Because this repo is going viral from time to time to developers, I’m open for discussion if you want to promote a product/service in this README file. Just mail me at XXXX

Ew.

I’ve been tempted by Tailscale a few times before, but I don’t want to depend on their proprietary clients and control server. The latter could be solved by selfhosting Headscale, but at this point I figure that going for a basic Wireguard setup is probably easier to maintain.

I’d like to have a look at your rules setup, I’m especially curious if/how you approached the event of the commercial VPN Wireguard tunnel(s) on your exit node(s) going down, which depending on the setup may send requests meant to go through the commercial VPN through your VPS exit node.

Personally, I ended up with two Wireguard containers in the target LAN, a wireguard-server and a **wireguard-client **container.

They both share a docker network with a specific subnet {DOCKER_SUBNET} and wireguard-client has a static IP {WG_CLIENT_IP} in that subnet.

The wireguard-client has a slightly altered standard config to establish a tunnel to an external endpoint, a commercial VPN in this case:

[Interface]
PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Address = XXXXXXXXXXXXXXXXXXX

PostUp = iptables -t nat -A POSTROUTING -o wg+ -j MASQUERADE
PreDown = iptables -t nat -D POSTROUTING -o wg+ -j MASQUERADE

PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT

PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT

[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
AllowedIPs = 0.0.0.0/0,::0/0
Endpoint = XXXXXXXXXXXXXXXXXXXX

where

PostUp = iptables -t nat -A POSTROUTING -o wg+ -j MASQUERADE
PreDown = iptables -t nat -D POSTROUTING -o wg+ -j MASQUERADE

are responsible for properly routing traffic coming in from outside the container and

PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT

PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT

is your standard kill-switch meant to block traffic going out of any network interface except the tunnel interface in the event of the tunnel going down.

The wireguard-server container has these PostUPs and -Downs:

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

default rules that come with the template and allow for routing packets through the server tunnel

PostUp = wg set wg0 fwmark 51820

the traffic out of the tunnel interface get marked

PostUp = ip -4 route add 0.0.0.0/0 via {WG_CLIENT_IP} table 51820

add a rule to routing table 51820 for routing all packets through the wireguard-client container

PostUp = ip -4 rule add not fwmark 51820 table 51820

packets not marked should use routing table 51820

PostUp = ip -4 rule add table main suppress_prefixlength 0

respect manual rules added to main routing table

PostUp = ip route add {LAN_SUBNET} via {DOCKER_SUBNET_GATEWAY_IP} dev eth0

route packages with a destination in {LAN_SUBNET} to the actual {LAN_SUBNET} of the host

PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip route del {LAN_SUBNET} via {DOCKER_SUBNET_GATEWAY_IP} dev eth0

delete those rules after the tunnel goes down

PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECT
PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark 0xca6c -m addrtype ! --dst-type LOCAL -j REJECT

Basically the same kill-switch as in wireguard-client, but with the mark manually substituted since the command it relied on didn’t work in my server container for some reason and AFAIK the mark actually doesn’t change.

Now do I actually need the kill-switch in wireguard-server? Is the kill-switch in wireguard-client sufficient? I’m not even sure anymore.

Oh I’m fully aware. I personally don’t care, but one could add a capable VPS and deploy the Wireguard Host Container + two Client Containers, one for the LAN and one for the commercial VPN (like so), if the internet connection of the LAN in question isn’t sufficient.

Oh, neat! Never noticed that option in the Wireguard app before. That’s very helpful already. Regarding your opnsense setup:

I’ve dabbled in some (simple) routing before, but I’m far from anything one could call competent in that regard and even if I’d read up properly before writing my own routes/rules, I’d probably still wouldn’t trust that I hadn’t forgotten something to e.g. prevent IP/DNS leaks.

I’m mainly relying on a Docker and was hoping for pointers on how to configure a Wireguard host container to route only internet traffic through another Wireguard Client container.

I found this example, which is pretty close to my ideal setup. I’ll read up on that.

Ball-Gags mit O-Ringen, wann?

Weil ich keine Lust habe das Profitape in H-Form zu kaufen (ein Monat Mund zukleben für 19,99 Euro), schneide ich Pflastertape in zwei schmale Streifen und klebe sie als X über meine Lippen.

Schnell fühlt sich meine Zunge schwer an, als wäre sie zu groß für meinen Mund. Ich versuche es zu ignorieren, wie wenn es im Sommer zu heiß zum Einschlafen ist. Nicht bewegen und aushalten.

Im Schlaf muss ich mich von dem Klebeband befreit haben. Am Morgen klebt es über meinem Bett an der Wand. Auch die zweite Nacht halte ich nicht durch. Ich werde fast stündlich wach und gebe auf.

Zu den bei Dieben besonders beliebten Warengruppen in Supermärkten und Discountern zählen Spirituosen, Tabakwaren, Kosmetikprodukte, Rasierklingen, Energydrinks sowie Babynahrung und Kaffee. Fleisch, Wurst und Käse werden ebenfalls häufiger genannt.

Meist handelt es sich um Gelegenheitstäter, für mindestens ein Viertel der Diebstähle sind professionelle Täter verantwortlich, die bandenmäßig agieren.

Bei Lebensmitteln kann ich die Position zumindest so halbwegs nachvollziehen, aber bei Spirituosen, Tabakwaren, Kosmetikprodukte, Rasierklingen, Energydrinks und Kaffee? Warum steht das Menschen zu, wenn als Folge des Diebstahls lediglich die Preise für die ehrlichen Kunden angezogen werden?

Ladendiebstahl ist kein nobler Protest oder gar eine Art Freiheitskampf gegen das böse kapitalistische Problem. Wenn das überhandnimmt, schließt einfach die lokale Filiale. Die meisten Diebe finden es wohl einfach geil, sich auf Kosten anderer zu bereichern. Fuck all of you, I got mine. Höchst asozial.

“Wir brauchen eine Debattenkultur, in der Menschen ihre Meinung und ihre Sorgen sagen können, ohne in Schubladen gesteckt zu werden”

Menschen über ihr Tun, ihr Wirken und nicht über ihre Herkunft zu definieren, dafür stehe für sie das neue Grundsatzprogramm der CDU, so die Politikerin.

Ah, die werte Frau Sekmen will also eine Debattenkultur ohne Schubladendenken und wechselt deswegen zur Union. Die sind ja bekanntlich sehr aufgeschlossen, besonders was populistische Positionen, Korruption und Verquickung von Mandat und persönlichen Interessen angeht.

Das hat garantiert nichts damit zu tun, dass die Ampel, und damit auch die Grünen, bei der nächsten Wahl höchstwahrscheinlich nicht mehr die regierende Koalition sein wird und die werte Frau Sekmen sich bessere Chancen zum Ausbauen von politischer Macht und persönlicher Bereicherung bei der politisch quasi gegenläufigen Union erhofft.

Das Landeslistenmandat, welches durch grüne Stimmen errungen wurde und durch welches sie nicht direkt gewählt wurde, niederlegen? Ne, Anstand ist out, gerade als neuer Parteifreund von Scheuer lernt man ja recht schnell, dass das Fußvolk lediglich ein zu manipulierender Pöbel ist, auf dessen Rücken man so viel besser nach mehr Macht grabschen kann.

Absolute Randgruppe, aber als jemand, der mit GrapheneOS unterwegs ist:

Wäre toll, wenn Wero die Möglichkeit bietet, ohne Google Pay NFC Bezahlungen abzuwickeln.

To add to this:

We have to differentiate between physical and cybersecurity.

Are you more likely to physically lose your smartphone you carry around with you all day than your full ATX desktop standing in your office? Yeah.

But let’s consider the consequences for a moment.

If someone physically stole your desktop, chances are that at least a part of your data isn’t encrypted, the boot sequence probably isn’t (at least completely) verified, and your OS is wide open. There is little to no real isolation in most desktop setups. Once somebody managed to gain access to your system, it is outright trivial to steal your browser sessions, modify commands or run some code, at least in userland.

Physically stealing your smartphone is easy. But a modern smartphone is usually protected by verified boot and a password+fingerprint/Face ID combo. Unless you take active steps to compromise the security of the phone like rooting/jailbreaking it, disabling verified boot or disabling the passcode, it’s pretty hard if not near impossible to gain access to your data or modify it in a harmful way. If you visit an infected site or install an infected app, the damage is usually confined to that app’s data and the data accessible to it by permissions you probably had to allow to be set in the first place.

Now that’s speaking to your usual bad actors and usual setups. Exceptions, as always, make the rule. As soon as a sufficiently motivated and technically able actor with access to 0-day exploits, like a state actor, targets you for some reason, all bets are off. But even in this case, due to the advanced verified boot chain on most modern smartphones, those exploits rarely have the ability to survive beyond a reboot.

That’s the joke.

£2,000 ($2,500 at current exchange rates) for the Early Bird special. Once those are gone, prices are to be bumped up to £2,500 ($3,150).

weighs no more than 14 kg (32 lbs), battery included.

Together with the battery, the M2 can achieve a maximum range of up to 50 km

From their website:

We will keep the prices the same as the FLIT-16 accessories: Mudguards – £59.95 Kickstand – £14.95 Spare charger – £49.95 Spare battery – £249.95.

Battery type: FLIT proprietary, lithium-ion 230 Wh, 36 V, 6.4 Ah, LG cells (CE)

So a startup with yet another proprietary electrical system and battery design. That ain’t it.

Indeed it does, I was talking about adding a checkbox tagged “Only transfer blocked users” instead of having to click through some menus.

Police allege the man’s fake wifi networks took users to a dummy page that asked for their email or social media login details. Those details were then saved to the man’s devices and could be used to access other personal information, including the online communications, photos, videos or bank details.

I was going to make fun of people falling for that, but I can see how a fake portal probably masquerading as SSO verification in order to get free Wi-Fi can temporarily fool even some more experienced users.

We have to vote for the people who will admit to that and get rid of them. The U.S. is going to have to choose between a leader who tries to install good people to run the government and one who intends to install people bent on dismantling the government and giving loyalty to the leader alone.

I largely share your thoughts. I honestly expected Biden to at least be prepared enough to counter the usual Trump tactics of making things up and using strong words to impress his base while deflecting blame or critical questions.

Instead, we got Trump basically having free rein to appear strong with simple (and wrong) answers to complex questions, twisting the truth to support his positions and straight up lying and deflecting when finally confronted with something.

I’m not a big fan of Biden, but IMO he’s the obvious, rational choice out of two candidates way past their prime - if you’re into rationality over the antics of a con artist.

But this isn’t a fair fight, and Biden isn’t the showman Trump managed to be today. Biden was barely audible and mostly on the defensive while appearing weak, Trump was the opposite of that. I can’t imagine any Trump voter switching teams after the debate, but I can image more than a few more emotionally motivated democrats second guessing their choice.

Sure, the code is completely client-side, simply clone it. If you’re running into CORS problems due to the file:// scheme Origin of opening a local file, simply host it as a local temporary server with something like python -m http.server .

This is due to the two ways most instances validate Cross-Origin requests:

• Sending Access-Control-Allow-Origin: * (allow all hosts)
• Dynamically putting your Origin into the Origin header of the response to your requests by the backend

file:// URLs will result in a null or file:// Origin which can’t be authorized via the second option, therefore the need to sometimes host the application via (local) webserver.

gespeicherte Posts/Comments sollten eigentlich mit übertragen werden, sofern vorhanden. Kann allerdings sein, dass Lemmy da beim Import manchmal bisschen was versemmelt. Da können die Tools leider nichts machen, im Zweifelsfall einfach erneut probieren. Du kannst dir auch mal im Editor bei meinem Tool oder in den heruntergeladenen Nutzerdaten (ist ne Klartextdatei) schauen, ob unter saved_posts überhaupt was exportiert wurde.

Eigens erstelle Posts/Comments/PNs werden absichtlich nicht übertragen. Diese sind zum einen nicht Teil der exportierbaren user data, zum anderen könnte man das zwar technisch mit ein paar API-Anfragen pro Post/Comment zwar nachstellen, allerdings wären die Erstellungszeitpunkte dann jeweils die der Anfrage und nicht die originalen. Das ist meiner Meinung nach nicht Sinn der Sache und tut mehr schlechtes als gutes.

Der Importprozess ist additiv, heisst, wenn du Daten von einem anderen Account oder (teilweise) neue Daten von irgendeinem Account importierst, werden die vorhandenen Daten nicht überschrieben, lediglich die Einträge, die vorher noch nicht vorhanden waren, ergänzt.

Kurz: Mehrmaliges Importieren, auch aus mehreren Quellen oder gar selbst geschrieben, ist kein Problem.

Wurden erstellt!

Hier die (aktuellen) Links zu meinem und einem anderen Projekt, welche beide bis auf gewisse Extrafeatures den Accountumzug so einfach wie möglich gestalten sollten:

https://stablenarwhal.github.io/Lemmy-Userdata-Migration/

Features:

• Export user data from any Lemmy instance (>=v0.19)
• Download user data as a text file
• Modify user data, e.g. to add or remove followed users/communites (Example in Wiki)
  • “display_name” ​
  • “bio” ​
  • “avatar” ​
  • “banner” ​
  • “matrix_id” ​
  • “bot_account” ​
  • “settings” ​
  • “followed_communities” ​
  • “saved_posts” ​
  • “saved_comments” ​
  • “blocked_communities” ​
  • “blocked_users” ​
  • “blocked_instances”
• Transfer user data to the target account on the target instance

https://elvith-de.github.io/lemmy-migration/

Features:

• Login and export settings from any Lemmy instance (e.g. feddit.de)
• Optionally: Find local communities on the target instance that match followed communities
• Optionally: Backup your settings to a file (can be imported on any Lemmy instance in your profile)
• Login and import settings to any Lemmy instance (e.g. feddit.org)