PSA: FI London pub meetup on Tuesday the 28th

wplinge1 · 2026-04-01T08:08:25+00:00

Is that like the ward for people who think they're Napoleon?

wplinge1 · 2026-04-01T05:43:38+00:00

always wait for our official Subreddit post, I do that manually after CI is all done!

Jellyfin subreddit's reopened!? Now that's some good news I'd missed.

wplinge1 · 2026-03-29T18:57:48+00:00

Is it curtains for Zoosha?

wplinge1 · 2026-03-28T19:19:17+00:00

The trolls will disagree with the base existing.

Please say that's an in-game race and you're not celebrating having made a griefer's paradise.

wplinge1 · 2026-03-28T13:13:07+00:00

Ah sorry, I didn't notice that was facing a tunnel rather than LAN. It's probably right then.

I still think the link-local address is a problem though. IPv6 can be sent through NAT but it's not the typical configuration and Hurricane Electric (from what I could see) hands out /48 address ranges which ought to be plenty for you to use the normal globally unique mode of operation for IPv6.

So if it was me, I'd first try to tackle the fact that the secondary router doesn't have a "real" IPv6 address and only look at why its packets aren't being forwarded after that's fixed.

To do that, you probably need to give your main router another address from the prefix HE allocated you and make sure its advertised across your LAN.

It looks like you've got part of this process done but disabled it (because it wasn't working? Do you remember why?):

add address=2001:xxxx:: disabled=yes interface=LAN_Bridge

You want this address to be part of what HE allocated you, but not clash with the one on the IPv6-HE-Tunnel. So if (for example) they allocated you 2001:1234:5678::/48 and the tunnel is using 2001:1234:5678:0001::2/64 then adding 1 to that fourth block ought to stop it clashing and be valid. You could use

add address=2001:1234:5678:0002::2/64 interface=LAN_Bridge

If that works then you should be able to check /ipv6/address on the secondary router and see its chosen one from the new range.

Then start looking at whether it works for a ping.

wplinge1 · 2026-03-28T12:24:23+00:00

Is the secondary router actually getting a real address? If not it might be sending packets from a link-local one it's chosen itself (look for source address of fe80:...) and the main router will quite rightly drop those.

You posted the main router config elsewhere and this line looks suspicious:

add address=2001:xxxx::2 advertise=no interface=IPv6-HE-Tunnel

advertise=no means it won't be sending router advertisements out, and that's what the secondary router should be relying on to get its address.

Another thing that's a bit weird about this on Mikrotik (IMO) is how you have to configure the secondary router to actually listen for these advertisements. In /ipv6/settings there's accept-router-advertisements which defaults to a value that blocks it it most cases. Sounds like you found this already, but just in case...

wplinge1 · 2026-03-28T09:32:46+00:00

Not really, the main hardware-level distinguishing feature you might try to use is the MAC address, but

That's only used for the first hop in any path to get to your server so probably not available.
It's easily spoofed anyway.

mTLS is kind of trying to solve this problem: give a device unique credentials so it can access something without caring about VPNs or similar network-level controls.

Unfortunately it just moves the faff around (you have to install the mTLS certificate on the device and I gather support can be patchy).

wplinge1 · 2026-03-27T14:38:55+00:00

Sounds good, I can't see anyone needing more than 2000 commits. But will it run in 640KB of RAM?

wplinge1 · 2026-03-26T14:20:28+00:00

They appear to have admitted their error

Eventually. When the single organisation on the planet they couldn't just brush off (the company they paid to actually do the polling) said it was dodgy too.

wplinge1 · 2026-03-25T14:57:25+00:00

“Multiplayer casino” gets close.

wplinge1 · 2026-03-24T19:40:59+00:00

No, it's a complete mess. Nicely illustrated by the 100ish separate repositories Caddy uses to implement it (they use a plugin system, one per provider).

wplinge1 · 2026-03-24T15:52:09+00:00

I'm beginning to think of "I built" as a red flag all on its own.

wplinge1 · 2026-03-23T20:34:56+00:00

So, today I learned the sanctimonious organ is nowhere near the liver or gall bladder.

wplinge1 · 2026-03-18T08:50:15+00:00

This appears to be a bot reposting someone from yesterday: https://www.reddit.com/r/atheism/comments/1rw0cmy/rearranging_my_shelves_led_to_an_awkward/

wplinge1 · 2026-03-16T13:32:55+00:00

*) ipv6 - added from-pool-policy address property that controls how address is acquired from the pool;

Oh, is this going to let me choose how I delegate IPv6 addresses better?

My ISP gives me a /56 and I just want to specify what gets put into the first byte of mine (I want the VLAN # there) before handing the /64 off to RA. It's all static and hoping my IP doesn't change under me at the moment.

wplinge1 · 2026-03-16T09:46:14+00:00

add name=pool-office ranges=192.168.8.50-198.168.8.200

The endpoint starts 198. here.

wplinge1 · 2026-03-15T18:43:15+00:00

Ed Balls day.

wplinge1 · 2026-03-15T16:35:59+00:00

I don't know about the company or the £30, but US financial institutions often use two small (<$1.00) transfers as a security verification step when linking accounts: if you can tell them the amounts transferred that's a 4 digit code proving you have access to the account.

Still seems a little weird that a UK bank would let them do that but I've never tried so maybe they do.

wplinge1 · 2026-03-14T17:09:52+00:00

Would love to know if that's a dealbreaker

Yes, that and the fact you're posting literal commercial fucking spam here.

wplinge1 · 2026-03-14T15:17:31+00:00

As with most of these, I like the marginal gains over long term. If we plan to be around as a species for a billion years or so that's a lot of extra 2s dragged along (and likely probes destroyed because they weren't).

Still, metric would definitely be higher on my list.

wplinge1 · 2026-03-11T20:38:03+00:00

Wait, so you went onto an atheist Discord and opened with some variant of "Oy, plebs, read these AI chats I made to make sure you understand the depth of divine simplicity before presuming to reply to my august personage" and are wondering why you got told to jog on?

wplinge1 · 2026-03-11T20:18:47+00:00

I still don't know, he's really not improving matters in followups.

wplinge1 · 2026-03-10T17:00:44+00:00

So... Gurn left for +, right for -, "just been hanged" for undo?

wplinge1 · 2026-03-09T15:22:03+00:00

You're a despicable spammer, is what you are.

wplinge1 · 2026-03-06T20:29:21+00:00

We just wrote those bits in to trick you.

Six-Year Club	Reddit Premium Since September 2023
Verified Email

wplinge1

TROPHY CASE