A rule was added so the testing gateway may also reach nodes tagged
tag:orchestrator, not only tag:notplants-test-server. Both tags now appear in
the skill's table, and the tool's warning fires only when a node carries
neither.
Verified end to end from an orchestrator box (tag:orchestrator, tag:server)
rather than assumed:
- the gateway can open a TCP connection to it over the tailnet
- a request to https://acltest.gtest.commoninternet.net/ returns the box's
own self-signed certificate, subject and issuer both CN=acltest...,
which is only possible if the gateway proxied the stream instead of
terminating it
- the payload came back and the box's listener logged the request
The troubleshooting section gains the one-liner that isolates this from the
gateway itself: open a TCP connection to your backend from the gateway.
notplants
23391cef2b