- lesson on anyssh.ru = 91.232.225.8 hidden behind shared jumphost
- feedback: never add office-subnet routes on remote NAT peer

Both incidents from ikev2.gr.egw setup where adding routes on
parentglobal first killed reverse SSH access to the host.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>