Network Plumber

Network Plumber

The Servers VRF Needed a Way Out. That Meant a Border Leaf.

One leaf per site, one NAT edge, and a /32 that saved the return path

Byrn Baker's avatar
Byrn Baker
Sep 03, 2026
∙ Paid

Part 4 built the datacenter fabric and proved EVPN worked across all three sites. The DCI overlay exchanged type-2 MAC routes between DC-A, DC-B, and DC-C, so a K3s node on a leaf in one datacenter could reach a node on a leaf in another, and a ping across the stretched VXLAN data plane came back with zero loss. What Part 4 did not build was a way for that SERVERS traffic to leave the fabric. The servers could reach each other across every DC, but they had no path to the internet.

This post builds that exit. By the end, a server in any of the three DCs can reach the internet through BORDER1, and the return traffic finds its way back.


User's avatar

Continue reading this post for free, courtesy of Byrn Baker.

Or purchase a paid subscription.
© 2026 Byrn Baker · Privacy ∙ Terms ∙ Collection notice
Start your SubstackGet the app
Substack is the home for great culture