DmitryandClaude Sonnet 5
dfcee00232
lint / yamllint + ansible-lint + syntax-check (push) Canceled after 0s
The phone tunnel established fine (TLS peer-fingerprint OK) but no traffic reached the LAN: ru-vps has policy FORWARD DROP and only per-service game ACCEPTs. The site tunnel never needed a FORWARD rule because it carries ru-vps's own traffic, not forwarded packets; the road-warrior instance is the first forwarded path. Add a `ufw route allow` (tun2 -> tun0, 10.80.0.0/30 -> 192.168.1.0/24). ufw route rules survive `ufw reload`, unlike a raw `iptables -I FORWARD` which would sit before the ufw chains and be flushed on reload. Return traffic is covered by the global RELATED,ESTABLISHED accept in ufw-before-forward. Verified on ru-vps: `ufw status` shows "192.168.1.0/24 on tun0 ALLOW FWD 10.80.0.0/30 on tun2"; make openvpn-phone idempotent. Same gap exists in openvpn-laptop.yml (tun1) — still not deployed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KbuZrUoevfBgCpf5DCF4DG