Arm the lab tripwire on ImaginationLAN (ADR-0014)

[Gerrrt]

What and why

Decided in ADR-0014 (the answer to #86); not built. This issue is the build.

ADR-0014 puts ifrit — attack tooling and the vulnerable targets — on ImaginationLAN (30) and adds no egress filtering there. The one firewall change it does decide is a tripwire on the ImaginationLAN interface, in the shape #223 gave the three terminal segments:

pass in log quick on igc0.30 inet from <vlan30 net> to <Internal_Segments>

Placed below the block rules that stop 30 → 99/50/40/20/10 and the quick iLO return-path pass (10.0.30.10 → 10.0.99.20/udp), and above the → any egress rule. It matches nothing while the design holds and costs nothing; if it ever logs a line, the segment that holds attackers has reached the house.

It is log-only. It cannot weaken anything. docs/security.md's threat-table row "a lab VM escaping into the house" is currently asserted, not watched; this is what makes it watched, on the segment where that threat becomes real.

The pieces

1. The rule itself, on morpheus, by hand — the firewall is not config-as-code. Re-run make backup-firewall afterwards, as the restore runbook says.
2. Internal_Segments must not contain 10.0.30.0/24. If the alias includes the lab's own subnet, every DNS and NTP query to 10.0.30.1 matches the tripwire and logs. Check the alias before adding the rule; if it does include 30, the rule needs its own alias (Internal_Segments minus 30) rather than a change to the shared one that the three existing tripwires use.
3. A Loki rule. TerminalSegmentReachedInternalNetwork in stacks/observability/loki/rules/security.rules.yaml hard-codes sources 10\.0\.(10|20|40)\. and destinations 10\.0\.(30|50|99)\. — VLAN 30 is on the wrong side of it. A sibling LabSegmentReachedInternalNetwork with source 10\.0\.30\. and destination 10\.0\.(10|20|40|50|99)\., severity critical, same for. make check-loki-rules boots a real Loki against it; mind the backtick raw-string note in the file header.
4. docs/runbooks/restore-the-firewall.md step 4 greps igc0\.(10|20|40) and expects exactly 3. Becomes igc0\.(10|20|30|40) and 4.
5. docs/security.md — the "Three tripwire rules" paragraph becomes four, and check_docs.py does not count tripwires, so nothing guards that number but the runbook grep.
6. The homelab-security dashboard has "Terminal → internal" panels; the lab tripwire wants to appear there or in a sibling panel, so a line is seen and not only alerted on.

Optional, from the same ADR

ADR-0014 puts the vulnerable targets on a bridge inside ifrit with no physical port, on a subnet morpheus has no interface or route for. If forwarding is ever accidentally enabled on the attack VM, a target's packet arrives at igc0.30 with a source outside 10.0.30.0/24, misses the → any pass (which is from vlan30 net), hits default deny, and is logged as a block. A second Loki rule on {app="filterlog", action="block"} with that subnet as source catches the forwarding mistake for free. Its subnet is chosen when ifrit is built (#96), so this rule waits for that.

When

With ifrit, or before. There is no reason to wait: the rule is a no-op on today's segment and the only cost is one restore-runbook number.

Which VLAN does this touch

🟢 30 — ImaginationLAN (lab)