follow.
docs/network.md and docs/hardware.md move the row. The [^Shiva] footnote that explains shiva and Saruman are one box stays true.
The case for no
Winterfell is "compromise here is total". A BMC on firmware that will not get newer is not obviously something to put next to the firewall's admin UI, and ADR-0008 already argued the management segment should not accumulate things. The alternative is leaving it on 30, treating the iLO as part of the estate under attack, and accepting that a BMC compromise in the lab costs the lab. That is defensible too, and ADR-0014 deliberately does not pick.
Which VLAN does this touch
🟢 30 — ImaginationLAN (lab), 🔴 99 — Winterfell (management)
What and why
Found while writing ADR-0014 for #86; the finding is recorded there, the decision is not.
shiva— the iLO 4 BMC of the defended estate — sits on the segment that will hold the attackers. ADR-0014 putsifrit's attack VM on ImaginationLAN (30), sharing a broadcast domain withSaruman's Windows domain because the techniques worth detecting are L2 and do not cross a router. That is the design. It also means the BMC of the box being defended, at10.0.30.10on firmware 2.82, is L2-adjacent to a Kali VM, and a BMC is not something that gets patched the way a guest does.ADR-0014 closes the hypervisor management planes at the host — Proxmox firewall on
Sarumanandifrit,8006/8007/22from Hicks only. The iLO has no equivalent: it is a separate device on its own port, reachable from anything on VLAN 30 that can ARP for it.What it is coupled to
The only explicit pass on the ImaginationLAN interface exists because the iLO is there. ADR-0013's table:
10.0.99.20 → 10.0.30.10:161-162/udp10.0.30.10 → 10.0.99.20/udpMoving
shivato Winterfell (99) deletes both rules and the exception, which leaves VLAN 30 with no cross-segment passes at all. Hicks already reaches 99, so console access from a workstation is unchanged.The pieces, if yes
neois the MokerLink; the VLAN walk has the trap #87 carries.shivamoves scopes. The BMC takes its address by DHCP, so without a reservation on the new scope the SNMP target breaks silently — the NOTE innetwork.md's VLAN 30 section already says so.stacks/observability/prometheus/targets/snmp.yamlhard-codes10.0.30.10withvlan: "30". New address, new label.restore-the-firewall.mdfollow.docs/network.mdanddocs/hardware.mdmove the row. The[^Shiva]footnote that explainsshivaandSarumanare one box stays true.The case for no
Winterfell is "compromise here is total". A BMC on firmware that will not get newer is not obviously something to put next to the firewall's admin UI, and ADR-0008 already argued the management segment should not accumulate things. The alternative is leaving it on 30, treating the iLO as part of the estate under attack, and accepting that a BMC compromise in the lab costs the lab. That is defensible too, and ADR-0014 deliberately does not pick.
Which VLAN does this touch
🟢 30 — ImaginationLAN (lab), 🔴 99 — Winterfell (management)