From 63d8036668303b107eaf8fa74663b42495853e65 Mon Sep 17 00:00:00 2001
From: Joshua Gilman <joshuagilman@gmail.com>
Date: Tue, 25 Aug 2026 18:18:58 -0700
Subject: [PATCH] fix(network): restore sandbox cluster access

---
 tailscale/policy.hujson    | 30 ++++++++++++++++++++++++++++++
 tests/test_policy.py       | 14 ++++++++++++++
 vyos/gw01/config.boot.tmpl |  4 ++--
 3 files changed, 46 insertions(+), 2 deletions(-)

diff --git a/tailscale/policy.hujson b/tailscale/policy.hujson
index e737629..c067c08 100644
--- a/tailscale/policy.hujson
+++ b/tailscale/policy.hujson
@@ -38,12 +38,42 @@
 			"dst":    ["tag:subnet-router:*"],
 		},
 
+
+		// Sandbox hosts reach only the Incus cluster API through the lab
+		// subnet route.
+		{
+			"action": "accept",
+			"src":    ["tag:sandbox"],
+			"proto":  "tcp",
+			"dst": [
+				"10.10.10.11:8443",
+				"10.10.10.12:8443",
+				"10.10.10.13:8443",
+				"10.10.10.14:8443",
+			],
+		},
 		// Routed hosts in the lab and home ranges reach each other in both
 		// directions.
 		{"action": "accept", "src": ["10.10.0.0/16"], "dst": ["172.16.0.0/16:*"]},
 		{"action": "accept", "src": ["172.16.0.0/16"], "dst": ["10.10.0.0/16:*"]},
 	],
 
+	"tests": [
+		{
+			"src": "tag:sandbox",
+			"accept": [
+				"10.10.10.11:8443",
+				"10.10.10.12:8443",
+				"10.10.10.13:8443",
+				"10.10.10.14:8443",
+			],
+			"deny": [
+				"10.10.10.10:8443",
+				"10.10.10.11:8444",
+			],
+		},
+	],
+
 	"ssh": [
 		// Tailscale SSH to your own devices, with periodic reauthentication.
 		{
diff --git a/tests/test_policy.py b/tests/test_policy.py
index 1e58643..1d088ab 100644
--- a/tests/test_policy.py
+++ b/tests/test_policy.py
@@ -31,6 +31,20 @@ def test_rtr01_gateway_health_probe_is_allowed() -> None:
             }""" in load_template()
 
 
+def test_sandbox_to_management_is_allowed() -> None:
+    from networking_vyos.render import load_template
+
+    assert """rule 10 {
+                action accept
+                description "Allow sandbox to management"
+                destination {
+                    group {
+                        network-group LAB_MGMT
+                    }
+                }
+            }""" in load_template()
+
+
 def test_invented_footer_is_rejected() -> None:
     with pytest.raises(ToolError, match="must not invent"):
         validate_template(VALID_TEMPLATE + '\n// vyos-config-version: "guessed@1"\n')
diff --git a/vyos/gw01/config.boot.tmpl b/vyos/gw01/config.boot.tmpl
index 161bd75..3e4e898 100644
--- a/vyos/gw01/config.boot.tmpl
+++ b/vyos/gw01/config.boot.tmpl
@@ -322,8 +322,8 @@ firewall {
             default-log
             description "Forward from sandbox"
             rule 10 {
-                action drop
-                description "Block sandbox to management"
+                action accept
+                description "Allow sandbox to management"
                 destination {
                     group {
                         network-group LAB_MGMT