• 0 Posts
  • 53 Comments
Joined 1 year ago
cake
Cake day: June 20th, 2023

help-circle













  • vyatta and vyatta-based (edgerouter, etc) I would say are good enough for the average consumer. If we’re deep enough in the weeds to be arguing the pros and cons of wireguard raw vs talescale; I think we’re certainly passed accepting a budget consumer router as acceptably meeting these and other needs.

    Also you don’t need port forwarding and ddns for internal routing. My phone and laptop both have automation in place for switching wireguard profiles based on network SSID. At home, all traffic is routed locally; outside of my network everything goes through ddns/port forwarding.

    If you’re really paranoid about it, you could always skip the port-forward route, and set up a wireguard-based mesh yourself using an external vps as a relay. That way you don’t have to open anything directly, and internal traffic still routes when you don’t have an internet connection at home. It’s basically what talescale is, except in this case you control the keys and have better insight into who is using them, and you reverse the authentication paradigm from external to internal.




  • Fail2ban and containers can be tricky, because under the hood, you’ll often have container policies automatically inserting themselves above host policies in iptables. The docker documentation has a good write-up on how to solve it for their implementation

    https://docs.docker.com/engine/network/packet-filtering-firewalls/

    For your usecase specifically: If you’re using VMs only, you could run it within any VM that is exposing traffic, but for containers you’ll have to run fail2ban on the host itself. I’m not sure how LXC handles this, but I assume it’s probably similar to docker.

    The simplest solution would be to just put something between your hypervisor and the Internet physically (a raspberry-pi-based firewall, etc)




  • I’ve met a surprising number of “good religious people”, but it’s not surprising most people think they don’t exist. I think this phenomenon transcends religion though

    In the case of good Christians, the one unifying quality all of them have is they aren’t loud, and they aren’t pushy about it. They live their lives with a set of fundamental values and are always willing to go out of their way to help a neighbor. If it weren’t for the symbology in their homes you might never know.

    I think it’s the same with anything else. If you’ve never met a trans person who doesn’t make enforcing pronouns their entire identity, it’s easy to have your perspective skewed towards the obnoxious loud ones you see online. If you don’t personally know a cop or a black person, sensationalist stereotypes might be your internal idea of normal about them too. Etc…

    Linux users though… we’re all pushy weirdos. Not a normal good one among us :)

    Actually now that it’s been mentioned, have you ever tried Linux on the desktop? It’s really good these days. I do not use arch btw, I’m a Debian user myself.