pHr34kY

I selfhost. My ISP has a mail relay so it doesn’t appear to come from my residential IP. The problem is that the relay is on more blacklists than I am.

Servers retry delivery. It needs to be offline for a while before you miss stuff.

Receiving everything is the easy bit. It’s sending that’s hard. Every recipient is looking for a reason to spambox you.

OMG patching all the vulns. I actually pulled my wordpress offline overnight for that one. Still waiting on the Ubuntu patch for that IPv4 kernel CVE.

That reminds me - It’s time to do No NAT November again. This CVE gives me an excuse. Last year, the Nintendo Switch Switch and Steam were the big standouts. I think the Switch 2 will actually work with it now.

Oh, and my workplace is shifting offices, so my offiste backup is not offsite. Must take care to not burn the place down. I just put new fans in my PoE switch and now I can hear a server fan is dying too. There’s a lot of maintenance work to all this.

They will never comprehend the amount of work they have created for everyone else.

Same. I just stopped apache and let everything else run.

If you don’t have ports open, you’re not an internet participant. You’re just spectating.

Oh, you can tear it down as soon as you get the certification.

Mine still runs decades later though.

If your domain registrar doesn’t do DDNS, and you don’t want to pay extra for one that does, you can get free DNS for life at Hurricane Electric:

dns.he.net

All you need to do is finish their little online IPv6 course. TBH the “course” is just setting up your own server properly and proving it.

When I retire my desktop PC, the old parts become my router. If you have two network ports, it can do it.

To warrant the power bill, it’s also a NAS, NVR, mail server, print server and web server.

It’s running the private DNS for my phone. If it goes down, I realise quite quickly.

Nope. I don’t use them.

It’s because people keep finding ways around them and they evolve in nonsensical ways.

I’ve been on IPv6 years before Google turned it on. My ISP gave me a /48 and I’ve got different subnets for my WAN, LAN and guest LAN. I have a 4-port NIC so I could put a different subnet on each port.

I didn’t mention it in my first post, but I only made AAAA DNS entries for my internal stuff. I just enable IPv4 for the few services that actually need it.

Nope. SSL certs are pinned to the hostname, not the IP address. I can change the IP address in DNS and it will still work.

That’s exactly what I’m doing.

I’ve also got a completely different DNS config for WAN and LAN traffic. WAN devices can only resolve PTR records for my mail server. My LAN devices have DDNS so internally they a get allocated DNS entries by hostname. Even my guest network has a different config for isolation.

They definitely all need to be kept separate.

Routing between two interfaces on the same NIC takes nanoseconds. You wouldn’t notice a performance difference.

When I first set it up, I didn’t have a static IP address, so it would not be great when it changed. I also want my server to remain reachable locally if my internet goes down. I had different firewall/ACL rules for wifi too. For example, some of my internal websites only prompt for a login if you’re outside the network.

IPv6 has been awesome here. I have my server and clients on different /64 subnets in the same /48 block. The nearby devices on Android assumes only the same /64 is local.

Native apps all have a backwards-compatible setting so it’s allowed by default. That will surely get dropped when Google bumps the minimum Android target API so newly published apps need to explicitly configure it.

I actually went through my apps list and disabled nearby devices for all the apps that don’t need it. It’s a good security measure. I just don’t like how it was rolled out.

I self-host a DoH/DoT server and my local DHCP advertises it to local clients. It’s kinda cool because android phones on my wifi will use DoT when private DNS is set to “automatic”.

Private DNS sort-of broke while I was tinkering with internal/external IP addresses for nearby devices. It wouldn’t always connect when I specified my external IP (despite being available externally). I made it IPv6-only too. It wouldn’t be the first time something couldn’t handle it.

I’m actually on GrapheneOS.

I’ve found that you can deny “Network” permissions and permit “Nearby devices”. The app becomes LAN-only this way.

I’m actually using GrapheneOS.

It would be annoying to do that for everyone who uses my wifi.

I found that “Conversations” (XMPP) was blocking a connections even when the permission was enabled. I suspect Android no longer allows connections on port 5xxx on a local network. It works fine when the IP is external.

I did this once with a router. I just bought a 12V SLA battery (a UPS battery) and a trickle charger. The charger was always connected to the battery, so it was pumping about 13V into the router. The router could withstand it. It’s easy enough to get a voltage regulator if it’s an issue, but most hardware already does it to an extent. It was DC all the way.

I don’t think anyone is gonna solve that problem until it’s actually a problem.

Mozilla has their Nothing Personal online magazine with product reviews. It’s only a small handful of product at this point. This started out as “Privacy Not Included”, which is now defunct.

Run nft list ruleset and make sure that the final result matches your config. Maybe it’s misinterpreting or discarding something?

My server has this to allow ICMP in nftables:

ip protocol icmp accept
meta l4proto ipv6-icmp accept

There’s a hundred ways to do the same thing, and I haven’t found online guides to be consistent.

Make it a subdomain on a wildcard cert if you’re concerned about that.

Just expose it on single-stack IPv6. Nobody ever knocks. The address space is not scannable.