Networking

In previous posts, I’ve explained how to use Tailscale’s MagicDNS and HTTPS certificate feature to generate a TLS cert for your Home Assistant install: Homeassistant Enable MagicDNS and HTTPS Certificates in Tailscale. That setup required you to reformat the TLS cert and copy it to the Home Assistant container… it wouldn’t be to much of a task to automate those actions, but fortunately there is now a superior method of applying and renewing a Tailscale cert for HASS (and many other self-hosted services). Let us dig in to that… ...

Tailscale is a virtual private network (VPN) service that allows secure remote access to resources across different networks. It offers a feature called MagicDNS that enables you to access your resources using a domain name instead of an IP address. Additionally, you can use HTTPS certificates to encrypt traffic between clients and servers, ensuring secure communication. In this tutorial, we’ll explain how to enable MagicDNS and HTTPS certificates in Tailscale and how to add a TLS certificate to Home Assistant using Tailscale. The most practical benifit for using Home Assistant within a Tailscale network is that it removes the requirement for network port forwarding and exposing services publicly, whilst still allowing your devices to access it from outside your local network. This blog post aims to give you the starting stes required to setup MagicDNS and HTTPS certificates in Tailscale, create a certificate on your home server and install that certificate in a Home Assistant docker container. ...

Following on from a previous post on how to setup a VLAN on a Fortigate hardware switch, this post is going to explain how we can link an AP-bridge SSID to a hardware switch and VLAN. For the most part, the only reference material you will need to complete this configuration can be found here: https://docs.fortinet.com/document/fortiap/6.4.0/fortiwifi-and-fortiap-cookbook/252439/configuring-the-fortigate-interface-to-manage-fortiap-units. However, if you have been working with Fortigates and by extension FortiOS for quite some time, you may be wonder where the CAPWAP option vanished to? Fortinet adopted this into the security fabric naming convention. CAPWAP has even been replaced in the CLI by ‘fabric’. ...

In this post, we are going to discuss how to add a VLAN to a hardware (sometimes referred to as physical) switch or interface on a Fortigate. It is worth noting that I actually do my testing on a FortiWifi, so I can assure you that this also applies there too. I will be focusing on the configuration which is relevant to FortiOS v6.0 and above, so your millage vary between versions. However, you need can usually be found over at the Fortinet Handbook: https://docs.fortinet.com/product/fortigate/6.0. ...

This is my lean and effective way to monitor your public IP address with Python, specifically Python3. The script – code and GitHub link below – runs on a continuous loop, which I covered in a previous post: here. NOTE: this code is reliant on the dig system command – so this essentially only work on a unix based system. I was running this on a Debian install. import os import subprocess import re import time print("start monitor vpn monitor check") expected_IP: "0.0.0.0" # ENTER YOUR EXPECTED PUBLIC IPv4 ADDRESS HERE current_IP: subprocess.check_output("dig +short myip.opendns.com @resolver1.opendns.com", shell=True) try: while True: if expected_IP in str(current_IP): print("IPs Match - Things are normal") else: print("Current IP: " + str(current_IP) + "\nIP NOT AS EXPECTED!") #Code to complete actions called here time.sleep(60) # Change this timer to reduce/increase time between checks (seconds) except KeyboardInterrupt: print("\nHard Exit Initiated. Goodbye!") https://github.com/Tombo1001/PyIPmonitor ...

I have a number of projects which I am currently working on which usually involve a raspberry pi and so other TCP enabled object. One project, in particular, is to control a KVM server with buttons connected to a raspberry pi (follow on social media or RSS for that future post). I have been using Python 3 SSH with Paramiko to send commands KVM server from the pi. Here is how I do that… ...

https://ddclient.net A quote short post on how to secure your DDNS updates with Namecheap, SSL and DDClient. For those of us who use dynamic DNS to work around roaming IP addresses, it is important to make sure that you are updating your DNS records securely with SSL. The default DDclient config has an example configuration file for using Namecheap’s DDNS service, however, it does not use SSL to check for your IP. In theory that connection could be manipulated and a false IP result could be returned – updating your DNS records to a wrong, malicious IP could cause a number of problems. ...

A short and sweet problem/resolution. If you are looking to enable subnet overlapping on a Fortigate so that you can give multiple interfaces an IP in the same subnet, this is the post for you. NOTE: This feature can only be enabled in the Fortigate’s CLI. To enable the overlapping feature, enter the following commands: config system settings set allow-subnet-overlap [enable/disable] end What is subnet overlapping? Subnet overlapping is disabled by default in fortiOS and for good reason; if you misuse subnet overlapping it can cause massive routing issues for your clients and their traffic. Subnet overlapping lets you apply IPs from the same subnet (e.g 192.160.1.X/24) to multiple interfaces that are not in the same virtual/physical switch. ...

If you are unfortunate enough to have to deal with double NAT on your gateway then you might know the troubles surrounding portforwarding or VIPs. Here is a quick how to guide for setting up a port forward on a Forgate where double NAT is inplace. Case Study – Plex port forward Plex is a great tool for managing your personal media collection and it gets even better when you enable a port forward to let you access this collection from anywhere in the world. Whilst Plex ahve made a number of changes to allow you to reach your contect via a relay server, the best way to access your content from outside your LAN is by using a port forward. ...

This is a local DNS server for local DNS requests. This post is going to explain the why and how I created a local DNS server in my home network environment. I used the PiHole project to make a network wide advert blocking a reality. https://pi-hole.net/ I have previously created a DNS server using Bind, running on CentOS 7. Thankfully digital ocean came to my rescue with some of the config in this home lab project, so be sure to check out their guide if you are looking for slightly higher level DNS setup: https://www.digitalocean.com/community/tutorials/how-to-configure-bind-as-a-private-network-dns-server-on-centos-7 ...