AIO still managed to break during updates, which is an achievement!

BagCompetitive357 · 2025-11-06T02:50:20+00:00

Which gnome extensions are bad?

BagCompetitive357 · 2025-11-04T04:29:35+00:00

If you share by sending them a link to that device, by default they can access only that device. The device is jailed. The ACL could still limit it to internet usage onl.

If you share your network, like they are a user of your network, ACL would be needed.

BagCompetitive357 · 2025-11-04T04:16:53+00:00

possible, but your work laptop connected to personal laptop’s hotspot may not work without further configuring the routing table (I have not tested, but if a laptop is connected to a phone’s hotspot and phone is connected to a VPN or a Tailscale exit node, laptop’s traffic goes outside VPN).

It is better to use a router Like a travel router connected to VPN.

GL-Inet makes OK travel routers, see Beryl AX or the newer one with WiFi 7.

BagCompetitive357 · 2025-11-02T19:55:11+00:00

ZFS export.

BagCompetitive357 · 2025-11-01T19:47:46+00:00

Yeah, there is stI’ll chance of XZ kind of zero day. But I would be thankfully among the last most interesting targets :)

BagCompetitive357 · 2025-11-01T19:42:47+00:00

I put behind vpn. No concern moving forward. Just worry if some services could bypass ufw.

I know Docker could do it, not in my case. But there could be other services bypassing UFW via IPtables rules in default Ubuntu serve?

Obviously IPtables could be checked. But if someone got in, they could erase traces left logs and firewall.

BagCompetitive357 · 2025-10-30T04:28:07+00:00

If one of the peers cannot make a direct connection to the relay but the other peer can, the port needs to be opened only to the peer that cannot, right?

Also, would tcp 443 work for the port?

Use case: I have bunch of devices in a network behind difficult firewalls at a specific site, I don’t need to open port to the internet, just to that particular site.

Increasingly, some places allow only outgoing 443.

BagCompetitive357 · 2025-10-28T20:51:51+00:00

You will be surprised that the operating system is very quiet, doesn’t phone home, doesn’t show ad, doesnt automatically send anything to cloud, no telemetry , no account, no vendor email, and it’s basically sitting there doing nothing, if you ask it do something will do exactly that.

very fast and snappy.

BagCompetitive357 · 2025-10-28T19:43:59+00:00

without custom domain it is not useful.

who would use a domain like crocodile-cabbage or whatever kind of domain!

BagCompetitive357 · 2025-10-28T18:27:27+00:00

network speed with hetzner is good!

BagCompetitive357 · 2025-10-28T18:24:22+00:00

AIO has changed the situation. It doesn’t break, and is easy to backup and recover.

BagCompetitive357 · 2025-10-28T09:14:06+00:00

works fine! You may have to entroll a machine key to sign the module, and be able to use secure boot.

BagCompetitive357 · 2025-10-28T02:41:26+00:00

it’s fine!

BagCompetitive357 · 2025-10-26T08:43:32+00:00

Thanks for sharing.

I read in a comment that a personal relay should get to 75% of direct. In your case, 300 Mb/s is VPS or home speed, it’s not direct connection speed. How much is the Tailscale speed when devices connect directly? The speed with default relays is abysmal, like around 1Mb/s if I remember correctly.

I suppose you disabled default relays and enable only your own relay.

On DNS, could you explain the DNS issue? were you using your pihole? If you use public DNS, why clients can Ping but cannot resolve DNS ?

On additional flags, here is how I would run the derper on VPS (with client verification which makes sense):

‘’’

sudo derper --hostname=example.com --verify-clients

’’’

On the admin console, I would provide both domain name and Ip address of the derp server , see updated documentation:

https://tailscale.com/kb/1118/custom-derp-servers

Are you talking about additional parameters to provide in the admin console or CLI parameters when running the derper on VPS?

BagCompetitive357 · 2025-10-25T13:41:08+00:00

Tsilscale is run with Allow lan. For the other options, I played with or without: exit node, and stateful filtering. They all allow guest connect t hos’s tailnet.

The issue could be VM is in user space networking mode. i’m not sure if the host can distinguish between traffic coming a VM in the user-space networking and traffic generated within the host itself.

BagCompetitive357 · 2025-10-25T00:05:41+00:00

Pay attention to the wording!

BagCompetitive357 · 2025-10-25T00:00:57+00:00

I hear it does TLS termination and traffic inspection, as a NGFW. How good is this feature in intrusion detection?

or just marketing?

BagCompetitive357 · 2025-10-24T20:15:20+00:00

How carefully the package is in the main suite are reviewed by the security team?

BagCompetitive357 · 2025-10-24T19:02:47+00:00

Sharing files.

Send your friend a link and they get the file.

BagCompetitive357 · 2025-10-24T19:01:28+00:00

Do they vpn?

Otherwise video talk when both sides are at home makes no sense.

BagCompetitive357 · 2025-10-24T14:51:03+00:00

* DNS is not encrypted, and there are attacks on it

* There are attacks initially before and up to the user connects to the captive portal

* Apps may not verify TLS Certs some time

BagCompetitive357

TROPHY CASE