travel router

docs/SITE-SIDE.md

@@ -13,7 +13,8 @@ Add the RackNerd peer to each site's existing WG config. The sites
 [Peer]                       # RackNerd hub
 PublicKey = <RACKNERD_WG_PUBLIC_KEY>       # printed by host/setup.sh
 Endpoint = vpn.atlashorizon.net:51820
-AllowedIPs = 172.31.255.1/32, 172.31.8.0/24
+# .8 = OpenVPN clients, .9 = travel routers (docs/TRAVEL-ROUTERS.md)
+AllowedIPs = 172.31.255.1/32, 172.31.8.0/24, 172.31.9.0/24
 PersistentKeepalive = 25
 ```
 
@@ -35,6 +36,7 @@ LAN router (or directly on the DCs):
 | Destination      | Via                    |
 |------------------|------------------------|
 | `172.31.8.0/24`  | site WireGuard box     |
+| `172.31.9.0/24`  | site WireGuard box     |
 | `172.31.255.1/32`| site WireGuard box     |
 
 Verify no asymmetry: `tracert 172.31.8.10` from a DC must leave via the
@@ -42,9 +44,10 @@ local WG box → RackNerd, never via the other site.
 
 ## 3. Windows Firewall / segmentation on the DCs
 
-Allow from **`172.31.8.0/24`** (roaming clients, real source IPs): standard
-AD client ports — DNS 53, Kerberos 88/464, LDAP 389/636, SMB 445, RPC 135 +
-49152-65535, NTP 123, GC 3268/3269.
+Allow from **`172.31.8.0/24`** (OpenVPN clients, real source IPs) and
+**`172.31.9.0/24`** (travel routers): standard AD client ports — DNS 53,
+Kerberos 88/464, LDAP 389/636, SMB 445, RPC 135 + 49152-65535, NTP 123,
+GC 3268/3269.
 
 Allow from **`172.31.255.1/32`** (the RackNerd host itself):
 - TCP/UDP 53 → AHDC01, AHDC03, AH-OSWLDC (Technitium forwarder queries)