diff --git a/bin/netvm-topology.sh b/bin/netvm-topology.sh
index 1e0123e..21a61b1 100755
--- a/bin/netvm-topology.sh
+++ b/bin/netvm-topology.sh
@@ -1,8 +1,14 @@
 #!/usr/bin/env bash
-# Live topology: netns -> egress IP. Run as root for netns exec.
+# netvm-topology.sh — live topology + per-node diagnostics.
+# Run as root (operator: sudo -n via the allowlist).
 set -u
 for ns in $(ip netns list 2>/dev/null | awk '{print $1}' | grep '^warp-'); do
   node="${ns#warp-}"
-  egress=$(ip netns exec "$ns" curl -s --max-time 10 ifconfig.me 2>/dev/null || echo UNREACHABLE)
-  printf '%-20s %-16s %s\n' "$node" "$ns" "$egress"
+  hs=$(ip netns exec "$ns" wg show "wg-${node}" latest-handshakes 2>/dev/null | awk '{print $2}')
+  [ -z "$hs" ] && hs="none"
+  routes=$(ip netns exec "$ns" ip route 2>/dev/null | tr '\n' '|' )
+  egress=$(ip netns exec "$ns" curl -sk --max-time 10 'https://[2606:4700:4700::1111]/cdn-cgi/trace' 2>/dev/null | grep -oP '^ip=\K.*' || true)
+  printf 'node=%s netns=%s handshake=%s egress=%s\n  routes: %s\n' "$node" "$ns" "$hs" "${egress:-?}" "${routes:-none}"
 done
+# host-side NAT rules for our subnets
+iptables -t nat -L POSTROUTING -n 2>/dev/null | grep '10.201\.' || echo "no netvm NAT rules on host"