Tag: networking

DDoS mitigation for self-hosters: Nginx rate limiting, Fail2ban, Cloudflare free tier, CrowdSec, and iptables tricks that actually work.

Squeeze every MB/s from WireGuard: MTU sizing, GSO/GRO CPU offloading, AllowedIPs routing, PersistentKeepalive tradeoffs, and iperf3 benchmarks included.

Traefik vs Nginx Proxy Manager compared for self-hosters. Docker auto-discovery, SSL certs, GUI vs labels, performance, and when to pick each reverse proxy.

Proxychains-ng, Tor, and VPN+Tor combos tested honestly: which setups actually anonymize traffic and which are security theater you should stop trusting.

Incomplete chains, bundles in the wrong order, and self-signed certs all read as untrusted. Diagnose with openssl s_client, then rebuild the chain properly.

Firewall rules are evaluated top-down, first match wins. One misplaced ALLOW rule above your denials silently defeats all your security. Here's the fix.

Verify fail2ban is protecting you: check jails, test bans, monitor logs, common misconfiguration, and unban IPs when needed.

SSHFS mounts remote filesystems over SSH so you can browse and edit files locally, faster than scp for interactive work.

Fix SSH timeouts: ServerAliveInterval, ServerAliveCountMax, ClientAliveInterval. Understand NAT, firewalls, and TCP keepalive.

ss replaces netstat on modern Linux: faster, shows more socket detail, and reads from the kernel. Every netstat command you rely on, rewritten for ss.

Network aliases give a container more than one DNS name on a Docker network. Blue-green and canary deploy patterns, a Compose example, and the limits.

lsof shows every open file, socket, and port on the box. Find what holds a port, trace deleted files still eating disk, and see what a service owns.