Hasty Briefsbeta

All tags

#networking

197 stories total

Bilingual

DENT: A network operating system (NOS) for everyone else
4 months ago
- Build an ecosystem around a Linux-supported network operating system and control plane.
- Foster an open-source community for network OS, control, and management plane use cases.
- Enable collaboration across developers, providers, and users in the networking stack.
- Establish a neutral home with governance, infrastructure, and operations.
- Invite the networking ecosystem to participate in building a common network OS.
FreeBSD Home NAS, part 3: WireGuard VPN, routing, and Linux peers
4 months ago
- Setting up a home server on FreeBSD 14.3 to serve as a NAS.
- Configuring WireGuard VPN for secure access between office and home networks.
- Comparison between WireGuard and OpenVPN highlighting WireGuard's advantages like smaller codebase, kernel module operation, and peer-to-peer model.
- Network architecture includes office (192.168.0.0/24) and home (192.168.100.0/24) networks with FreeBSD as the VPN server.
- Installation and configuration of WireGuard on FreeBSD including key generation and firewall settings.
- Setting up WireGuard on Arch Linux client with key exchange and connection establishment.
- Configuring cross-LAN access between office and home networks via routing table adjustments.
- Finalizing Packet Filter (PF) firewall rules to allow traffic between networks and ensure security.
Nineteen Septillion Addresses – Setting Up an ASN and Getting an IPv6 Allocation
4 months ago
- The author explores the process of obtaining and setting up their own IPv6 address space, including getting an ASN (Autonomous System Number) and configuring BGP (Border Gateway Protocol).
- They discuss the challenges of IPv4 scarcity and the advantages of IPv6, including the vast address space and the ability to have publicly routable addresses without NAT.
- The author details their setup with a VPS (Virtual Private Server) and the use of BIRD for BGP configuration to announce their IPv6 prefixes.
- They explain the use of WireGuard for tunneling IPv6 traffic to devices behind a CGNAT (Carrier-Grade NAT) connection, including configuring a Teltonika router for this purpose.
- The article concludes with thoughts on future improvements, such as peering with other networks and exploring 44Net for IPv4 addresses reserved for the amateur radio community.
Show HN: BGP Scout – BGP Network Browser
4 months ago
- Access comprehensive Border Gateway Protocol (BGP) data from thousands of networks worldwide.
- Free demo account available for trial.
- Monitor BGP routing changes in real-time with a live feed system.
- Analyze routing trends using a comprehensive historical database.
- Integrate BGP data into applications via a robust API.
- Join BGPscout for these services.
pf: Make af-to less magical
4 months ago
- David Gwynne proposes making the 'af-to' option in pf less magical by removing its special case restrictions.
- Current 'af-to' restrictions include only working on incoming packets ('pass in' rules) and forcing translated packets to be forwarded, creating only one state.
- The proposed change allows 'af-to' to work on 'pass out' rules and lets the local stack handle translated packets, similar to 'rdr-to'.
- This change simplifies the code by removing special cases but requires additional rules for outgoing traffic in forwarded connections.
- Feedback is sought from users who utilize 'af-to' to ensure the changes maintain functionality while simplifying the codebase.
Show HN: Pipenet – A Modern Alternative to Localtunnel
4 months ago
- Pipenet is a modern alternative to localtunnel, offering both client and server components for hosting your own tunnel infrastructure.
- It allows exposing local services to the internet, sharing local servers with teammates, testing webhooks, and demoing work without deploying.
- Pipenet can be embedded in tools to provide tunneling capabilities, such as connecting local MCP servers with remote AI clients.
- Users can run their own tunnel server for full control over security, domains, and availability.
- Pipenet supports multiple protocols including HTTP/HTTPS, WebSocket, SSE, and HTTP Streaming.
- It features programmatic usage for testing, automation, and integration with detailed event handling.
- Pipenet offers cloud deployment with single-port support, multiple domains, and is built with TypeScript and ES Modules.
- The tool includes lifecycle hooks for deploying custom tunnel infrastructure, allowing for detailed monitoring and control.
- Pipenet provides a comparison with localtunnel, highlighting advantages like active maintenance, multiple domains support, and modern deployment features.
Targeted Bets: An alternative approach to the job hunt
4 months ago
- The tech job market is tough, making targeted bets more effective than broad applications.
- A targeted bet involves focusing on 5-10 specific opportunities where you have a unique interest or connection.
- Stand out by contacting current employees multiple times and avoiding direct referral requests.
- For small companies (<30 people), reaching out directly to the CEO can be effective.
- Targeted bets increase your chances per application, reducing the total number needed.
- This strategy applies beyond job searches, like securing competitive apartments.
- The real benefit is focusing on what you truly care about, increasing both success and satisfaction.
10GbE in 2026 Is Finally Hitting the Tipping Point
3 months ago
- 10GbE technology is becoming more affordable and easier to integrate, signaling a tipping point in the industry.
- Realtek RTL8127 is a new low-cost 10Gbase-T NIC, priced just above $10 per controller, utilizing PCIe Gen4 x1 links for efficient integration.
- Marvell AQC113/AQC113C adapters, derived from Aquantia, offer low-cost 10Gbase-T networking and are popular among major brands like Lenovo and Apple.
- Intel E610, launched in 2025, is emerging as a server adapter with power efficiency but faces early bugs and higher costs compared to Realtek and Marvell solutions.
- Intel X710-T4L and X710-T2L adapters support Nbase-T speeds (2.5GbE and 5GbE), distinguishing them from other models without this capability.
- Cabling is a significant challenge for 10G adoption, with longer runs of lower category cables often failing to support 10GbE reliably.
- There's interest in a deeper dive into testing setups and practical guides for 10G copper networking, including cable types and DACs.
When Every Network is 192.168.1.x
3 months ago
- Default subnets in consumer routers and ISP modems cause address conflicts across multiple customer sites.
- Traditional solutions like port forwarding and subnet routing fail due to dynamic NAT configurations and overlapping subnets.
- Overlay addressing with 1:1 NAT assigns unique IPs in the 100.64.0.0/10 range, avoiding conflicts and enabling secure access.
- A gateway device on each customer's LAN performs NAT translation, allowing devices to be accessed via unique overlay addresses.
- Netrinos automates the configuration of WireGuard peers, NAT rules, and DNS records across hundreds of sites.
- This approach eliminates the need for port forwarding, reduces attack surfaces, and ensures connectivity despite ISP changes.
Reliable 25 Gigabit Ethernet via Thunderbolt
3 months ago
- Tiny Thunderbolt to 25 Gigabit Ethernet adapter available on Amazon, powered by the host with no additional power supply needed.
- Comes in single and dual port SFP28 versions, starting at $157, but lacks reviews and manufacturer information.
- Identifies as 'PX Thunderbolt to Ethernet' on macOS, plug-and-play without additional drivers.
- Gets extremely hot during use, leading to network disconnections or kernel panics on macOS.
- Performance tests show speeds up to 20.7 Gbits/sec unidirectional and 25.4 Gbits/sec bidirectional.
- Internally consists of a Mellanox ConnectX-4 Lx EN OCP 2.0 card and a Thunderbolt 3 adapter PCB.
- Added large heat sinks with thermal pads to reduce temperatures by 15 Kelvin, improving stability.
- Firmware update requires a Linux or Windows machine with Thunderbolt support, not possible on macOS.
- Updated firmware and cooling solution have made the adapter stable for continuous use.
- Does not fit in the original travel case after adding heat sinks.
Pangolin (YC S25) is hiring software engineers (open-source, Go, networking)
3 months ago
- Pangolin is hiring talented engineers for building secure remote access solutions.
- Pangolin provides identity-aware remote access to internal apps and services, replacing legacy VPNs.
- The platform is open-source, self-hosted by default, and integrates with standard identity providers (IdPs).
- Pangolin's system is policy-driven, offers observability, health metrics, and an API for automation.
- Open roles are available for those interested in open-source auth and networking infrastructure.
We have ipinfo at home or how to geolocate IPs in your CLI using latency
3 months ago
- A CLI tool was developed to geolocate IP addresses to countries, US states, and cities using latency data.
- The tool leverages Globalping's network of over 3000 probes to perform ping and traceroute measurements.
- VPN providers often fake IP geolocation data, making latency-based detection a more reliable method.
- The tool uses a multi-phase approach: detecting the continent first, then the country, and optionally the US state or city.
- Traceroute was chosen over ICMP ping due to network restrictions, analyzing the last hop's latency for accuracy.
- The tool is open-source and can be run with a simple command, supporting customization via parameters.
- Hosting a Globalping probe or donating can increase the number of available tests for more accurate results.
Why aren't we using SSH for everything? (2015)
3 months ago
- SSH can be used for more than just shell access, such as chat applications like ssh-chat.
- SSH shares environment variables like $USER and $TERM with the server, allowing for customization.
- SSH supports multiple authentication methods, including public key authentication, which provides secure identity verification without user intervention.
- SSH connections are encrypted, with key fingerprint validation to prevent man-in-the-middle attacks.
- SSH supports multiplexing, allowing concurrent operations like port forwarding, shell access, and command execution.
- SSH is widely available across platforms, making it highly accessible.
- SSH has features similar to HTTP/2, such as encryption and multiplexing, but with built-in client authentication.
- SSH can be used for innovative applications like Multi-User Dungeons (MUDs), Distributed Hash Tables (DHTs), and RPC APIs.
- SSH could potentially be used to serve static files or even implement HTTP on top of it.
- SSH's versatility raises the question of why it isn't used more broadly for various applications.
GitHub - netbirdio/netbird: Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.
3 months ago
- NetBird offers a configuration-free peer-to-peer private network with centralized access control.
- Features include automatic WireGuard-based overlay network creation, eliminating complex setups like VPN gateways.
- Provides secure remote access with granular policies managed from a single interface.
- Supports universal deployment across any infrastructure.
- Quick start guide includes downloading NetBird, signing up, and adding machines.
- Self-hosted NetBird requires a Linux VM with specific public accessibility and domain setup.
- Software prerequisites include Docker, docker-compose, jq, and curl.
- Installation involves running a script with domain export and bash execution.
- NetBird architecture includes agents connecting to a Management Service for network state and peer IP management.
- Uses WebRTC ICE and STUN servers for peer-to-peer connections, with TURN as a fallback.
- NetBird joined the StartUpSecure program in November 2022, emphasizing security best practices.
- Built on open-source technologies like WireGuard®, Pion ICE, Coturn, and Rosenpass.
- Licensed under BSD-3-Clause, with specific directories under AGPLv3.
Reimplementing Tor from Scratch for a Single-Hop Proxy
3 months ago
- The author, a student, needed a fast VPN for mundane tasks like accessing email and installing Linux packages at school, without the anonymity features of Tor.
- Tor's multi-hop routing was too slow, leading the author to explore connecting directly to an exit node, which Tor intentionally disables for security reasons.
- The author discovered that Tor blocks direct client connections to exit nodes by checking identity digests to prevent single-hop proxy usage.
- By starting a relay node and using its keys, the author bypassed Tor's restrictions to establish a direct connection to an exit node, improving speed.
- The project involved reimplementing Tor from scratch in C++ for better control and debugging, focusing on cryptography and networking.
- Key steps included TLS handshakes, version exchanges, certificate verification, and key exchanges to establish a secure connection.
- The author successfully benchmarked the custom implementation (Kurrat) against Tor Browser, finding it faster for their needs.
- The implementation emphasizes error handling with std::optional and modular design for portability and maintainability.
- The code is open-source, with contributions and installation instructions available on GitHub.
DNS Explained – How Domain Names Get Resolved
3 months ago
- DNS translates domain names into IP addresses, making it easier to access websites without memorizing IPs.
- DNS is organized hierarchically: Root servers know TLD servers, which know domain servers, which know subdomains.
- Common DNS record types include A (IPv4), AAAA (IPv6), CNAME (aliases), MX (mail), and TXT (text for verification).
- TTL (Time To Live) determines how long DNS records are cached, affecting propagation speed when changes are made.
- DNS resolution involves multiple steps: browser cache, OS cache, router cache, ISP resolver, root servers, TLD servers, and authoritative nameservers.
- Resolvers (like Google's 8.8.8.8) fetch DNS records, while nameservers store them (e.g., Cloudflare, AWS Route 53).
- DNS can be used for load balancing, failover, and geographic routing by returning different IPs based on conditions.
- Debugging DNS issues involves checking and clearing caches (browser, OS) and using tools like `nslookup` and `dig`.
GitHub - ZeroTworu/anet: Simple Rust VPN Client / Server
3 months ago
- ANet is a tool for creating private, secure information spaces between trusted individuals.
- It is a technology, not a service, designed to connect people who trust each other.
- Built on the ASTP (ANet Secure Transport Protocol) focusing on privacy, resilience, mimicry, and cross-platform compatibility.
- Features include end-to-end encryption (ChaCha20Poly1305 / X25519), stable operation in lossy networks, and high-entropy UDP streams.
- Cross-platform clients available for Linux, Windows, and Android.
- Project is written in Rust and divided into modules: anet-server, anet-client-cli, anet-client-gui, anet-mobile, anet-common, anet-keygen.
- Requires Rust (cargo) for building components.
- Development is humorously described as happening under high radiation with alternative energy sources (C2H5OH).
- Support options include donations for the developer, buns for 'Nyusha', and J7 for recovery.
What's at the Other End of 8.8.8.8?
3 months ago
- 8.8.8.8 is Google’s free, global DNS resolution service.
- Queries from 8.8.8.8 originate from various Google-owned IP addresses, not 8.8.8.8 itself.
- The author tested 8.8.8.8 using a wildcard DNS service (nip.io & sslip.io).
- DNS queries were logged, showing random capitalization and varied source IPs (IPv4 and IPv6).
- Only 3% of 256 test queries were forwarded to the author’s Warsaw server.
- Google uses random capitalization to mitigate DNS cache poisoning.
- Most queries use UDP; TCP is rarely used (0.0002% of queries).
- Source IPs confirmed to belong to Google via ARIN lookups.
Using Microvm.nix to Sandbox OpenClaw
3 months ago
- The author participated in a 'setup Openclaw' hangout despite not being enthusiastic about Clawdbot, Moltbot, or Openclaw, aligning with their 2026 theme of community.
- The goal was to explore lightweight virtualisation and sandboxing in 2026, using Openclaw as a test subject despite its numerous CVEs.
- Objectives included constraining the executable's access and modifications, controlling its network traffic, and doing so declaratively.
- Microvm.nix was introduced as a solution, offering lightweight virtualisation with minimal overhead, shared Nix store via virtiofs, and quick boot times.
- A shared microvm-base.nix configuration standardizes VM settings across the author's clan, including network setup and virtiofs shares.
- The host configuration includes a bridge for microVM TAP interfaces and NAT masquerading for public interface traffic.
- Openclaw's required secrets (Telegram bot token, OpenRouter API key, gateway auth token) are mounted into the VM via virtiofs.
- The OpenClaw VM runs via Home Manager, with configurations for gateway mode, Telegram channel settings, and model preferences.
- Initial network monitoring plans evolved from a near-airgap approach to allowing full internet access with logging for DNS queries and new connections.
- Unbound and nftables are used for DNS query logging and connection logging, respectively, to monitor VM activity.
- Challenges included Node.js requiring AF_NETLINK for network interface queries and adjusting ProtectHome settings for Openclaw's state writing needs.
- The author concluded the activity as a valuable learning experience in virtualisation and networking, though they remain unlikely to use Openclaw.
Faster Than Dijkstra?
3 months ago
- A new algorithm claims to improve on Dijkstra's method for finding shortest paths in networks by avoiding sorting operations.
- The new approach has been peer-reviewed and published, but its practical impact on real routing systems is questioned.
- Scaling limits in routing systems may not benefit from theoretical improvements if the network size (n) isn't large enough.
- Historical examples show that scalability isn't always the primary factor in successful commercial products.
- Routing performance depends on multiple factors beyond SPF calculation, such as failure detection and convergence times.
- Dijkstra's algorithm remains popular due to its simplicity and understandability, making it preferable for implementation.
- The article also touches on unrelated topics like datacenters in space and AI-generated content on Wikipedia.

first prev8next

About|Login

#networking

DENT: A network operating system (NOS) for everyone else

FreeBSD Home NAS, part 3: WireGuard VPN, routing, and Linux peers

Nineteen Septillion Addresses – Setting Up an ASN and Getting an IPv6 Allocation

Show HN: BGP Scout – BGP Network Browser

pf: Make af-to less magical

Show HN: Pipenet – A Modern Alternative to Localtunnel

Targeted Bets: An alternative approach to the job hunt

10GbE in 2026 Is Finally Hitting the Tipping Point

When Every Network is 192.168.1.x

Reliable 25 Gigabit Ethernet via Thunderbolt

Pangolin (YC S25) is hiring software engineers (open-source, Go, networking)

We have ipinfo at home or how to geolocate IPs in your CLI using latency

Why aren't we using SSH for everything? (2015)

GitHub - netbirdio/netbird: Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.

Reimplementing Tor from Scratch for a Single-Hop Proxy

DNS Explained – How Domain Names Get Resolved

GitHub - ZeroTworu/anet: Simple Rust VPN Client / Server

What's at the Other End of 8.8.8.8?

Using Microvm.nix to Sandbox OpenClaw

Faster Than Dijkstra?