• 1 Post
  • 73 Comments
Joined 3 years ago
cake
Cake day: June 13th, 2023

help-circle







  • It definitely makes it more difficult to switch endpoints manually. I have multiple VPN connections with different exit nodes configured for failover in case one (or more) of them is unreachable. I don’t run into geoblocking issues very often but I also don’t route all my WAN traffic over VPN. Just some of it.

    What you can automate depends on your routers capabilities. Mine is a Mikrotik which does have fairly extensive support for custom scripts. However, detecting Geoblocking is probably going to involve parsing HTTP responses which is beyond the capabilities of almost all consumer grade routers. You would have to effectively do a MITM attack (aka deep packet inspection) in order to accomplish that on something other than the client device.

    TLDR: I manually change routes to a different VPN if needed but I very rarely run into Geoblocking issues.


  • I exclusively use my router as the VPN client for a few reasons. There are multiple services on my network that use the VPN. I’ve got static routes configured which effectively act as a kill switch and I can use QOS to prioritize traffic. It’s pretty much set it and forget it. You can use any VPN service as long at they offer a protocol your router supports. I use Proton via WireGuard and have for years.


  • Why not just use what you have until you can afford to and/or need to upgrade? SAS drives are more expensive because they typically offer higher performance and reliability. Hardware raid may be “old” but it’s still very common. The main risk with it is that if your raid card fails, you’ll have to replace it with the same model if you don’t want to rebuild your server from scratch.

    I’ve been running an old Dell PowerEdge for several years with no issues.


  • Self hosting is a great opportunity to learn about some popular technologies and even acquire a few sysadmin skills. Required knowledge of a self-hosted solutions tech stack is not gatekeeping any more than required knowledge of tools and building materials is gatekeeping when it comes to renovating your bathroom. In either scenario, if you don’t know what you’re doing, it’s going to be a much more difficult job.

    reverse proxies

    That said, you should not be exposing any of your services to the public if you don’t know what you’re doing. That’s a quick way to a bad time.





  • In this situation it’s not necessarily that it’s the “right” or “wrong” device. The better question is, “does it meet your needs?” There are pros and cons to running each service in its own VM. One of the cons is the overhead consumed by the VM OS. Sometimes that’s a necessary sacrifice.

    Some of the advantages of running a system like Proxmox are that it’s easily scalable and you’re not locked into specific hardware. If your current Beelink doesn’t prove to be enough, you can just add another one to the cluster or add a different host and Proxmox doesn’t care what it is.

    TLDR: it’s adequate until it’s not. When it’s not, it’s an easy fix.






  • I want to make sure I understand your goal correctly. Here’s what I’m getting.

    1. You have a wire guard connection that you want to use for outbound traffic from your local LAN.
    2. You have a Debian box that serves at the client in this situation.

    Here’s the part where I’m a little fuzzy

    1. You want to connect to your local LAN using another wire guard connection and have WAN requests routed from clients connecting to your LAN (via wire guard) out the wire guard connection mentioned in #1.

    Did I get any part of that wrong?

    Edit: NVM. I saw your response to another comment that sounds like this is exactly what you want.

    This should be achievable via routing. I actually do the same thing. The main difference is all the work is done on my router which handles both wire guard connections and routing.

    At the minimim you’re going to need:

    • A NAT rule on your local router to port forward incoming wire guard requests on the WAN to your Debian box. **Assuming the Debian box is also the wire guard server.
    • An iptables DSTNAT rule on your Debian box to route local traffic to the LAN gateway.
    • An iptables DSTNAT rule on your Debian box to route outbound WAN traffic that does NOT originate from your Debian box to the gateway at the other end of the outbound wire guard connection.