brownmustardminion

@brownmustardminion@lemmy.ml

This profile is from a federated server and may be incomplete. View on remote instance

[Question] Securely Passing Host VPN to KVM?

I've attempted to create a VM on my ubuntu host machine that is accessing the internet via a dedicated VPN app. I'm able to disconnect my host VPN and access the web within the VM, but cannot access the web when the host VPN is enabled. Ideally I'd like to enable the VPN on the host and pass through web access to the VM....

brownmustardminion OP ,

QEMU. Using NAT but it's attached to the host's NIC. I know this is probably what's causing the issue. I'm not sure how to connect it to the VPN.

Nextcloud appreciation post

After months of waiting, I finally got myself an instance with Libre Cloud. I was expecting basic file storage with a few goodies but boy, this is soooo much more. I am amaze by how complete this is!!! Apps let me configure my instance to fit everything I need, my workflow is now crazy fast and I can finally say goodbye to...

brownmustardminion ,

I’m a massive Nextcloud fan and have a server up and running for many years now.

But I understand all of the downvoted commenters. It is clunky and buggy as hell at times. Maybe it’s less noticeable when you’re running a single user instance, but once you have non tech literate users using it you begin to notice how inferior it is to the big boys like google drive in some aspects.

That said, I personally have a decent tolerance for fiddling and slight frustrations as a trade off for avoiding privacy disrespecting and arguably evil corporations.

I would recommend everybody looking for a gdrive, Dropbox, one drive alternative to at least give Nextcloud a go.

brownmustardminion OP ,

Underlying system is running Proxmox. From there I have the relevant two VMs: OMV and Proxmox Backup Server. The hard drives are passed into OMV as SCSI drives. I had to add them from shell as the GUI doesn’t give the option. Within OMV I have the drives in a mergerfs pool, with a shared folder via NFS that is then selected as the storage from within the Proxmox Backup Server VM. OMV has another shared folder that is used by a remote duplicati server via SSH(SFTP?), but otherwise OMV has no other shared folders or services. Duplicati/OMV have no errors. PBS/OMV worked for a couple of months before the aforementioned error cropped up.

Also possibly relevant: No other processes or services are setup to access the shared folder used by PBS.

brownmustardminion OP ,

Looks like my reply got purged in the server update.

Running Proxmox baremetal. Two VMs: Proxmox Backup Server and OMV. Multiple HDDs passed through directly as SCSI to OMV. In OMV they're combined into a mergerfs pool. Two shared folders on the pool: one dedicated to proxmox backups and the other for data backups. The Proxmox backup shared folder is an NFS share and the other shared folder is accessed by a remote duplicati server via SSH (sftp?). Within the proxmox backup server VM, the aforementioned NFS share is set up as a storage location.

I have no problems with the duplicati backups at all. The Proxmox Backup Server was operating fine as well initially but began throwing the estale error after about a month or two.

Is there a way to fix the estale error and also to prevent it from reoccurring?

brownmustardminion OP ,

Third time posting this reply due to the lemmy server upgrade.

Proxmox on bare metal. A VM with OMV and a VM of proxmox backup server. Multiple drives passed through to OMV and then mergerfs pools them together. That pool has two main shared folders. One is for a remote duplicati server that connects via SFTP. The other is an NfS for PBS. The PBS VM uses the NFS shared folder as storage. Everything worked until recently when I started getting estale errors. Duplicati still works fine

brownmustardminion OP ,

Thanks so much for the detailed reply. I have about 20TB of data on the disks otherwise I would take your advice to set up a different scheme. Luckily, as it's a backup server I don't need maximum speed. I set it up with mergerfs and snapraid because I'm essentially recycling old drives into this machine and that setup works pretty well for my situation.

The proxmox host is the default (ext4/lvm I believe). The drives are also all ext4. I very recently did a data drive upgrade and besides some timestamp discrepancies likely due to rsync, the SCSI semi-virtualized thing wasn't an issue. I replaced the old drive with a larger one, hooked the old one up to a usb dongle and passed it through to OMV and I was able to transfer everything and get my new data drive hooked back into the mergerfs pool and snapraid. I'll do a test and see if I can still access the files directly in the proxmox host just for educational purposes.

I'll try to re-mount the NFS and see where that gets me. I'm also considering switching to a CIFS/SMB share as another commenter had posted. Unless that is susceptible to the same estale issue. I won't be back at that location for about a week so I might not have an update for a little while.

brownmustardminion OP ,

Your question is a good one. I'm not the one who downvoted you fyi. To answer your question, it is absolutely a personal anecdote based on my own experimentation. I'm sure others will add their own experiences. Based on my experiences there's no doubt about twitch shadowbanning based on VPN use. I'll admit I don't have a basis for Linux and adblockers being a part of the equation, but I made it clear in my original post that those were assumptions.

To further speculate, I have an idea that the shadowban may actually be triggered by somebody using the same VPN server doing something that triggers it, affecting anybody else on that server. I can't possibly provide evidence for that theory, but it would explain the seemingly random nature of the shadowbans.

brownmustardminion OP ,

It's trivial for twitch to differentiate between users who are logged in and have verified accounts. Slapping bans by IP is archaic and lazy when you have more precise metrics to go by. And at the very least, they should make you aware that you are banned before accepting your money for their services.

brownmustardminion OP ,

I've only experienced a shadowban while using ubuntu. I switch between all the major operating systems on the same twitch account and with the same vpn service/servers. The bans have only been initiated while on linux, although they did follow over to the other OSes until some type of timer was passed.

This follows what some online shopping services do, which is to assign weights to certain user metrics and if a set threshold is crossed it rejects your payment or otherwise blocks you from a transaction. So VPN+MacOS might work but VPN+Linux matches some type of metric fraud systems associate with criminals.

brownmustardminion OP ,

I'm curious to hear the opinion of those downvoting this response. It seems off brand for privacy enthusiasts to disagree with my take on IP bans.

brownmustardminion OP ,

Think of it from the reverse direction. If you have a twitch account in good standing that's verified with a valid email and has no violations, why all of the sudden would it make sense to apply a ban to this account? Perhaps preventing new accounts from being created on a sketchy IP could be a sensible solution, but shadowbanning an existing account makes no sense and is a lazy approach to security. In addition, fingerprinting makes it so a service can easily differentiate between users using the same IP.

brownmustardminion OP ,

I have not. I try to avoid apps if I can.

brownmustardminion OP ,

Got an alternative that isn't youtube?

brownmustardminion OP ,

Maybe I'm missing something but you can tell a compromised account from a secure account by the user behavior, no? If an account is compromised the activity will be spam/harassment, etc at which point a ban on that account would happen. And compromised accounts could be accessed from a non-vpn Ip also.

brownmustardminion OP ,

When you detect a compromised account you could put a freeze or lock on it. If there are that many compromised logins that constant account swapping is an issue then twitch needs to overhaul their account security.

brownmustardminion OP ,

Is it the privacy community in general or Lemmy that’s gotten infiltrated by all of these antagonistic socially inept 15 year olds recently? Never started a thread on Lemmy that’s gotten so many unsupportive and useless responses before. And I’m active on piracy subs…

brownmustardminion ,

I would suggest trying wireguard first as it’s much less complex to set up. Once you have a handle on that, you might consider moving to a mesh network. I personally would love to use a mesh network, but have not been able to get it configured correctly the few times I’ve tried.

brownmustardminion , (edited )

I've tried Nebula before but couldn't get it running properly on all devices. How is Tailscale in terms of compatibility and can you also use wireguard simultaneously? Mesh networks are great for connecting my own devices and servers, but I still need a wireguard interface for certain servers to provide public access through a public router. I also ran into a major issue setting up Nebula on my laptop in which it couldn't be used without disabling my VPN. Is any of that a problem with Tailscale? Also, is Tailscales coordination server self hostable or do you have to use theirs? That seems like a dealbreaker if you’re forced to use a third party coordinator

brownmustardminion OP ,

Forwarded mail but it may be two way in the future so it would probably be smart to just go that route from the beninging.

brownmustardminion OP ,

I ended up going with migadu. Seems great so far. Already up and running with 3 domains and dozens of aliases.

brownmustardminion OP ,

Problem solved. The firewall was attempting to pass traffic through the default gateway. You have to create a firewall rule to allow whatever traffic you want but in the advanced settings you need to select the wireguard gateway instead.

brownmustardminion OP ,

amazonads has already been blocked but I just blocked amazon and waiting to see if that does the trick.

brownmustardminion OP ,

I'm using a pretty good VPN and I still get ads.

brownmustardminion ,

I tried a couple but had no luck running them in VMs so I gave up.

brownmustardminion ,

Yep. Also as extra protection from any phoning home to Topaz. It’s not possible run the software firewalled, since it needs to download the AI models once you try to run anything.

brownmustardminion ,

I haven't.

brownmustardminion OP ,

It’s really that much of a hassle to fiddle with the volume sizes?

brownmustardminion OP ,

You suggested just adding the ISOs to local-lvm. Do you think it would be feasible to simply delete the local storage completely and then extend the local-lvm after, storing the ISOs there? I know extending volumes is much simpler than shrinking. And I imagine deleting completely is also easier than shrinking?

Mini Monitor Recommendations

I’m looking for a small 7” or 8” computer monitor to keep on my desk to display Discord and other things without taking up real estate on my main monitor. Ideally something cheap and therefore not a touchscreen. There’s tons of options online but I’d like to get some recommendations from people who have a similar...

brownmustardminion OP ,

Good idea. I was leaning heavily towards those raspberry pi monitors.

brownmustardminion OP ,

With this method, would I be able to use an iPad as a display for windows 10? If so, are there any downsides? I remember trying Duet Display years ago but they charge a monthly fee which is absurd. And performance was not great.

brownmustardminion OP ,

Thanks. That helped a lot. It gave me a good basis for some further googling.

It ended up that the Internal Clock of the hardware interface was deselected in alsamixer. Enabling it fixed the no audio issue.

For the channel remapping I tried a bunch of different config files until finally one actually managed to not be ignored. It's absurd how many separate configuration files and sound settings menus exist for linux audio and there's no guarantee the one your editing is even being used. An absolute mess IMO and it's not wonder people shy away from linux for desktop purposes.

Funny enough, despite getting the channel remapping to work, it's completely ignored unless you put pulseaudio -k into your user profile. And even now, because the remapped output device doesn't show up on boot, it has to be manually set to the default output every login.

At least I have the right channels mapped though.

I love linux but god damn is it a hot mess for the simple stuff.

brownmustardminion OP ,

That’s pretty decent. I tried speed testing some other recommendations and I was seeing 35 MB/s.

brownmustardminion OP ,

I appreciate your insight. That’s good to know. My journey into self hosting started with searching for alternatives to google products so I’m naturally hesitant to touch anything under their umbrella.

brownmustardminion OP ,

Thanks. I actually selfhost my backup server. So I’m not backing up to a VPS. I use the VPS as a hub in a hub and wheel configuration to connect multiple servers (including a dedicated backup server).

brownmustardminion OP ,

So each time I get shut down is during a large extended data transfer. I have my VPS server set up as a VPN hub that connects multiple servers. So typically when my traffic gets diverted to a black hole by DO, there was a consistent roughly 35MB/s inbound/outbound vpn traffic stream for 4-5 hours going through the VPS. My server gets shut down for 3-4 hours and I get a email notice that my server was under a massive DDoS attack and they diverted traffic to a black hole. I always respond informing them that it’s not a DDoS and explain the situation. They typically respond with “Utilize a service like Cloudfare which has DdoS protection”.

I’ve been really happy with them as a provider otherwise but this is a dealbreaker for me.

brownmustardminion OP ,

Funny you mention that. I was about to make a post about Nebula earlier. I learned about it through YouTuber apalrd a few months back and it seems perfect. I’m still trying to understand some of the complexities when utilizing a service that requires circumventing the mesh network for public access such as Nextcloud. I’ll probably make a post about this after I’ve done some more research. I think there’s some good discussion to be had about such a setup.

brownmustardminion OP ,

I tried to set up a nebula network but it seems like it has trouble when your hosts are behind a VPN service. The VPN must block the port or protocol the lighthouse is connecting with and I can’t figure out a way to bypass the VPN (at least on Mac split tunneling isn’t supported). I’m assuming you’re familiar with mesh networks…do you have any good youtube videos or resources you would recommend? The nice thing about VPN is it’s crazy simple to set up and seems to work with all types of system configurations. Nebula was pretty simple but seems like a pain to troubleshoot so far.

brownmustardminion OP ,

Ideally I would be able to split tunnel around the vpn but I don’t have the option on mac

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • All magazines
    •