Status: Running · OS: Debian 13 (Trixie) · Network manager: systemd-networkd
- Purpose: IPv4 NAT, native IPv6 routing, DHCP, NextDNS, and DNS-populated nftables allowlists.
- Current policy: DNS authorizes new connections for one hour; established connections continue through conntrack.
- Removed: The Python DNS-log timeout-refresh service. There is no per-lookup timer renewal daemon.
- Not yet configured: Dedicated logging for denied forwarding packets.
