Hasty Briefsbeta

All tags

#networking

197 stories total

Bilingual

The Beauty of Having a Pi-Hole
a year ago
- Pi-hole is a DNS proxy that blocks unwanted domains, improving privacy and reducing unnecessary network traffic.
- Setting up Pi-hole requires a Raspberry Pi, minimal hardware, and some time to configure network settings.
- Pi-hole can block up to 66.6% of network traffic without impacting functionality.
- Community blocklists, like those from Firebog, can be used to block known trackers and malicious domains.
- Advanced configurations, such as blocking specific TLDs (e.g., .cn, .ru, .hk), enhance security.
- Devices may bypass DNS settings; iptables rules can force all DNS traffic through Pi-hole.
- Combining Pi-hole with browser ad-blockers (e.g., uBlock Origin) provides additional layers of ad and tracker blocking.
- Pi-hole significantly improves online quality of life by reducing ads, trackers, and malicious scripts.
Podfox: First Container-Aware Browser
a year ago
- Containers have become essential for running project dependencies without cluttering the host system.
- Port conflicts in Docker Compose setups led to frustration with port forwarding.
- Podman's rootless networking uses Linux namespaces and tools like slirp4netns and pasta.
- Podfox is a SOCKS proxy that allows direct access to containers without port forwarding.
- Podfox resolves container hostnames like <container>.<network>.podman and proxies requests.
- A simple Firefox WebExtension or PAC file can route .podman domains to Podfox.
- Homebrew is used to share CLI tools across containers by mounting its prefix read-only.
- Podchamp is a fish script for managing project-specific dev containers with custom configurations.
- Terminal emulators like Ptyxis can be container-aware, improving the development workflow.
eBPF Mystery: When is IPv4 not IPv4? When it's pretending to be IPv6
a year ago
- The article discusses an eBPF program designed to redirect DNS requests on port 53 for a single program or Docker container.
- The initial setup used BPF_CGROUP_INET4_CONNECT to inspect and redirect traffic from within a cgroup.
- A problem arose when the dotnet CLI hung indefinitely, producing blocked IPv6 messages despite the machine not supporting IPv6.
- Investigation revealed that dotnet uses DualMode sockets, which handle IPv4 traffic via IPv6 sockets, encoding IPv4 addresses within IPv6 addresses.
- The solution involved updating the eBPF program to handle IPv4-mapped IPv6 addresses by parsing the IPv4 address from the IPv6 socket.
- Additional adjustments were needed in the egress eBPF program to distinguish between true IPv6 traffic and IPv4-mapped IPv6 traffic.
Show HN: MMORPG prototype inspired by World of Warcraft
a year ago
- Everwilds is a prototype demonstrating MMORPG networking and netcode architecture, inspired by games like World of Warcraft.
- It serves as a learning resource for developers interested in real-time online RPGs, covering synchronization and client-server interaction.
- Features include client-server architecture, character movement, basic combat, leveling system (up to level 10), and a chat system.
- Uses World of Warcraft's player movement synchronization technique for smooth replication and scalability.
- Built with Three.js, TypeScript, and HTML/CSS.
- To run locally: clone the repo, install dependencies, build, and start the server (requires manual asset copy on Windows).
Tailscale 4via6 – Connect Edge Deployments at Scale
a year ago
- Tailscale 4via6 subnet routing addresses connectivity challenges in edge and customer network deployments.
- Common connectivity problems include multiple NAT layers, restrictive network policies, and fixed CIDR ranges.
- Three approaches to tackle these challenges: consolidation, dedicated sub-network, or bypassing existing infrastructure.
- 4via6 supports network-in-a-network approaches, ideal for complex deployments like cameras, sensors, and robots.
- Site-to-site VPNs are not suitable for edge infrastructure due to CIDR overlaps and lack of public IPs.
- 4via6 enables seamless connections between identical networks without managing IPs, CIDR ranges, or ports.
- Key requirements for ideal setup: isolation, customer-wide connectivity, and secure remote access.
- 4via6 works on any internet connection (LTE, 5G, satellite) and integrates with Tailscale's fine-grained ACLs.
- Use case: robots and autonomous vehicles benefit from 4via6 for unified network management.
- Devices can be accessed via MagicDNS names or IPv6 addresses, simplifying connectivity.
- 4via6 also supports cloud deployments, linking VPCs across environments with overlapping CIDRs.
- Available on all Tailscale plans, with enhanced security features on Premium and Enterprise tiers.
The FreeBSD-native-ish home lab and network
a year ago
- The author runs a FreeBSD home server named 'pingvinashen' on an old laptop, serving as an email server, web server, and public chat server (XMPP/Jabber).
- The home network setup includes IPv6 via Hurricane Electric, multiple VLANs for guests, and a static IP from ISP Ucom.
- The server uses FreeBSD Jails for isolation, managed by the author's tool 'Jailer', hosting services like WordPress, Git (Gitea), PostgreSQL, and automation tools (Huginn).
- Other services include nginx for web traffic, BIND9 for DNS, OpenSMTPd for email, Prosody for chat, and WireGuard for VPN.
- The home router, 'evn0', also runs FreeBSD, handling routing, DHCP, DNS, and VLAN management with pf for firewall security.
- A Lenovo T480s laptop runs additional services like Unifi Management in a Jail and Jellyfin for media.
- A Raspberry Pi 4 is repurposed as a TimeMachine backup server using Samba.
- The author advocates for FreeBSD Jails over hardware virtualization for resource efficiency and prefers CLI over GUI for reproducibility.
Beej's Guide to Network Concepts
a year ago
- Brian 'Beej Jorgensen' Hall is the author.
- Document version is v1.0.32, last updated on May 6, 2025.
- Mentions Content-Type and Content-Length.
- Lists files: file1.txt and file2.html.
- References functions: get_next_word_packet() and extract_word().
- File extensions mentioned: .txt and .dat.
- References select() and send() functions.
- Mentions 'chatui' and the number '1'.
- CTRL-C is referenced.
Upgrading my 25gbit internet router to VyOS
a year ago
- Upgraded a 25gbit internet router to VyOS using new hardware (MS-01 and Mellanox SFP28 card) to avoid downtime.
- Installed Proxmox on the MS-01 to run VyOS as a VM for easier upgrades and backups.
- Configured PCI passthrough for SFP+ and SFP28 interfaces, and set up VLANs (100, 150, 200, 900) for network segmentation.
- Used bridges in VyOS to connect VLANs and physical interfaces, applying firewall and routing rules.
- Encountered and resolved VLAN routing issues by adjusting load-balancing rules.
- Set up automated backups for VyOS configuration using cronjobs.
- Implemented DDNS for dynamic IP updates.
- Configured a DMZ for hosted services (Matrix, Mastodon) with NAT and firewall rules.
- Used Split DNS for internal service access to avoid Hairpin NAT issues.
- Configured WAN failover with priority for Init7, Swisscom, and Yallo connections.
- Set up WireGuard for VPN access with specific firewall rules.
- Noted improved performance over OPNSense and plans for future IPv6 and special routing configurations.
How to Build an Anycast Network
a year ago
- Browsers perform DNS lookups to convert domain names to IP addresses for networking.
- Anycast networks involve multiple servers advertising the same IP from different locations to improve redundancy and reduce latency.
- The Internet is decentralized, managed by Autonomous Systems (AS) using Border Gateway Protocol (BGP) for routing.
- Anycast networks are beneficial for high availability, low latency, and global traffic distribution.
- Render uses anycast to simplify DNS configuration for custom domains, routing traffic to the nearest server.
- Setting up an anycast network requires obtaining an Autonomous System Number (ASN) and acquiring an IP address block.
- IP blocks can be bought or leased, with considerations for cost, stability, and reputation.
- Hosting providers like Vultr and Equinix Metal support BGP for anycast network setup.
- Configuring BGP involves setting up a BGP daemon (e.g., BIRD) and announcing routes to peers.
- Anycast networks optimize performance by routing traffic efficiently, though fine-tuning may be needed for optimal paths.
CPanel's IPv6 Overhaul
a year ago
- IPv6 has been properly implemented in cPanel/WHM, enabling dual-stack hosting without complex workarounds.
- Previous limitations included SNI not being usable with shared IPv6 addresses and requiring separate prefixes for servers and websites.
- The Network Crew Pty Ltd (TNC) worked with APNIC’s Technical Assistance Platform (TAP) to resolve IPv6 deployment issues.
- Key problems included RouterOS v7 routing oddities and cPanel/WHM’s IPv6 implementation.
- TNC collaborated with cPanel developers to remove IPv6 overlap restrictions and resolve legacy warnings.
- Changes were tested in development builds and later promoted to stable and LTS releases.
- TNC deployed AAAA records and /96 prefixes for smooth dual-stack implementation.
- Internal network resilience was improved with BGP and VRRP for both IPv4 and IPv6.
- APNIC TAP’s support was instrumental in achieving network overhaul and IPv6 deployment.
- The successful IPv6 deployment contributes to the APNIC region crossing the 50% IPv6 adoption milestone.
Direct TLS can speed up your connections
a year ago
- Aurora DSQL connections were slower without VPN, specifically in AWS offices.
- Debugging revealed an extra non-Postgres connection was being made for each cluster connection.
- Cisco firewall was initiating a second TLS 1.2 handshake to inspect certificates due to TLS 1.3 encryption.
- Postgres 17 introduced direct TLS support, allowing TLS handshake without prior SSLRequest.
- Direct TLS in Postgres 17+ clients requires `sslmode=require` and `sslnegotiation=direct`.
- Aurora DSQL enforces TLS, making direct TLS a recommended feature for faster connections.
- Example connection strings provided for `psql` and `pdsql` with direct TLS parameters.
No Internet Access? SSH to the Rescue
a year ago
- The article discusses a method to bypass internet restrictions on a remote VM using SSH tunneling.
- A reverse SSH tunnel is created from the client to the server to establish a connection back to the client.
- Dynamic port forwarding is set up to route internet traffic through the client's connection.
- Environment variables are configured to use the SSH tunnel as a proxy for internet access.
- The technique demonstrates the flexibility of UNIX/Linux systems in solving connectivity issues.
EasyTier – P2P mesh VPN written in Rust using Tokio
a year ago
- Decentralized networking solution with no distinction between client/server and no reliance on centralized services.
- Nodes are equal and independent.
- Powered by Rust and Tokio.
- Aims to be simple and secure.
- Encourages sponsorship to support ongoing development and maintenance.
An illustrated guide to Amazon VPCs
a year ago
- VPCs (Virtual Private Clouds) were invented to solve IP address conflicts and security issues in AWS.
- Before VPCs, all AWS instances ran in a single shared network, leading to potential data exposure and IP conflicts.
- IP address conflicts occur when multiple servers, especially on-prem and AWS, share the same IP address.
- VPCs provide each customer with a private network within AWS, isolating their instances from others.
- The mapping service in AWS ensures instances within a VPC can communicate securely without IP conflicts.
- VPCs span availability zones within a region but do not cross regions.
- Every AWS account comes with a default VPC, ensuring isolation and security by default.
- Terraform can be used to create and manage VPCs, with code snippets provided for easy setup.
Broadcom Tomahawk 6 Launched for 1.6TbE Generation
a year ago
- Broadcom launches Tomahawk 6 series, a 102.4Tbps switch supporting up to 64 ports of 1.6TbE.
- Two ASIC models available: BCM78910 and BCM78914, catering to different configurations and applications.
- Features include co-packaged optics, 512x 200G PAM4 or 1024x 100G PAM4 options, and Global Load Balancing 2.0.
- Cognitive Routing 2.0 enhances load balancing across network paths, improving data movement efficiency.
- Designed for both scale-up (high bandwidth between fewer nodes) and scale-out (connecting numerous accelerators).
- Advantages include reduced latency, fewer switches, lower power consumption, and cost savings on optics and cables.
- Tomahawk 6 addresses the growing demand in AI clusters, where networking is a significant cost and power consumer.
- Broadcom faces competition from NVIDIA, which is closing its ecosystem to non-NVIDIA NICs and PCIe switches.
- Power and noise make these switches impractical for home labs, with most ending up in collections or museums.
- The market is bifurcating, with high-end AI switches receiving more investment than low-power alternatives.
Ditching HAProxy (In My Homelab)
a year ago
- Single HAProxy VM was a single point of failure in the homelab, causing access issues to Kubernetes services.
- Explored solutions like keepalived, VIPs, and MetalLB to address redundancy and high availability.
- MetalLB in layer 2 mode worked seamlessly for IPv4, simplifying service exposure via LoadBalancer.
- Challenges remain with IPv6 implementation despite successful IPv4 routing.
- Kubernetes distribution supported VIPs for kube-apiserver access, enhancing control plane reliability.
- Tailscale Kubernetes operator improved, enabling direct routing and LoadBalancer functionality with failover capabilities.
- Successfully eliminated HAProxy dependency, ensuring no service disruption during tests.
- Gained confidence in networking, motivating deeper exploration into BGP and IPv6.
- DNS played a crucial role in minimizing downtime during the transition.
- Homelab now operates with improved resilience against server failures.
PCI-Sig Releases PCIe 7.0 Specification to Support 128.0 GT/S Transfer Rates
a year ago
- PCI-SIG releases PCIe 7.0 specification with 128.0 GT/s transfer rates.
- Targets AI/ML, 800G Ethernet, cloud, and Quantum computing applications.
- Features include 128.0 GT/s raw bit rate, PAM4 signaling, and improved power efficiency.
- Maintains backwards compatibility with previous PCIe generations.
- Pathfinding for PCIe 8.0 specification already in progress.
- Datacenters and ASIC companies are ready to deploy PCIe 7.0 technology.
- PCIe 7.0 has more enthusiasm than previous versions despite PCIe 6.0's popularity.
How to modify Starlink Mini to run without the built-in WiFi router
a year ago
- The Starlink Mini terminal has an integrated Wi-Fi router, but advanced users can remove it for custom setups.
- This modification is only applicable to the Starlink Mini 1 as of June 14, 2025.
- Disassembly requires tools like metal spudgers and a plastic prying tool, with a video manual available.
- Removing the metal plate is discouraged as it acts as a heatsink and EMI shield.
- The Starlink Mini PCB connector uses a 2 mm pitch and requires careful handling due to EMI concerns.
- A 1 Gbps Ethernet link connects the primary unit and router, with no Ethernet transformer included.
- The primary voltage bus is 12 VDC, with specific pinout details provided for the connector.
- A direct Ethernet connection schematic is recommended, with short wires and proper shielding.
- The terminal provides a DHCP IP address (192.168.100.0/24) and can be accessed at 192.168.100.1.
- After connecting to Starlink, the Ethernet interface provides a tunneled DHCP service with CGNAT IPv4 and IPv6 addresses.
- Static routes may be needed to maintain access to the terminal's web UI after obtaining an external IP.
- gRPC status codes provide detailed information on connection issues and account status.
- Possible outage causes include thermal shutdown, obstructions, and signal issues.
- Disablement codes indicate account status, such as no active account, roaming restrictions, or unsupported locations.
Learning (The Basics of) Nftables
a year ago
- nftables is a modern replacement for iptables, introduced in 2014, offering efficiency and easier extensibility.
- nftables reduces code duplication and supports a more intuitive configuration language compared to iptables.
- iptables-nft is a compatibility layer allowing users to use iptables commands while translating them to nftables rules.
- nftables configuration is file-based, unlike iptables which requires iptables-restore for loading rules.
- Tables in nftables can be defined for different protocols (inet, ip, ip6), with chains specifying default policies (drop/accept).
- Rules can be added to chains to allow specific traffic, such as permitting SSH on a particular interface.
- Forwarding rules enable traffic between interfaces, useful for LAN configurations.
- NAT rules in nftables are straightforward, allowing source NAT for traffic from a local subnet via a public interface.
- The author found nftables enjoyable to work with and encourages others to rewrite their firewalls using it.
Locally hosting an internet-connected server
a year ago
- Using a cheap VPS with multiple IP addresses to bypass ISP limitations.
- Setting up Wireguard for a point-to-point link between VPS and local machine.
- Configuring iptables on VPS to redirect traffic to the local machine.
- Adjusting Wireguard settings to allow packets from any source.
- Implementing policy routing to manage traffic flow effectively.
- Ensuring local systems remain accessible even with dynamic IP changes.

first prev1next

About|Login

#networking

The Beauty of Having a Pi-Hole

Podfox: First Container-Aware Browser

eBPF Mystery: When is IPv4 not IPv4? When it's pretending to be IPv6

Show HN: MMORPG prototype inspired by World of Warcraft

Tailscale 4via6 – Connect Edge Deployments at Scale

The FreeBSD-native-ish home lab and network

Beej's Guide to Network Concepts

Upgrading my 25gbit internet router to VyOS

How to Build an Anycast Network

CPanel's IPv6 Overhaul

Direct TLS can speed up your connections

No Internet Access? SSH to the Rescue

EasyTier – P2P mesh VPN written in Rust using Tokio

An illustrated guide to Amazon VPCs

Broadcom Tomahawk 6 Launched for 1.6TbE Generation

Ditching HAProxy (In My Homelab)

PCI-Sig Releases PCIe 7.0 Specification to Support 128.0 GT/S Transfer Rates

How to modify Starlink Mini to run without the built-in WiFi router

Learning (The Basics of) Nftables

Locally hosting an internet-connected server