M0: Verify spoke connections are outbound-only

[gnanirahulnutakki]

Milestone-0 — security property check. Confirm the spoke only ever makes outbound connections to the hub (the property that lets spokes live in isolated VPCs / behind NAT).

Tasks

• With the tunnel established, inspect spoke connections (ss/netstat/tcpdump) — all hub-directed connections are outbound (dialed by the spoke)
• Confirm no inbound hub→spoke port is required for reach
• Note this as evidence in the ADR-0001 falsification section

Acceptance

• Documented evidence that spoke→hub is outbound-only.

Refs: THREAT-MODEL §2, ARCHITECTURE §2.

[gnanirahulnutakki]

Superseded by the corrected completion evidence in #5 (comment).

[gnanirahulnutakki]

Correction to the preceding comment, whose Markdown formatting was stripped by a shell-quoting error.\n\nCompleted by PR #73, merged into dev at 017eec0.\n\nAcceptance evidence:\n- each spoke installs and verifies dedicated INPUT/FORWARD hub-ingress deny jumps;\n- a hub-to-known-live spoke API probe must fail and increment the exact probe-specific REJECT counter, so Docker or command errors cannot create a false PASS;\n- both reverse tunnels and scoped service reaches remain healthy;\n- original-direction conntrack shows spoke-pod to hub port 6443 flows and zero hub-node-originated flows.\n\nThe runbook retains the overlapping pod-CIDR limitation and requires a non-overlapping VPC/firewall preproduction repeat for direct pod-IP proof. Final result: transport=outbound-only, boundary=active-deny.