diff --git a/CLAUDE.md b/CLAUDE.md
index 87f23ad..0db7623 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -274,12 +274,22 @@ Currently `2606:1c80:1001:e00::/56`. Key config on home:
 - `/ipv6 address` with `from-pool=home-pd-vntx address=::1 advertise=yes`
   on `bridge` (→ `:e00::1/64`) and `ether3-servers` (→ `:e01::1/64`).
   Remaining 254 /64s of the /56 stay in the pool for internal use.
-- Egress policy: `/routing rule` `src-address=2606:1c80::/32
-  action=lookup-only-in-table table=v6-verona` — the verona /56 is
-  single-homed, so traffic sourced from it must egress via verona only
+- Egress policy: **two** `/routing rule`s, order matters —
+  (1) `src-address=2606:1c80::/32 dst-address=2606:1c80:1001:e00::/56
+  action=lookup-only-in-table table=main` so vntx-sourced traffic
+  *destined to the home LANs* resolves via main's connected routes,
+  then (2) `src-address=2606:1c80::/32 action=lookup-only-in-table
+  table=v6-verona` for everything else. The verona /56 is single-homed,
+  so traffic sourced from it must egress via verona only
   (T-Mobile/Starlink would BCP38-drop it). No v6 WAN failover for the
   internal /56, by design. The PD client's default lands in the
-  `v6-verona` table, not `main`.
+  `v6-verona` table, not `main`. **Without rule (1)** the broad rule
+  also catches transit packets (echo replies, ICMPv6 time-exceeded)
+  sourced from internal routers and destined back to the home LAN, and
+  hairpins them to verona in a loop — symptom: home reaches the v6
+  internet fine but cannot ping any internal router and internal hops
+  show `*` in `traceroute6`. Rule (1)'s `dst-address` is tied to the
+  current delegated /56 — update it if the PD lease ever changes.
 - Stateless DHCPv6 servers (`home-bridge-stateless`,
   `home-servers-stateless`) carry the `v6-dns` option (Cloudflare).
 - Stale `tunnerbroker` `/ipv6 pool` (HE.net `2001:470:ba50::/48`) is
diff --git a/mikrotik-tool/494.rsc b/mikrotik-tool/494.rsc
index f959de3..2acbb32 100644
--- a/mikrotik-tool/494.rsc
+++ b/mikrotik-tool/494.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:37:53 by RouterOS 7.21.4
+# 2026-05-14 13:40:52 by RouterOS 7.21.4
 # software id = K4QG-8NQV
 #
 # model = RB5009UG+S+
diff --git a/mikrotik-tool/982.rsc b/mikrotik-tool/982.rsc
index 61b5f23..41a7b70 100644
--- a/mikrotik-tool/982.rsc
+++ b/mikrotik-tool/982.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:37:53 by RouterOS 7.21.4
+# 2026-05-14 13:40:53 by RouterOS 7.21.4
 # software id = FUVS-HCM5
 #
 # model = CCR1009-7G-1C-1S+
diff --git a/mikrotik-tool/climax.rsc b/mikrotik-tool/climax.rsc
index ce350b5..4d83ca1 100644
--- a/mikrotik-tool/climax.rsc
+++ b/mikrotik-tool/climax.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:37:53 by RouterOS 7.21.4
+# 2026-05-14 13:40:52 by RouterOS 7.21.4
 # software id = UETF-WF31
 #
 # model = CCR2004-16G-2S+
diff --git a/mikrotik-tool/core.rsc b/mikrotik-tool/core.rsc
index fd9916a..7658ac5 100644
--- a/mikrotik-tool/core.rsc
+++ b/mikrotik-tool/core.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:37:54 by RouterOS 7.21.4
+# 2026-05-14 13:40:53 by RouterOS 7.21.4
 # software id = XS5B-41QR
 #
 # model = CCR1009-7G-1C-1S+
diff --git a/mikrotik-tool/culleoka.rsc b/mikrotik-tool/culleoka.rsc
index b6c9f10..b96011f 100644
--- a/mikrotik-tool/culleoka.rsc
+++ b/mikrotik-tool/culleoka.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:37:53 by RouterOS 7.21.4
+# 2026-05-14 13:40:53 by RouterOS 7.21.4
 # software id = HVP9-3G0K
 #
 # model = CCR1009-7G-1C-1S+
diff --git a/mikrotik-tool/edge.rsc b/mikrotik-tool/edge.rsc
index 6d4601a..d2d6767 100644
--- a/mikrotik-tool/edge.rsc
+++ b/mikrotik-tool/edge.rsc
@@ -1,4 +1,4 @@
-# may/14/2026 09:37:53 by RouterOS 6.49.18
+# may/14/2026 13:40:52 by RouterOS 6.49.18
 # software id = 8XZE-R7EJ
 #
 # model = CCR2004-1G-12S+2XS
diff --git a/mikrotik-tool/home.rsc b/mikrotik-tool/home.rsc
index b9c6918..714bb06 100644
--- a/mikrotik-tool/home.rsc
+++ b/mikrotik-tool/home.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:37:53 by RouterOS 7.22.3
+# 2026-05-14 13:40:52 by RouterOS 7.22.3
 # software id = ZGNY-ZJW7
 #
 # model = RB5009UG+S+
@@ -496,6 +496,9 @@ add advertise-dns=yes interface=ether3-servers other-configuration=yes
 /routing rule
 add action=lookup-only-in-table disabled=no dst-address=0.0.0.0/0 \
     src-address=10.0.16.1 table=*400
+add action=lookup-only-in-table comment=\
+    "vntx-sourced to home /56 stays local" dst-address=\
+    2606:1c80:1001:e00::/56 src-address=2606:1c80::/32 table=main
 add action=lookup-only-in-table comment="vntx /56 egress via verona only" \
     src-address=2606:1c80::/32 table=v6-verona
 /snmp
diff --git a/mikrotik-tool/lowry.rsc b/mikrotik-tool/lowry.rsc
index 59d72c5..8afe298 100644
--- a/mikrotik-tool/lowry.rsc
+++ b/mikrotik-tool/lowry.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:37:53 by RouterOS 7.21.4
+# 2026-05-14 13:40:53 by RouterOS 7.21.4
 # software id = 2I9X-PQZP
 #
 # model = CCR1009-7G-1C-1S+
diff --git a/mikrotik-tool/newhope.rsc b/mikrotik-tool/newhope.rsc
index 44218d0..6274c69 100644
--- a/mikrotik-tool/newhope.rsc
+++ b/mikrotik-tool/newhope.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:37:54 by RouterOS 7.21.4
+# 2026-05-14 13:40:53 by RouterOS 7.21.4
 # software id = 5HTF-YFWV
 #
 # model = CCR1009-7G-1C-1S+
diff --git a/mikrotik-tool/verona.rsc b/mikrotik-tool/verona.rsc
index dbb7b2a..144f0c3 100644
--- a/mikrotik-tool/verona.rsc
+++ b/mikrotik-tool/verona.rsc
@@ -1,4 +1,4 @@
-# 2026-05-14 09:37:53 by RouterOS 7.21.4
+# 2026-05-14 13:40:52 by RouterOS 7.21.4
 # software id = Y1CT-1WB1
 #
 # model = CCR2004-16G-2S+