From eec55da0c729cd383c662e92dca3b5cb4f7287bc Mon Sep 17 00:00:00 2001
From: Joshua Gilman <joshuagilman@gmail.com>
Date: Thu, 13 Aug 2026 21:33:55 -0700
Subject: [PATCH] feat(vyos): add OOB KVM network

Bridge the two directly attached KVM ports on LAB_OOB, reserve the PiKVM address, and allow Kea to receive local broadcast DHCP traffic.
---
 network/vyos/configs/gateway.conf | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/network/vyos/configs/gateway.conf b/network/vyos/configs/gateway.conf
index c09b5da..f7c2ab2 100644
--- a/network/vyos/configs/gateway.conf
+++ b/network/vyos/configs/gateway.conf
@@ -20,13 +20,15 @@
  *   10 - LAB_MGMT     (10.10.10.0/24) - Management + platform
  *   20 - LAB_PROV     (10.10.20.0/24) - Provisioning (PXE)
  *   40 - LAB_WORKLOAD (10.10.40.0/24) - Workload / VM network
- *   access - LAB_OOB  (10.10.70.0/24) - MS-02 AMT/OOB access switch on eth5
+ *   access - LAB_OOB  (10.10.70.0/24) - KVM devices on eth4-eth5
  *
  * Bridge Architecture:
  *   br10 - Bridges eth1.10 (switch trunk) and eth2.10 (UM760 direct connect)
  *          for steady-state UM760 management/platform access.
  *   br20 - Bridges eth1.20 (switch trunk) and, temporarily, physical eth2
  *          while provisioning the UM760 via untagged PXE/Tinkerbell.
+ *   br70 - Bridges the directly attached PiKVM and TESmart KVM on untagged
+ *          LAN ports eth4-eth5.
  */
 
 firewall {
@@ -458,6 +460,16 @@ interfaces {
             }
         }
     }
+    bridge br70 {
+        address 10.10.70.1/24
+        description "LAB_OOB - KVM"
+        member {
+            interface eth4 {
+            }
+            interface eth5 {
+            }
+        }
+    }
     ethernet eth0 {
         address 10.0.0.2/30
         description "WAN - Transit to Home (CCR2004)"
@@ -481,9 +493,11 @@ interfaces {
             description "LAB_MGMT - Bridge member (br10)"
         }
     }
+    ethernet eth4 {
+        description "LAN - PiKVM OOB"
+    }
     ethernet eth5 {
-        address 10.10.70.1/24
-        description "LAB_OOB - MS-02 AMT access switch"
+        description "LAN - TESmart KVM OOB"
     }
 }
 nat {
@@ -562,8 +576,6 @@ protocols {
 }
 service {
     dhcp-server {
-        listen-address 10.10.10.1
-        listen-address 10.10.70.1
         dynamic-dns-update {
             enable
             conflict-resolution enable
@@ -636,6 +648,10 @@ service {
                     ip-address 10.10.70.13
                     mac 38:05:25:35:43:f0
                 }
+                static-mapping PiKVM {
+                    ip-address 10.10.70.20
+                    mac 88:a2:9e:42:4a:7f
+                }
                 subnet-id 2
             }
         }