# Windows Server as Mesh LAN Gateway (N5b)

**Lab note:** Linux is the **preferred / supported** gateway OS for q-clearance Mesh.
Windows Server with **RRAS** can work; expect more ops around forwarding, NAT, and
Windows Firewall. This guide is documentation only — no automated RRAS install.

## When to use this

Admin set Tenant gateway `host_os=windows` for a node that will route Mesh clients
into one or more LAN CIDRs (certificate unsafe networks + client overlay routes).

## Prerequisites

- Windows Server (lab-tested concepts: 2019/2022)
- Mesh agent package for the **gateway** node (re-download after Admin gateway save)
- LAN NIC(s) on the target CIDRs; Mesh TUN will appear when the agent runs
- Overlay CIDR on this lab: `10.50.0.0/16`

## 1) Install RRAS

In an elevated PowerShell:

```powershell
Install-WindowsFeature RemoteAccess, Routing -IncludeManagementTools
Install-RemoteAccess -VpnType RoutingOnly
```

Or use Server Manager → Add Roles → Remote Access → Routing.

Open **Routing and Remote Access** MMC → configure and enable routing.

## 2) IP forwarding

RRAS LAN routing enables forwarding. Alternatively (less preferred alone):

```powershell
Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters `
  -Name IPEnableRouter -Value 1
# Reboot may be required
```

Confirm: `Get-NetIPInterface | Select ifIndex,InterfaceAlias,Forwarding`

## 3) NAT toward LAN

In RRAS: IPv4 → NAT → add the **LAN** interface as the public/NAT interface for
outbound translation from the Mesh overlay (`10.50.0.0/16`) toward LAN hosts.

Without NAT (or static routes on every LAN host back to the gateway), return
traffic from LAN devices to Mesh clients will fail.

## 4) Windows Firewall

- Allow the Mesh agent (UDP to lighthouse public endpoint; lab UDP 4242)
- Allow **forwarding** between the Mesh TUN adapter and the LAN NIC
- If connection security rules or domain profiles block forward, create explicit
  allow rules for the LAN CIDRs

## 5) Run the Mesh agent

Unpack the gateway zip (includes `WINDOWS-GATEWAY.txt`). Certificate must list
LAN CIDRs under unsafe networks. Start:

```powershell
.\nebula.exe -config config.yml
```

Prefer a Windows service wrapper for lab persistence (out of scope here).

## 6) Clients

Other Tenant nodes must **re-download** their Mesh package so `config.yml`
contains overlay routes (`unsafe_routes`) via this gateway’s overlay IP.
Per-client allowed destinations (N5c) are enforced softly by which routes are
issued; gateway firewall `local_cidr` rules add stronger filtering when present.

## Gaps / realism

| Topic | Note |
|-------|------|
| ICS | Avoid; use RRAS NAT |
| Full-tunnel `0.0.0.0/0` | Out of scope for N5 |
| Multi-gateway ECMP | Out of scope |
| Automated RRAS | Not shipped — ops manual only |

If forwarding “silently fails”, switch the Tenant gateway host to **Linux**.