Tailscale Kernel TUN in Unprivileged LXC: Direct SSH Without Userspace Networking
Two lines in a Proxmox LXC config give Tailscale a real kernel TUN device: direct peer-to-peer SSH, working UDP, and the container stays unprivileged.
#networking
8 posts
Traefik Host Collision: Why Duplicate Host Rules Break IngressRoutes
In Traefik v3, a wildcard router can outrank an exact Host match, because default priority is rule string length. Here's how it fails and how to fix it.
MetalLB on Bare Metal: LoadBalancer Without a Cloud Provider
Your bare-metal LoadBalancer Service is stuck Pending. Here's how MetalLB hands out real LAN IPs, why L2 mode works, and the traps that cost me hours.
Network Policies with Calico: Default Deny and Namespace Isolation
Rolling out default-deny NetworkPolicies and namespace isolation with Calico without breaking DNS, ingress, or admission webhooks.
Tailscale Subnet Routers: Accessing Your LAN Without the VPN Headache
Stop installing Tailscale on every single device. Use a subnet router to expose your home network and IoT gear without traditional VPN complexity.
PCIe Passthrough: NIC Name Instability and MAC Pinning
Stop your network configs from breaking after a reboot. How to fix unpredictable NIC naming in Proxmox PCIe passthrough.
AdGuard Home: Network-Wide DNS Filtering with Failover
Setting up AdGuard Home for network-wide DNS filtering with a robust failover strategy to prevent total internet outages.
Wildcard DNS + ndots:5: The TLS Nightmare and How to Fix It
Kubernetes default DNS settings can cause TLS certificate mismatches when using wildcard DNS. Here is how to debug and fix it.