Complete procedures with a way back.

Add a reviewed global IPv6 address alongside existing IPv4, learn the default route through authenticated network ownership rather than assumption, preserve Neighbor Discovery and Path MTU Discovery, and apply one consistent nftables policy to both families with timed recovery.

Create a default-deny host firewall with loopback, established traffic, controlled SSH, service ports, logging, validation, and rollback.

Deploy or repair an OpenVPN 2.6 gateway with certificate checks intact. Start Cannot resolve host address with the client's pre-tunnel DNS and actual profile; investigate VERIFY ERROR, peer certificate verification failure and TLS handshake failed only at their demonstrated transport or TLS layer.

Create a minimal routed WireGuard VPN with protected keys, explicit peers, constrained forwarding, and peer removal.