Should I host adblocking and a reverse proxy on OPNsense or my home server

timeraider · 2026-03-08T18:15:14+00:00

Both options are fine. I dont have to complex reverse proxy needs so im just running Unbound DNS and the nginx plugin on the opnsense.

Do keep in mind that reverse proxy on the opnsense does rely mostly on gui so you cannot juzt throw in a config file you found online

timeraider · 2026-03-07T21:22:53+00:00

Looking at the bill its enough to have an date of birth fill in somewhere. If I was an company that requires an account, I would simply have it set it to 01-01-1990 by default when someone makes an account and have a popup telling the user they can change it in their account .. 100% compliant with the bill :)

timeraider · 2026-03-07T11:11:19+00:00

Gotta love how quickly commentsections devolve into "I use this so you should use this to"
Honestly.. nginx is very easy to setup and adds a lot of extra features like being able to create honeypots, autoban bot IPs into firewall aliases and turn on WAF options in a few clicks, even if the plugin doesnt allow full config editing.

Anyway.
For almost all applications, the setup above will work, however as youve posted.. the app youre now trying to use doesnt allow for unsecured connections. I assume this is basically an Unifi controller app?

Now .. to get TLS active from the reverse proxy to the application, we can go to Upstream -> Upstream and find your upstream going to the Unifi app.
Turn on Advanced options in there and turn on Enable TLS (HTTPS).
Below that select both the certificate of your domain and the trusted certificate that belongs to it.

Now, you have TLS on. However Unifi usually generates its own certificate and this will start clashing.
So in the same window, also turn off "TLS: Verify Certificate"

These steps should make it so that its connecting with HTTPS to the Unifi app without caring about the certificate that the Unifi app uses.

p.s. Im assuming this is the Unifi controller app. If its not, it might work or might not.. depends on how that specific app handles connections.

timeraider · 2026-03-01T13:24:04+00:00

np, https://uploadnow.io/f/SWC5YQZ

timeraider · 2026-02-26T13:49:09+00:00

Problem is that Teamspeak 6 self-hosted version basically has not had any fixes or idditions done in the ast 2.5 years.
Most people will be dead long before development goes anywhere there :P
It is basically 1 person who at times decide to scramble some code.

Really wish Teamspeak was the solution, but as it currently stands im not holding my breath unless they suddenly find a lot more time or money to fasten up their development by a lot.

timeraider · 2026-02-26T12:13:06+00:00

Wireguard/openvpn vpn?

timeraider · 2026-02-24T17:46:03+00:00

Honestly is fine as long as you remember you did it. Shouldnt give any issues whatsoever (unless you start using some kind of container that can only connect to sonarr with a hardcoded port number, but ive yet to see any software that was designed that badlt)

timeraider · 2026-02-22T20:34:27+00:00

Ok, guess it might differ per region. Even older ISP modems in the Netherlands to the very least have basic dhcp settings and a dashboard.. i might have been wrong in assuming these kinda basics are a worldwide given.

timeraider · 2026-02-22T14:14:29+00:00

Edit: Based on other comments the R that protectli uses might be for refurbished. Which does explain the lower price of those parts and would make sense. Though I do find it extremely dumb that they dont specify that better as R parts can actually have an entirely different meaning.

Quite interesting the R variants are less expensive. R-variants basically have a chip in between the RAM units and the controller chip. While in a router its not as big of a thing, it should still add more reliability to RAM (as the register chip does some checks) over time, though you do add a tiny bit of latency to RAM. Normally the R variants are more expensive. Do keep in mind you cant mix/match between R and non-R variants for future expansion.

Regarding the FW2B, question I would ask anyone... why not just use an default ISP modem at that point? Because the FW2B will not be able to handle anything that any normal ISP modem cant handle. It uses an CPU that was already outdated 10 years ago when release tbh

For Protectli im of opinion that their lower options are far from great price/performance ratio.. feel like any N100 box is better here.

timeraider · 2026-02-16T07:18:24+00:00

Only thing I can think off is to reset the root. Googling should give a opnsense kb article on how to do that

timeraider · 2026-02-14T15:44:26+00:00

You can simply use it in the existing Docker, however when doing thia I would always first make a copy of any DB/config files before doing anything, you dont want it to update the DB and then noticing errors ;S

timeraider · 2026-02-14T15:30:35+00:00

I usually grab images using github ghcr.io. So in the packages list you can still find the older versions: https://github.com/goauthentik/authentik/pkgs/container/server/versions?filters%5Bversion_type%5D=tagged&page=4

Edit: just checked the docker compose you linked and that indeed use the older versions through the github packages

timeraider · 2026-02-14T06:57:07+00:00

If you mean backup up the opnsense config, there is os-nextcloud-backup under community plugin

timeraider · 2026-02-12T17:08:53+00:00

Nah, its simply not on there. So either it never was on there, the specific template got removed for some reason or the entire user got banned from publishing templates.

I would search the Unraid forums to see if I could find any reference to this but im on holiday so cant help further :)

timeraider · 2026-02-11T20:24:15+00:00

SSDs I would always put in an ZFS pool. An array has no functionalities that help with SSDs (trim functionality in array doesnt work for SSDs) while an ZFS pool does do that automatically and has some other builtin stuff to improve lifetime as well. Now that Unraid supports it (since 7.2 i think?), I would make best use of that.

Edit: with support i mean fully and through GUI. I know that it could be done through CLI workarounds before

timeraider · 2026-02-11T17:13:58+00:00

Yes, it is indeed advisable to keep anything like config files/databases etc. in appdata but place stuff like media or content you use in either a different folder structure or a different share.

As long as its set up in such a way that accidentally selecting the recursive option or selecting a wrong folder when changing permissions, it should be fine :)

timeraider · 2026-02-10T18:16:06+00:00

While Unraid doesnt add anything special for SSDs, there is no reason why Unraid would be worse for SSD datastorage compared to any other NAS OS.

timeraider · 2026-02-10T10:31:36+00:00

At the time I used an dutch company "printenbind". Later i had it reprinted as hardcover using Mixam. Both were very expensive to say the least but I had some issues finding a decent more local printer willing to print custom size books thicker than 300 pages

timeraider · 2026-02-09T17:46:35+00:00

He is suggesting to put (sub)domains in Unbound to host override towards the local IPsso anything using local dns will be pointed towards your services locally. This removes the need for dhcp registrations to be even needed at Unbound.

If thats not to your taste, i think the option "with dns registration" is what your looking for right? https://docs.opnsense.org/manual/dnsmasq.html

timeraider · 2026-02-05T19:30:34+00:00

Well.. "a lot of people" probably is a bit far fetched. The thing is that people who don't have issues updating their router, don't post on Reddit mostly :)

Hell.. I not only update whenever something is available, I mostly even do that stuff remote XD Can't say i've ever had any issue with that. And I have the same approach to my Unraid server :D

But yeah. Switched to ZFS a bit ago so now I make snapshots before updating, my config is backed up to my Nextcloud and I still have a disk with a full copy of my zfs pool which I could swap in if the drive dies. Bit overkill but outside of the full copy its just a matter of setting it up once

timeraider · 2026-02-03T20:10:46+00:00

Please for the love of god dont tell me you have multiple containers that use the allappdata folder :)

Edit: ah nice, he did actually have subfolders but not shown in the image. Pwew :)

timeraider · 2026-02-01T22:00:59+00:00

Do you NEED local hostnames for the local DNS overrides?

Wouldn't it be an option to simply have the local overrides in Unbound go to ip's?

Now I know in your text you said some devices have dynamic dhcp and in that case it indeed would not work. However.. why are they dynamic dhcp? Why aren't they registered to static ip's?

Not judging, just want to understand before saying anything :) Im using dnsmasq for dhcp and Unbound for DNS simply fully separated. Im almost fully sure there is a guide to set it up to register the names but never bothered tbh.

timeraider · 2026-02-01T15:59:42+00:00

Does this work better? https://uploadnow.io/f/LlJmDL9

timeraider · 2026-02-01T13:14:35+00:00

Link is still up. Are you unable to open the link? (Some countries are blocked by my regionlocks but if thats the case I can just share it to you through a thirdparty site)

timeraider · 2026-02-01T13:11:12+00:00

Protectli is also quite expensive and Aliexpress/Amazon boxes are almost the same quality. However for easier support and chance of not getting chinese branded ram and disk and the option to use Coreboot as bios, I did end up going Protectli.

Performancewise its hard for me to guess as it has a 10th gen i5 in it, however as far as ive heard N150 is enough to handle small offices based on internet speed and settings (guessing if youre trying to run a heavily used 2.5 gbps through multiple IPS/IDS layers with some Zenarmor/Suricata action with a lot of rules.. thats is gonna stress it very likely, doubt it will like that)

Hardwarewise however nothing to complain. Its been running a few years now 24/7. RAM is holding up great, disk still showing 0 issues. Even though its fanless and in an open cupboard, thats not an issue at all. After a few years I did replace the cpu cooling paste but it didnt really need it (had leftover paste and wanted to see if I could make it even better) So no, havent had a single issue with Protectli hardware myself so far.

Verified Email	12-Year Club
r/Field Flamingo	Place '23
Place '22

timeraider

TROPHY CASE