Tailscale Exit Node Logic: Why Auto-Select Fails for Security and How to Fix It
Tailscale's auto exit node optimizes for latency, not trust. Here's how auto-select compares to a pinned, dispatcher-enforced exit node on laptops.
#networking
11 posts
Firewall Zone Persistence: Why firewalld Runtime Changes Vanish and How to Pin Them
firewalld runtime changes disappear on reload or reconnect, and NetworkManager can override zone bindings. Here's how to make firewall zones persist.
Trust the Tailnet, Not the Network: Automating Wi-Fi Hardening with NetworkManager Dispatchers
Treat every Wi-Fi network as hostile: a NetworkManager dispatcher that pins a locked-down firewalld zone and forces a Tailscale exit node on connect.
Tailscale Kernel TUN in Unprivileged LXC: Direct SSH Without Userspace Networking
Two lines in a Proxmox LXC config give Tailscale a real kernel TUN device: direct peer-to-peer SSH, working UDP, and the container stays unprivileged.
Traefik Host Collision: Why Duplicate Host Rules Break IngressRoutes
In Traefik v3, a wildcard router can outrank an exact Host match, because default priority is rule string length. Here's how it fails and how to fix it.
MetalLB on Bare Metal: LoadBalancer Without a Cloud Provider
Your bare-metal LoadBalancer Service is stuck Pending. Here's how MetalLB hands out real LAN IPs, why L2 mode works, and the traps that cost me hours.
Network Policies with Calico: Default Deny and Namespace Isolation
Rolling out default-deny NetworkPolicies and namespace isolation with Calico without breaking DNS, ingress, or admission webhooks.
Tailscale Subnet Routers: Accessing Your LAN Without the VPN Headache
Stop installing Tailscale on every single device. Use a subnet router to expose your home network and IoT gear without traditional VPN complexity.
PCIe Passthrough: NIC Name Instability and MAC Pinning
Stop your network configs from breaking after a reboot. How to fix unpredictable NIC naming in Proxmox PCIe passthrough.
AdGuard Home: Network-Wide DNS Filtering with Failover
Setting up AdGuard Home for network-wide DNS filtering with a robust failover strategy to prevent total internet outages.
Wildcard DNS + ndots:5: The TLS Nightmare and How to Fix It
Kubernetes default DNS settings can cause TLS certificate mismatches when using wildcard DNS. Here is how to debug and fix it.