FILE 02 · Complete · Network engineering

Selective Internet Breakout

A Site 1 design note for allowing one personal workstation to reach the real internet while preserving the simulated ISP path for normal lab systems.

Problem

The lab needed two internet behaviors at the same time. Normal lab hosts needed to keep using the simulated ISP path for routing and NAT practice. One personal workstation needed a controlled exception for real internet access through the Slate 7 / Flint 2 path.

Design goal

Keep the exception narrow. The personal PC can leave through the real internet path while normal lab systems continue to behave like they are inside the simulated environment.

Packet paths

Two behaviors, one lab.

Normal lab path

Site 1 lab
  → Core
  → OPNsense
  → Edge Router
  → Simulated ISP
  → 203.0.113.10

Real internet exception

Personal PC
  → Core
  → OPNsense
  → Edge Router
  → Slate 7
  → Flint 2
  → Internet

Decision

NAT stays at the edge.

Keeping NAT at the edge keeps the WAN decision closer to the simulated provider boundary and makes the exception easier to reason about during packet walks.

Validation

Trace the source.

Validation should prove which source address is visible at each hop, which route decision is being made, and whether non-exempt lab systems remain isolated from the real path.