Admiral Patrick

I’m surprisingly level-headed for being a walking knot of anxiety.

Ask me anything.

Special skills include: Knowing all the “na na na nah nah nah na” parts of the Three’s Company theme.

I also develop Tesseract UI for Lemmy/Sublinks

Avatar by @SatyrSack@feddit.org

  • 313 Posts
  • 1.37K Comments
Joined 3 years ago
cake
Cake day: June 6th, 2023

help-circle










  • I’ve got bot detection setup in Nginx on my VPS which used to return 444 (Nginx for "close the connection and waste no more resources processing it), but I recently started piping that traffic to Nepenthes to return gibberish data for them to train on.

    I documented a rough guide in the comment here. Of relevance to you are the two .conf files at the bottom. In the deny-disallowed.conf, change the line for return 301 ... to return 444

    I also utilize firewall and fail2ban in the VPS to block bad actors, overly-aggressive scrapers, password brute forces, etc and the link between the VPS and my homelab equipment never sees that traffic.

    In the case of a DDoS, I’ve done the following:

    • Enable aggressive rate limits in Nginx (it may be slow for everyone but it’s still up)
    • Just stop either Wireguard or Nginx on the VPS until the storm blows over. (Crude but useful to avoid any bandwidth overages if you’re charged for inbound traffic).

    Granted, I’m not running anything mission-critical, just some services for friends and family, so I can deal with a little downtime.



  • I have never used it, so take this with a grain of salt, but last I read, with the free tier, you could not secure traffic between yourself and Cloudflare with your own certs which implies they can decrypt and read that traffic. What, if anything, they do with that capability I do not know. I just do not trust my hosted assets to be secured with certs/keys I do not control.

    There are other things CF can do (bot detection, DDoS protection, etc), but if you just want to avoid exposing your home IP, a cheap VPS running Nginx can work the same way as a CF tunnel. Setup Wireguard on the VPS and have your backend servers in Nginx connect to your home assets via that. If the VPS is the “server” side of the WG tunnel, you don’t have to open any local ports in your router at all. I’ve been doing that, originally with OpenVPN, since before CF tunnels were ever offered as a service.

    Edit: You don’t even need WG, really. If you setup a persistent SSH tunnel and forward / bind a port to your VPS, you can tunnel the traffic over that.



  • Yeah, I expanded my hard drive (unofficial methods) in my 360 and “installed” all of my games to it. That way if the optical drive starts to go or my discs get messed up, all it’ll have to worry about is reading the disc initially to allow it to play from the hard drive. I did similar on my soft-modded OG Xbox but I don’t even need the disks for that one anymore (and the DVD drive is kaput anyway).

    I haven’t messed with x360 emulators as I never had anything powerful enough at the time, but I saw not long ago there was one available for Android now, so I may look back into it.

    But yeah, something like XLink Kai that somehow satisfies the cloud connectivity would be cool. But I’m not sure how that would work since it’d have to have valid certs for the hardcoded domains the system and games would connect to.