**Note** from Bead: Simtable Network · [canonical source](https://redfish.acequia.io/guerin/.agents/40a28642-b4bb-4a6d-93c3-c6f1ce1af361/2026-06-14/notes/00-simtable-office-network.md) · session 2026-06-14 · discussion: Talk: Simtable Network
**Date:** 2026-06-14. Read-first for bead `simtable-network`. Snapshot; every entry is dated and carries its **probe vantage** (internal vs external) — an internal `000` is a NAT-hairpin artifact, not proof a host is externally down.
## Public static-IP block — `50.243.20.250 – .254` (5 statics) Scanned from **inside the office** (this machine, egress `.254`) on 80/443, 2026-06-14: | IP | :80 | :443 | TLS cert / Server | Box / role | State | |---|---|---|---|---|---| | **.250** | 200 | 200 | `CN=node.redfish.com` (Let's Encrypt); Apache/2.4.48 (Ubuntu) | **node.redfish.com** | **UP** (Apache 80/443). Its nephele WebDAV `:3334` is **DOWN** — only the web server answers. | | **.251** | 200 | 200 | `O=Axis Communications AB, CN=axis-accc8ef2e6c9` (self-signed); Apache/2.4.46 (Unix) | **Axis network camera** (`axis-accc8ef2e6c9`) | **UP** | | **.252** | 000 | 000 | — | **unknown** | no internal response (hairpin — external unconfirmed) | | **.253** | 000 | 000 | — | **unknown** | no internal response (hairpin — external unconfirmed) | | **.254** | 000 | 000 | — | **`my-claude-vscode` Caddy box** (LAN `192.168.1.19`) | Caddy **is** listening locally on 80/443 (`127.0.0.1:3500`→200); `.254` did **not** loop back internally → external reachability unconfirmed | ### Reading the scan - **`.250` and `.251` answer internally** → the office router routes internal→those public IPs (or they're directly reachable). They are separate physical boxes. - **`.252`–`.254` are `000` internally**, but that is a **NAT-hairpin** result, not an external verdict. ### EXTERNAL verification (2026-06-14) — the right way The internal scan was the wrong tool (it hits NAT hairpin). Verified instead from an **external vantage** — `WebFetch`, which runs on Anthropic's cloud, *outside* the office NAT (= "ask the cloud to check"): - **`node.redfish.com` (.250)** → loads externally (a "Node JR" page). **Publicly reachable.** ✓ - **`stephenguerin.live`** → `ECONNREFUSED` externally → **publicly DOWN** (DNS still on the stale `174.56.31.65`). - **`.252`, `.253`, `.254` → nothing** (confirmed by Stephen + external check). So **`.254` does NOT inbound-NAT to the `192.168.1.19` Caddy box** — if it did, the external probe would have reached Caddy. **Consequence:** only `.250` (node.redfish.com box) and `.251` (Axis camera) are externally reachable. To serve `stephenguerin.live` from the office you must either run the origin **on the `.250` box**, get IT to **NAT a free static (`.252/.253`) to `192.168.1.19`**, or use an **outbound tunnel** from the Caddy box. **Method lesson (see feedback_external-vantage-for-reachability):** check public reachability from an external vantage (`WebFetch`/`WebSearch` = Anthropic cloud; an external box like `.250`; a port-checker), never an internal curl.
## LAN - Subnet `192.168.1.0/24`, gateway `192.168.1.1`. - **`192.168.1.19`** = this machine (`my-claude-vscode`, the Caddy box), Wi-Fi. - Other LAN hosts: TBD (don't scan the LAN without cause; enumerate from the router/DHCP or as boxes are identified).
## How the statics map to boxes (the question driving this) - `.250` → node.redfish.com box (Ubuntu/Apache). - `.251` → Axis camera. - `.252`, `.253` → **unmapped** — identify (off-network probe + ask which boxes own them). - `.254` → egress of the `192.168.1.19` Caddy box; **does `.254` inbound-NAT to `.19`?** unknown — the key question for serving `stephenguerin.live` from the office (see 7049c694 §04). Confirm externally.
## Open items 1. ~~External probe of `.252/.253/.254`~~ **DONE 2026-06-14 (WebFetch):** `.252/.253/.254` = nothing externally; only `.250`/`.251` reachable. 2. **`.254` does NOT inbound-NAT to `192.168.1.19`.** To serve `stephenguerin.live` from the office: run the origin on the `.250` box, NAT a free static (`.252/.253`) to `.19`, or tunnel out. (Static IP ⇒ no dyndns needed once a reachable static maps to the origin box.) 3. **node.redfish.com `:3334`** WebDAV is down though the box is up — restart if it should be serving. 4. Build the office **Caddy ingress routing table** ([7049c694 / 04-office-lan-ingress.md](https://redfish.acequia.io/guerin/.agents/7049c694-e45b-4116-a887-49e64885ac8e/2026-06-13/notes/04-office-lan-ingress.md)) over these mapped backends.
## Related - Ingress design: [7049c694 / 04-office-lan-ingress.md](https://redfish.acequia.io/guerin/.agents/7049c694-e45b-4116-a887-49e64885ac8e/2026-06-13/notes/04-office-lan-ingress.md). - `node.redfish.com` credential: `.credentials/node.redfish.com.json` (port 3334, basic). Axis cameras: [.ai/axis-cameras.md].
## References (bead cross-links) - Bead: Home Port Forward Hosting · [canonical](https://redfish.acequia.io/guerin/.agents/7049c694-e45b-4116-a887-49e64885ac8e/)