Elements in bbrkn_v4/bbrkn_v6 carry a 1d timeout and are only refreshed
when a query reaches the host dnsmasq on :5350, where the nftset=
directives are applied. Idle domains — or ones answered from the pihole
FTL cache — age out of the sets and their traffic silently falls back to
the plain WAN route instead of the tunnel.
warm-nftset.sh re-resolves every domain from the deployed 90-nftset.conf
(base + related subdomains) directly against 127.0.0.1:5350, bypassing
the FTL cache. Sourcing the domain list from the deployed config means
there is no second list to keep in sync.
Ping is off by default: packets originating on the gateway itself go
through OUTPUT, never prerouting_mangle, so they leave unmarked and
almost all time out — a misleading signal, not a real failure.
Run on the gateway via `make warm` or hourly cron. Measured: 1059
domains in ~1m45s at PARALLEL=8, v4 526->2203, v6 305->1440 elements.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
