Then I really recommend you not to play with vlan and use different eth ports as different segments.

The performance will be significant better this way

Just for me to fully understand your setup.

How many eth ports do you have in your opnsense box?

Try to find a rev3, the cpu upgrade really is really worthy

Which hw revision?

If it is a ver3 it is the same I have, good for FW and red services, you can make complex setups.

It is a bit short on cpu for ips systems(suricata and zenarmor) , but it is able to do dns filtering via adguard or unbound.

100€ sounds good to me if it comes with AP, people here are happy with that brand

Good luck

Take a sophos second hand FW.

Intel nic, low power consumption processors and full opnsense support.

Go at least for 4gb ram and the most powerful processor you can safely get. It will come with a lot of eth ports too on top.

And it will cost close to 100€, probably less if you struck a good deal

Dawkins solved it time ago.

Mutations are passed into the next generation and if we assume that only chickens can laid chicken eggs then the paradox solution is as follows :

A proto chicken (soemthing extremely similar to a chicken but not yet one) laid a proto egg of which a chicken hatched and then it could laid a chicken egg.

Here there is a reduced scope version saying that proto chicken can lay eggs, which depends on the eggs definition may not be 100% acceptable

https://youtu.be/h0CbqV8pPTU

Total misleading post, to the point is incorrect. Pretty sure it is us source info

From EU Parlament directly https://www.consilium.europa.eu/en/policies/military-support-ukraine/

My setup is “simple” and all these monitoring functions are performed in my opnsense box with the telegram plugin.

Most of the alerts are pretty basic and are done into the FW level or the outbound basic logging. So opnsense with the basic tooling is just enough.

I have in my todo to connect the logging system from opnsense to a proper Prometheus/grafana system to really have proper log of several days without having an impact on the FW but I never find the time to do it (lazyness problem)

Segment the network as much as feasible, forbid the communication between the segments via FW rules, and set an alert when those rules are triggered.

For example: your dmz should never initiate any type of communication with your lan segment, your lan segment should not try to access services outside ports 80/443, your dns should log all resolutions performed and it would be nice to have at least a black list.

None of them should have dns over tls, and for specific hosts and networks segments, new domains with very looong active but idle connections should trigger an alert.

My personal opinion is that for a homelab is not realistic to perform a dpi to check that there is not an active attack ongoing, neither from the raw processing power, either from the human effort side, your best chance is to alert when something unusual is happening and then adjust your rules of the are false positives

You have edited it!!

:)

I guess they are referring to pc gaming handheld, and this segment is totally dominated by amd and their special cores.

Good to see some competition but unless they fully open everything to steam os I would not have many hopes

Then nothing to say, good luck with your setup :)

Certainly it is a good way to go, but in my experience try the usual work flow, it is way more stable and the cpu burden is share between both nodes -> faster backups

Borgbackup is all you need, you even don’t need to allocate the space in your A machine…

Here trivial means that it shouldn’t appear in a dictionary so it will reddit the first million most probably password attack, the crypto techniques will take care of the rest to make them un feasible

The point is… It does not really matter, as long as your password is not trivial the security relies more in the algorithm than in the chosen password.

With bcrypt + round parameters, password stretching or any other key derivation technique, even weak passwords cant be cracked in a realistic time frame

The outbound connections problems as stated here? https://tailscale.com/docs/integrations/synology

The only thing I can tell is that it is totally worthless.

Because you can not have an uga ipv6, then obviously you will have an ula served via dhcpv6 with ipv4 local address (double stack).

And in this point you will realize that most computers implementation select which ip address to use following prio: ipv6 uga -> ipv4 -> ipv6 ula

So even if you do all the things right, your clients will not use it because ipv4 is there and you cannot deselect it because I assume you still want connectivity

Funny, right? :)

Here you have: https://ntfy.sh/

And because it is you you launch the connection is pretty secure… Assuming telegram servers are not compromised…

Yep, I checked that possibility too but it is like putting barriers into the see because :

• DoH can also share the IP-PORT with some legits websites
• there is not a proper way to scan the web to see if there is a proper service
• the effort to setup one is orders of magnitude lower tan to track then and then to filter it properly

Honestly is just the prey-predator competition. It won’t stop ever