Q Clearance Mesh — Linux gateway ops (lab, N5a)
===============================================

Linux is the preferred / supported OS for Tenant LAN gateways.

After Admin enables a gateway and you re-download the gateway node's Mesh
package, the host certificate includes LAN CIDRs as unsafe networks. Enable
forwarding + NAT on the host:

1) Forwarding
   sudo sysctl -w net.ipv4.ip_forward=1
   echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-qc-mesh-forward.conf

2) NAT (replace eth0 with LAN NIC; overlay is 10.50.0.0/16)
   sudo iptables -t nat -A POSTROUTING -s 10.50.0.0/16 -o eth0 -j MASQUERADE

   nftables example:
   sudo nft add table ip qcmesh
   sudo nft 'add chain ip qcmesh postrouting { type nat hook postrouting priority 100 ; }'
   sudo nft add rule ip qcmesh postrouting oifname "eth0" ip saddr 10.50.0.0/16 masquerade

3) Allow forward between mesh TUN (qcmesh1) and LAN NIC in the host firewall.
   Agent config also includes inbound local_cidr rules for the LAN.

4) Clients of the Tenant must re-download packages after gateway or ACL changes.

See also WINDOWS-GATEWAY.txt if the gateway host is Windows Server (RRAS).