• 3 Posts
  • 30 Comments
Joined 7 months ago
cake
Cake day: April 20th, 2024

help-circle



  • Why do you keep stating blatantly false info as facts when it is obvious that you’re knowledge of the topic at hand is superficial at best?

    In this comment thread alone you’ve stated that:

    • to avoid “Google Android”, one should use Lineage OS (?)
    • Apps on Lineage are some kind of separated on Lineage OS and not abandonware (??)
    • Lineage OS is not terrible for security, because you haven’t found anything wrong with it besides that small little, insignificant detail of an unlocked bootloader (???)
    • DivestOS has “all the same issues” as GrapheneOS(???)

    Genuinely not trying to stir up shit, I’m curious. Why?



  • 15-20 years ago, I’d have agreed with you. But apart from a select few news sites and exceedingly rare static sites, what percentage of websites most users use day to day actually function even minimally without JavaScript?

    I’m convinced that in practice, most users would be conditioned to whitelist pretty much every site they visit due to all the breakage. Still a privacy and security improvement, but a massive one? I’m not sure.

    Very happy to be convinced otherwise.


  • Emotet@slrpnk.nettoLinux Gaming@lemmy.worldGaming on Linux is great!
    link
    fedilink
    English
    arrow-up
    7
    arrow-down
    4
    ·
    3 months ago

    Ehhh.

    Yeah, compared to a few years ago, it’s very much improved and a lot of games, especially those on Steam, run pretty good and in rare cases even better than on their native platform, Windows.

    But the pretty much broken state of VR support combined with some annoying bugs that are very hard to troubleshoot even for advanced users, the decision by most AAA and even some smaller studios to actively block Linux clients in multiplayer games via anti-cheat measures and the usual Linux fuckery of HDR, VRR (which hopefully will get better now that Wayland is getting there) and some NVIDIA fuckery (which is also getting better) leads to the following conclusions for me:

    1. Linux Gaming is improving.
    2. If all you play are some indie titles and/or single-player titles, you may be good.
    3. If you want to play in VR, most popular multiplayer titles and rely on features such as HDR and VRR, you’ll still need to dual boot into Windows.

    I’m very much looking forward to the day when I can fully banish Windows, at least from my private machines. I’m very tolerant towards debugging and living on the bleeding edge, if that is needed. But I don’t see the need for Windows for PC gaming to go away anytime soon for most users and, frankly, writing love letters to Linux Gaming without mentioning even some hurdles can, has and will take new Linux users by surprise and turn them off. Communicating transparently, so the user can make their own informed decisions, is a better strategy.








  • Emotet@slrpnk.nettoSelfhosted@lemmy.worldServer build for Family
    link
    fedilink
    English
    arrow-up
    5
    ·
    edit-2
    4 months ago

    While this is a great approach for any business hosting mission critical or user facing ressources, it is WAY overkill for a basic selfhosted setup involving family and friends.

    For this to make sense, you need to have access to 3 different physical locations with their own ISPs or rent 3 different VPS.

    Assuming one would use only 1 data drive + an equal parity drive, now we’re talking about 6 drives with the total usable capacity of one. If one decides to use fewer drives and link your nodes to one or two data drives (remotely), I/O and latency becomes an issue and you effectively introduced more points of failure than before.

    Not even talking about the massive increase in initial and running costs as well as administrive headaches, this isn’t worth it for basically anyone.



  • I’ve been tempted by Tailscale a few times before, but I don’t want to depend on their proprietary clients and control server. The latter could be solved by selfhosting Headscale, but at this point I figure that going for a basic Wireguard setup is probably easier to maintain.

    I’d like to have a look at your rules setup, I’m especially curious if/how you approached the event of the commercial VPN Wireguard tunnel(s) on your exit node(s) going down, which depending on the setup may send requests meant to go through the commercial VPN through your VPS exit node.

    Personally, I ended up with two Wireguard containers in the target LAN, a wireguard-server and a **wireguard-client **container.

    They both share a docker network with a specific subnet {DOCKER_SUBNET} and wireguard-client has a static IP {WG_CLIENT_IP} in that subnet.


    The wireguard-client has a slightly altered standard config to establish a tunnel to an external endpoint, a commercial VPN in this case:

    [Interface]
    PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    Address = XXXXXXXXXXXXXXXXXXX
    
    PostUp = iptables -t nat -A POSTROUTING -o wg+ -j MASQUERADE
    PreDown = iptables -t nat -D POSTROUTING -o wg+ -j MASQUERADE
    
    PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
    
    PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
    
    [Peer]
    PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    AllowedIPs = 0.0.0.0/0,::0/0
    Endpoint = XXXXXXXXXXXXXXXXXXXX
    

    where

    PostUp = iptables -t nat -A POSTROUTING -o wg+ -j MASQUERADE
    PreDown = iptables -t nat -D POSTROUTING -o wg+ -j MASQUERADE
    

    are responsible for properly routing traffic coming in from outside the container and

    PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
    
    PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
    

    is your standard kill-switch meant to block traffic going out of any network interface except the tunnel interface in the event of the tunnel going down.


    The wireguard-server container has these PostUPs and -Downs:

    PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

    default rules that come with the template and allow for routing packets through the server tunnel

    PostUp = wg set wg0 fwmark 51820

    the traffic out of the tunnel interface get marked

    PostUp = ip -4 route add 0.0.0.0/0 via {WG_CLIENT_IP} table 51820

    add a rule to routing table 51820 for routing all packets through the wireguard-client container

    PostUp = ip -4 rule add not fwmark 51820 table 51820

    packets not marked should use routing table 51820

    PostUp = ip -4 rule add table main suppress_prefixlength 0

    respect manual rules added to main routing table

    PostUp = ip route add {LAN_SUBNET} via {DOCKER_SUBNET_GATEWAY_IP} dev eth0

    route packages with a destination in {LAN_SUBNET} to the actual {LAN_SUBNET} of the host

    PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip route del {LAN_SUBNET} via {DOCKER_SUBNET_GATEWAY_IP} dev eth0

    delete those rules after the tunnel goes down

    PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECT
    PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECT
    

    Basically the same kill-switch as in wireguard-client, but with the mark manually substituted since the command it relied on didn’t work in my server container for some reason and AFAIK the mark actually doesn’t change.


    Now do I actually need the kill-switch in wireguard-server? Is the kill-switch in wireguard-client sufficient? I’m not even sure anymore.



  • Oh, neat! Never noticed that option in the Wireguard app before. That’s very helpful already. Regarding your opnsense setup:

    I’ve dabbled in some (simple) routing before, but I’m far from anything one could call competent in that regard and even if I’d read up properly before writing my own routes/rules, I’d probably still wouldn’t trust that I hadn’t forgotten something to e.g. prevent IP/DNS leaks.

    I’m mainly relying on a Docker and was hoping for pointers on how to configure a Wireguard host container to route only internet traffic through another Wireguard Client container.

    I found this example, which is pretty close to my ideal setup. I’ll read up on that.




  • We have to vote for the people who will admit to that and get rid of them. The U.S. is going to have to choose between a leader who tries to install good people to run the government and one who intends to install people bent on dismantling the government and giving loyalty to the leader alone.

    I largely share your thoughts. I honestly expected Biden to at least be prepared enough to counter the usual Trump tactics of making things up and using strong words to impress his base while deflecting blame or critical questions.

    Instead, we got Trump basically having free rein to appear strong with simple (and wrong) answers to complex questions, twisting the truth to support his positions and straight up lying and deflecting when finally confronted with something.

    I’m not a big fan of Biden, but IMO he’s the obvious, rational choice out of two candidates way past their prime - if you’re into rationality over the antics of a con artist.

    But this isn’t a fair fight, and Biden isn’t the showman Trump managed to be today. Biden was barely audible and mostly on the defensive while appearing weak, Trump was the opposite of that. I can’t imagine any Trump voter switching teams after the debate, but I can image more than a few more emotionally motivated democrats second guessing their choice.


  • The export/import functionality is, yes. This implementation uses the same API endpoints, but the main reason for this existing:

    An instance I was on slowly died, starting with the frontend (default web UI). At least at the time, no client implemented the export/import functionality, so I wrote a simple script in Bash to download the user data, if the backend still works.

    Running a script can still be a challenge to some users, so I wrote a web application with the same functionality.

    It’s a bit redundant if we’re talking about regularly working instances, but can be of use if the frontend isn’t available for some reason.