networking

My Netgear Nighthawk wifi router just crapped out last weekend and I’m gimping along on the rental wifi router from my ISP, so I’m looking to buy a replacement and am torn: should I go with a single WiFi Router or a wired router plus a wireless access point?

I don’t need crazy throughput, just enough to handle some lite home automation, streaming, and a future NAS. My house isn’t large, so wifi coverage with a single device hasn’t been a problem so far. I’m also interested in flashing OpenWRT or DD-WRT to the router, so compatibility is a consideration. Hardware recommendations would be great!

I've been a proud owner of a Ubiquiti Dream Router for a good while now - live in a rural area so the Dream Machine would've been overkill for my needs.

Currently getting 300/300 from the ISP. Not bad.

Couple months ago, noticed I was getting some pretty awful speeds to my end devices, around 30/30 across the board. Wired/wireless made no difference.

Checked the periodic speed tests the UDR does, nothing; no change in bandwidth.

I hadn't changed a setting in my router in quite a while as I've been happy with my setup, so I was convinced it was a fluke. Rebooted, back to semi-normal speeds (though still short).

After dealing with this for a while, tonight I finally decided to bite the bullet and factory reset the UDR. Throughput right back to normal immediately. Restored backup - throughput still where it should be.

Am I missing something obvious??

Edit - to clarify, when I checked the speeds from router to isp, I'd been getting expected bandwidth the whole time; it was only the end devices suffering.

Anyone that's thinking of implementing LibreNMS for more than a trivial setup - look elsewhere.

Unfortunately I'm married to it at $dayjob, and seldom a day goes by where it doesn't frustrate me (we monitor about 5k devices and about 40 distributed pollers).

I mentioned one day I'd write a nasty song about it, and an apt coworker quickly piped something into Copilot and this was the result (pretty good for AI-generated):

"Libre Mess (The Monitoring Blues)" 🎤

(Rock parody song)

[Verse 1]

Woke up at 3 AM, alerts screaming in my ear,

"Disk space low!" "Ping timeout!"—I live in constant fear.

Tried to check the dashboard, but it crashed again,

LibreNMS, you're my foe, not my friend.

[Chorus]

Oh Libre Mess, you're a beautiful disaster,

Your graphs load slow, but your bugs come faster.

I just want uptime, not a nervous breakdown,

But you keep dragging my whole network down!

[Verse 2]

Docs say “just run this script,” but it breaks my soul,

Dependencies from 2012? That’s your goal?

SNMP walks like it’s stuck in glue,

And your alert rules? I think they hate me too.

[Bridge]

I tried to love you, I gave you a chance,

But now I’m screaming at logs like it’s performance dance.

You gaslight me with false positives all day,

Libre, Libre, why you treat me this way?

[Chorus]

Oh Libre Mess, you chaotic beast,

You feast on my sanity, at the very least.

I’d switch to Zabbix, or maybe just cry,

But I’m too deep in configs to say goodbye.

[Outro]

So here’s my song, my monitoring lament,

For every hour LibreNMS made me vent.

You’re open-source, but my heart’s closed tight,

‘Cause Libre, you gave me one hell of a fight

Has anybody heard if the upcoming 47-day maximum on TLS cert lifetime will apply to Enterprise wifi auth using private PKI (especally on IOS and Android)?

We have a campus CA that signs the TLS cert used by RADIUS when students connect to wifi using personal devices. Freshman need to accept the cert once (hopefully after checking the fingerprint), then usually one more time before graduation. Every 47 days would be difficult.

cross-posted from: https://infosec.pub/post/28196930

Another post in the records for the tech blog, this time all about opensource network monitoring with LibreNMS!

Background: I have a cellular ISP and therefore cannot configure the CGNAT. After burning through some dumb ideas (free reverse proxy, docker) I realized I could just use my paid VPN.

My setup is as follows: on the VPN server create a tunnel to AirVPN and start the openvpn daemon. This creates tun0 and tun1 with their own 10.x.x.x/24 subnets. The home network has 192.168.12.0/24.

It's possible to troubleshoot the MTU with ping -M do -s xxxx y.y.y.y to the VPN public address and test TCP/UDP sockets with nc -l -u -p 1194 .

I'm not sure if the MTU is variable across servers, but for the server I am on now ping -M do -s 1432 x.x.x.x is the biggest I can get a response from. 1432+20+8=1460 bytes.

Regardless, connecting to the home VPN through the AirVPN link still causes breakage. Discord seems to be what isn't working, mostly. Everything else has 200 ms latency as expected and not everything pings correctly. Rarely it will tell me the MTU has to be adjusted, sometimes tells me "message too long" and mostly just ignores my ping.

Can someone give me a recommendation for what MTU to be setting in my local OpenVPN server? Should I use mssfix or tun-mtu? Should I lower the MTU of the AirVPN connection? What else can I do?

Diagram:

Home -> AirVPN <- (1460 MTU) -> OpenVPN Client & server -> (1300 MTU) -> Home -> Outside World

dev tun
proto udp
remote A.B.C.D 34183
tun-mtu 1300
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
mute-replay-warnings
remote-cert-tls server
key-direction 1
cipher AES-256-CBC
data-ciphers AES-256-CBC
verb 3

proto udp
dev tun
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key /etc/openvpn/easy-rsa/pki/private/server.key
dh /etc/openvpn/easy-rsa/pki/dh.pem
topology subnet
tun-mtu 1300
server 10.9.8.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.12.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
keepalive 10 120
tls-server
tls-auth /etc/openvpn/server/ta.key 0
auth-nocache
user nobody
group nogroup
cipher AES-256-CBC
data-ciphers AES-256-CBC
status /var/log/openvpn/openvpn-status.log
persist-tun
persist-key
verb 3
client-to-client
explicit-exit-notify 1

dev tun
remote [spoiler].vpn.airdns.org 443
resolv-retry infinite
nobind
tun-mtu 1460
persist-key
persist-tun
auth-nocache
verb 3
explicit-exit-notify 5
push-peer-info
setenv UV_IPV6 yes
remote-cert-tls server
comp-lzo no
data-ciphers AES-256-GCM:AES-256-CBC:AES-192-GCM:AES-192-CBC:AES-128-GCM:AES-128-CBC
data-ciphers-fallback AES-256-CBC
proto udp
auth SHA512

In the process of doing this I somehow shut my house's WiFi down...

Hi all

For the past couple of years I have been running a Raspberry Pi4 with PiHole and PiVPN. Both of which I'm very satisfied with. My ISP recently changed the IP address assigned to me, this doesn't happen often but did cause my VPN profiles to no longer work. Simply changing the end IP address in the VPN config does not work so the configs had to be remade entirely. If this happens again and I am not near home, what would be a way to regain access? Can that be done remotely?

I am concerned with the possibility that my IP changes while I'm on a vacation and then lose access to my NAS and other home systems with no way to get it back until after.

I am considering a script that generates a new config file and sends it over email when I send a specific text to a phone, that could work. Is this over engineered? Something like a deadman switch could work too.

Thanks!

I will be moving into a new house in a few weeks. It's an older house (built in the 60s) and hasn't had much updates in terms of wiring. I want to be able to run a hardwire cable to each bedroom to maximize my Internet performance. My wife works from home and I'm hybrid, so I want to ensure we're not just flying on WiFi.

Are there any resources or how tos that can give me some information on where to start? What to look for? What to do first?

I'm struggling with figuring out what I should try to tackle. Should I just run an Ethernet line to the room that's an office and start there? Or is there some well thought out approach I can make?

I know this is probably vague, but any assistance would be appreciated.

A weird and disturbing thing is happening on my home network. I'd like some advice on how to diagnose it. My mastodon host (chaos.social) keeps blocking my IP address. I reached out to the admins and they told me it's because they are getting HTTP requests with user agent string claiming it's a Google bot. They shared a following log line with me.

[12/Mar/2025:08:55:14 +0100] my.ipv4.add.ress "GET /@lazurski HTTP/2.0" 403 Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)

It is my IP address indeed, and the path is pointing to my profile, so it's not random. It also happened while I was browsing Mastodon using Firefox on my laptop. The 403 response is strange, as I was logged in and also my profile is public and viewing it doesn't require authentication. Maybe they blocked it because of the bot signature?

I have no idea what can be making these requests. Certainly not anything I run on purpose. My Firefox uses it's standard user agent header. At home I have a few devices. At the time of this request I believe only the following were on:

• my laptop running NixOS and Firefox (I was actively using it when I got blocked)
• a RaspberryPi home server running NixOS
• my Android phone running Tusky (a 3rd party Mastodon client)
• a broadband router with stock software

I think I can exclude the phone from the suspects, because while the home IP is blocked I use my mobile network connection to access chaos.social and this IP is never blocked. I don't think it's the home server or the router. My suspicion is on Firefox extensions. I only use a few of them:

• Firefox DevTools ADB Extension
• Firefox Multi-Account Containers
• GNOME Shell integration
• Privacy Badger
• uBlock Origin
• Vimium

How can I troubleshoot it? I tried about:logging with networking preset, collected a ton of logs, but couldn't figure out what to do with it. Or maybe it's something completely different? 🤔

I have an off-grid setup with a few devices on a local network that is not connected to the internet. I can tell my iPhone to use the non-internet wireless LAN to talk to those devices, OR I can tell it to use cellular data to talk to the Internet, but there’s no config on the iPhone side to let them be both live at the same time.

Is there any magic config on a wireless router e.g. certain DHCP settings or just disable DHCP, that will let the iPhone route to static 10.x IPs on the WLAN while the cellular internet is still active?

Any “advanced network settings” on the iPhone to manage multiple NICs?

Would it be unwise to make my file server (SSH only) machine (also runs a Minecraft server, And From time to time runs RSTS/E under simh) a tailscale router node to allow my traveling notebood access to the network when I am away?

Hi! I'm new here and hope to get some help.

For at least 5 hours today I can't connect to https://chaos.social/ (the Mastodon server I'm on). Firefox gives me:

Unable to connect

Firefox can’t establish a connection to the server at chaos.social.

    The site could be temporarily unavailable or too busy. Try again in a few moments.
    If you are unable to load any pages, check your computer’s network connection.
    If your computer or network is protected by a firewall or proxy, make sure that Firefox is permitted to access the web.

From curl I'm getting:

$ curl --ipv4 --verbose https://chaos.social/
* Host chaos.social:443 was resolved.
* IPv6: (none)
* IPv4: 5.9.119.202
*   Trying 5.9.119.202:443...
* connect to 5.9.119.202 port 443 from 192.168.1.45 port 40188 failed: Connection refused
* Failed to connect to chaos.social port 443 after 21 ms: Could not connect to server
* closing connection #0
curl: (7) Failed to connect to chaos.social port 443 after 21 ms: Could not connect to server

It's the same for http, so not related to TLS.

All other websites work normally, but to this particular one I can't connect from any device on my home network (I tired a few laptops, phones and our Raspberry PI home server). I tried to restart the router (Zyxel T-56). No change.

I can connect via mobile network or from a VPS in "the cloud". Also https://www.isitdownrightnow.com/chaos.social.html shows that it's on-line.

I can think of three reasons, but I'm not a networking guru, so maybe it's something else:

1. My router blocks it

   That would be surprising, because it has the stock configuration from my ISP and I definitely didn't tweak anything in last days.

2. My ISP blocks it

   But then it's the same ISP for wired and mobile connection. The latter works.

3. The server is blocking me for some reason

I'd appreciate help in digging deeper, if only to learn.

some Debian flavors have this built into the WiFi GUI, but I'd like to learn a more generic option in the CLI or config files

sorry for the noob question, thanks for reading

I'm self studying for a server+ cert and ran into this paragraph. Am I right that CPU time is a set of ticks utilized, the CPU Capacity is the total capacity, and the CPU usage is the percentage of ticks:capacity?

I have been making notes from this chapter, and the more I get into it the more I seem to find things like this that seem slightly off.

Does anyone have a physical copy of the 2ed McMillan CompTia Server+ study guide I can compare against? I feel like someone is messing with me.

In theory it is a open standard...

Hi all, looking for some guidance on getting wired networking upstairs to my pcs.

Currently I have my internet connection coming in downstairs. Without running cables upstairs is it possible to connect something to my existing wifi network and then break it out to to ethernet?

Any help much appreciated.

cross-posted from: https://programming.dev/post/24356655

Hi,

I would like to forward packets that come from a wireguard connection to a local subnet

environment

• Client: connected to server trough wireguard IP 192.168.X.2
• server: connected to Client trough wireguard IP 192.168.X.1 and 192.168.Y.1 ( it's not systemd free ¯\(ツ)/¯  )
• aMachine: on the same subnet as server IP 192.168.Y.2

   

on the server I've done

#I don't know if this is necessary ?
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl --system

I've added the following rule to my nftables config but it seem the packet get lost ?

#added inside existing table `table ip Tip {}`
chain chPreRoute {
type nat hook prerouting priority 0; policy accept;
iif wg0 icmp type echo-request dnat to 192.168.Y.2
}

I needed to connect two buildings and was having machines in to dig a 4' (1.2m) deep trench between them for a water line so I went to Amazon and bought a 250' (76m) pre-terminated copper Cat6 cable. As I was going to be burying it I wanted to be sure it worked, so I used it as a "fly lead" for my laptop for a week or two first and it worked fine. I know it initially connected at 1Gbps, but (stupidly) I can't be 100% certain it stayed at full speed the whole time.

Now that it's buried I'm only getting 100Mbit/s. It does sometimes connect at 1Gbit/s, but it later falls back to 100Mbit/s. I have an old Cisco SG300-10P on one end and a Ubiquiti Edge Router X on the other. I disabled 802.3 Energy Efficient Ethernet (EEE) on the Cisco and, as expected, it made no difference. The Cisco has built in cable test capability and it says I have an 84m open cable on all pairs - even when connected to the ER/X and working. Is there some sort of loopback/test termination I can make for the other end to get a better (more meaningful) result? I've tried searching, but failed.

The plug at one end did get pushed through some silicone caulk as it was being shoved through a hole in a wall. I cleaned it off with alcohol and it looks clean, but I'm considering cutting the plug off and replacing it with a socket as my next debugging step as it would be more convenient anyway.

I live about an hour from the nearest large town so there's no way I'm getting someone here with a proper tester at a reasonable price. If I can't figure it out myself I'll revert to the pair of airMax GigaBeam radios that have given me a solid 800Mbit/s for the last 3 years with only visual alignment!

Edit: this is the cable https://a.co/d/i6mYLy1

I've been able to set up sending and listening to http requests locally using 127.0.0.1:8000. I want to try doing it using the internet now.

I have a VPN with port forwarding enabled, but sending requests to that IP address and port does not yield a response like it did when doing it locally.

Can anyone clarify which address I should be listening on in order to receive http requests from the internet? I tried 0.0.0.0 and a few inet addresses from ip add, but none of them work.

I've been using my carrier's router for a while now but I've been having some issues. Though speed tests show nice speed, the consistency of the signal is very bad. I work from home in an office with my SO and when we're both using the internet the signal can become really bad. Currently getting 20% signal strength and having a hard time keeping my teams call up.

The router is not that far, like 10-15m away but does go through a wall. Ethernet cables are unfortunately not a possibility and since we both have desktop computers we'd rather not move.

Looking for a router around 100 euros, preferably available on Amazon Spain so I can return it if it doesn't solve my problem. The goal is to shut down the carrier router's wi-fi and just use the new router for all the networking.

I don't having any special requisites. Wi-fi 6E would be a nice to have but honestly wi-fi 6 is good enough. Solid connection is the most important thing for me.

Thanks!

cross-posted from: https://lemmy.world/post/21641378

So I just added a TP-Link switch (TL-SG3428X) and access point (EAP670) to my network, using OPNSense for routing, and was previously using a TP-Link SX-3008F switch as an aggregate (which I no longer need). I’m still within the return window for the new switch and access point, and have to admit the sale prices were my main reason with going for these items. I understand there have been recent articles mentioning TP-Link and security risks, so I’m thinking if I should consider returning these, and upping my budget to go for ubiquity? The AP would only be like $30 more for an equivalent, so that’s negligible, but a switch that meets my needs is about 1.6x more, however still only has 2 SFP+ ports, while I need 3 at absolute minimum.

I’m generally happy with the performance, however there is a really annoying bug where if I reboot a device, the switch drops down to 1G speed instead of 10G, and I have to tinker with the settings or reboot the switch to get 10G working again. This is true for the OPNSense uplink, my NAS and workstation. Same thing happened with the 3008F, and support threads on the forums have not been helpful.

In any case, any opinions of switching to ubiquity would be worth it?

I have a server with wireguard in a container with host networking. I want to assign an ipv6 subnet for each peer (eg: fd42:413d:a91f:dd37::/64) that the client (my laptop) can freely use all the addresses in that subnet and corresponding port ranges as a separate network interface. Meanwhile on the server, that exact same ip and port is routed to that specific client but through the tunnel.

Here's an example:

1. Server config

   [Interface]
   Address = fd42::1/128
   ListenPort = 51820
   PrivateKey = <key>
   
   [Peer]
   PublicKey = <key>
   AllowedIPs = fd42:413d:a91f:dd37::/64
   

2. Client config

   [Interface]
   PrivateKey = <key>
   Address = fd42:413d:a91f:dd37::1/64
   
   [Peer]
   PublicKey = <key>
   Endpoint = server.local:51820
   AllowedIPs = fd42:413d::/32, fd42:413d:a91f:dd37::/64
   

3. Run a server on the client

   python -m http.server 8080 --bind fd42:413d:a91f:dd37::1 -d dist
   

4. Access on the server

   curl -svL http://[fd42:413d:a91f:dd37::1]:8080/
   

I can't get step 4 to work. It's also entirely possible that my lack of knowledge in networking is making me think this is even possible in the first place. Any help is appreciated!

It also connects to discord, supposed to be blocked since more than a week. No other device or browser I have connects to YouTube, they all get ERR_SOCKET_NOT_CONNECTED, and only a fresh Vivaldi profile on the same pc also connects to Discord, everything else get ERR_CONNECTION_RESET.

I've tried disabling all extensions, it still connects. Checked its IP address and DNS server and they're the same as other devices/browsers. Any idea what could be going on?

24m edit: Discord just started working on some other chromium browsers including on another device.

80m edit: Another chromium browser just also connected. After deleting browser data it stopped

edit 3: found that if I add this to the servers section of a Network Persistent State file associated with a chromium browser profile (while the browser is closed), it can connect to youtube. Can't explain why. (anonymization says https://www.youtube.com/ + some number that doesn't matter in the beginning in base64):
{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376788973168704","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABMAAABodHRwczovL3lvdXR1YmUuY29tAA==",false],"server":"https://www.youtube.com/","supports_spdy":true}

Edit 4: The block is gone

I have an ASUS N66U

I have configured the WAN interface to use a VPN Client to connect to a 3rd party VPN Server, so that all NAT LAN connected device traffic is routed through the 3rd party VPN server.

But if the 3rd party VPN server goes down, or the connection is otherwise lost or broken, the Asus N66U will route directly from the WAN connection using e.g. my ISP.

How can I stop my Asus N66U from routing any traffic on the WAN port if the VPN connection is down?

Hi,

I would like to create a LAN where each node need to authenticate before gaining access to the LAN.

and secondly be able to monitor the data consumption of each node and even limit the speed for a node when exceeded.

I'm looking for something FLOSS. For example a single-board computer with a gnu/Linux etc...

Maybe some distribution or solution already exist for this ?

Thanks.