BitPirate

@BitPirate@feddit.de

• ⁨Comment⁩ on ⁨FOSS Deep Packet Inspection software?⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  What kind of ISP are you dealing with?

• ⁨Comment⁩ on ⁨⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  And maybe PPoE.

  traceroute --mtu 1.1.1.1
  

  Pick the lowest value displayed for F=xxxx like e.g F=1492 and subtract 80.

  For my DSL connection the optimal value is 1412.

• ⁨Comment⁩ on ⁨Good server OS for Jellyfin⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  nonfree drivers accessible right away

  Non-free firmware is included in the Debian installer since Bookworm.

• ⁨Comment⁩ on ⁨[deleted]⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  Do you really know how Wireguard works?

  Updating without a reboot only works for wireguard-go. The default implementation runs in the kernel. An update to it would require kernel live patching.

  Wireguard doesn’t answer to unsigned packets. Using obscure ports or even port knocking is rather pointless. It’s indistinguishable from a closed port.

  I’d rather take Casaos out of the equation and target Ubuntus’ Wireguard stack instead.

• ⁨Comment⁩ on ⁨CGNAT blocking external access to NAS. Looking to address this plus more.⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  Jellyfin is completely free. I only used it shortly in my LAN environment so I can’t give you any numbers. It should roughly be in the same ballpark as plex though.

• ⁨Comment⁩ on ⁨CGNAT blocking external access to NAS. Looking to address this plus more.⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  You can skip fail2ban for SSH. I missed the important bit. Duh…

  Never used Plex but had a good experience with Jellyfin.

• ⁨Comment⁩ on ⁨CGNAT blocking external access to NAS. Looking to address this plus more.⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  Just a few thoughts:

  • don’t cheap out. Building your whole stack on top of free or ultra budget providers is going to backfire eventually
  • check the traffic limits if you want to stream 4k content from your NAS
  • if latency and bandwidth is a concern, you need to select a VPS provider with good peering. This fully depends on your ISP.
  • i’d recommend setting things up with split DNS. Your DNS server would answer with local IPs for queries from within your LAN and with the IP of the VPS for external queries.
  • take a look at AdGuard Home
  • you can skip fail2ban if you go straight for ssh keys
  • 100% wireguard
• ⁨Comment⁩ on ⁨Forward IP headers in HAProxy to get the real IP of the client⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  serverfault.com/a/1112627

• ⁨Comment⁩ on ⁨Forward IP headers in HAProxy to get the real IP of the client⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  Why are you running two HAProxy instances? You should be able to forward the traffic on your VPS to your homeserver with a firewall rule.

  If that’s not an option, this should still be doable using the X-Forwarded-For header. Instead of setting it to single value, you need to append to it:

  developer.mozilla.org/en-US/…/X-Forwarded-For#syn…

• ⁨Comment⁩ on ⁨Thinclient sourcing in Germany⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  I’m a fan of AfB: www.afbshop.de/gebrauchte-pcs/mini-pc

  www.afb-group.de/ueber-uns/

• ⁨Comment⁩ on ⁨Need some wireguard help⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  You only need the masquerade rule.

  iptables -t nat -A POSTROUTING -s 10.11.13.0/24  -o enp3s0 -j MASQUERADE
  

• ⁨Comment⁩ on ⁨How do you facilitate remote access?⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  Not OP but DynDNS entries will always point to your current external IP and are renewed every hour.

  Internally I run an AdGuard Home instance for adblocking. All my domains are rewritten to use the local IP while I’m in the same network.

  en.wikipedia.org/wiki/Split-horizon_DNS

• ⁨Comment⁩ on ⁨[HN] PostgreSQL reconsiders its process-based model⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  Tom Lane said: “I think this will be a disaster. There is far too much code that will get broken”

  And that’s the point where you can stop reading.