Nexus-Guard-Suite/.sisyphus/plans/bugfix-status-traffic-firewall.md

Bug Fixes: Device Status, Traffic, Firewall, UI Features

TL;DR

Fix 5 bugs: device status stuck online, traffic monitoring empty, firewall broken for non-/24, linked devices redundant, connection status missing chart.

Deliverables:

• Fix transfer bytes fallback preventing offline transition
• Fix traffic monitoring data flow (agent → server → DB)
• Fix firewall for comma-separated AllowedIPs
• Improve linked devices section
• Add chart to connection status

Estimated Effort: Medium Parallel Execution: YES - 3 waves

---

Context

Bugs Reported

1. Device status stuck online: When WireGuard deactivated, status stays "Online" forever
2. Traffic monitoring empty: 0 records in device_traffic table despite connected devices
3. Firewall broken for non-/24: Cannot ping through firewall when AllowedIPs is not /24
4. Linked devices: "Perangkat Tertaut" only shows current device, not linked peers
5. Connection status: No chart, just text debug panel

Root Causes Found

Bug 1: Transfer bytes fallback (redis.go:103-108)

if rx, exists := transferBytes[device.PublicKey]; exists && rx > 0 {
    isActiveFromWG = true  // CUMULATIVE bytes — never goes back to 0
}

GetPeerTransfer() returns cumulative ReceiveBytes from kernel. Once > 0, always true. Device never goes offline.

Secondary: Agent heartbeat UUID mismatch — sends HWID (SHA-256) instead of database UUID, so Redis pings always fail.

Bug 2: Traffic monitoring

• POST /api/v1/traffic/report endpoint exists and works
• But nobody calls it — device-agent doesn't report traffic
• HandshakeCollector in handshakesync.go is DEAD CODE (never started in main.go)
• Kernel sync records handshake but NOT traffic bytes

Bug 3: Firewall non-/24

• AddForwardRule directly interpolates CIDR into nftables command
• Single CIDR (e.g., 10.0.0.0/16) works fine in nftables
• Comma-separated CIDRs (e.g., 10.0.0.0/8, 192.168.0.0/16) produce INVALID nftables syntax
• Startup recovery uses FirewallRule.DestIPRange instead of Device.EndpointAllowedIPs

Bug 4: Linked devices

• "Perangkat Tertaut" only shows current device's own info
• Redundant with device info card above
• Should show peer relationships or connected devices

Bug 5: Connection status

• No chart — just text debug panel
• SSE stream has rx_rate/tx_rate data but unused by frontend

---

Work Objectives

Must Have

• Fix transfer bytes fallback (remove or add time window)
• Fix startup recovery to use Device.EndpointAllowedIPs
• Fix AddForwardRule for comma-separated CIDRs
• Start HandshakeCollector or integrate traffic recording into SyncToDB

Must NOT Have

• Do NOT change Docker behavior
• Do NOT break existing firewall rules
• Do NOT change API endpoints

---

Execution Strategy

Wave 1: Backend fixes (parallel)

• T1: Fix transfer bytes fallback in redis.go
• T2: Fix startup recovery in main.go
• T3: Fix AddForwardRule for multiple CIDRs

Wave 2: Traffic recording

• T4: Integrate traffic recording into SyncToDB or start HandshakeCollector

Wave 3: Frontend improvements

• T5: Improve linked devices section
• T6: Add chart to connection status (optional)

---

TODOs

---

Final Verification

• F1: go build -tags dev ./... passes
• F2: npm run build passes
• F3: Device goes offline when WG deactivated
• F4: Traffic data recorded in device_traffic table
• F5: Firewall works with non-/24 AllowedIPs

---

Success Criteria

go build -tags dev ./...  # Expected: no errors
cd apps/dashboard-ui && npm run build  # Expected: no errors