u/BostonDrivingIsWorse

I'm trying to create a direct p2p connection from my home network to a remote network using Pangolin, which uses Wireguard as its back end.

The docs recommend adding a hybrid NAT rule:

>By default, OPNsense software rewrites the source port on all outgoing connections to enhance security and prevent direct exposure of internal port numbers. Static port mapping in OPNsense involves creating a fixed association between a specific external port number and an internal IP address and port, allowing incoming traffic to be directed to the correct destination within the local network.

>Go to Firewall > NAT, Outbound tab. Select Hybrid Outbound NAT rule generation. Select Save. Select ↑ Add to create a new NAT rule to the top of the list. Configure the rule to match UDP traffic. Note, for each rule, select the appropriate Address Family (IP version), IPv4 for one and IPv6 for the other.

I have enough knowledge to be dangerous, but not really enough to fully understand the implications of what I'm doing. I've created this rule, and tested that it does work, but I want to make sure its fundamentally safe, and I'm not creating any unnecessary security risks.

These are the settings for the Source NAT rule:

• Interface: WAN
• Version IPv4
• Protocol: UDP
• Source Address: LAN Network
• Destination address: any
• Destination port: any
• Translate Source IP: (default) Interface Address
• Translate Source Port: any
• Static Port: Yes

As I understand it, Pangolin needs to be accessible on ports 80, 443, 51820, and 21820 (for CLI clients). 80(http) and 443(https) pipe directly to traefik which handles public resource routing, with a number of configurable security features.

What about 51820 and 21820? How are those open ports protected from intrusive traffic? Just looking to make sure I fully understand before I open those ports.

I have a remote Proxmox server with two VMs. The first VM is Home Assistant with the Newt app installed. I also use this for local access to the remote network.

The second is a Proxmox backup server, which I'd like to use as a private resource for remote backups. I tried installing the Pangolin CLI to enroll this VM, but it caused Newt to crash, and cut my remote access until I restarted the machine.

Any advice on why this might happen, and how to avoid? I'm also not tied to this setup. Any advice on a different config would also be welcome!

I have two non-clustered Proxmox machines each with a few very simple firewall rules (in order):

• Allow all from one IP
• Deny any connections to management interface port
• Deny any connections to SSH port
• Allow all other connections

I have the same rules on both machines, where PM1 hosts a Home Assistant VM, and PM2 hosts frigate NVR. When I enable the firewall, video streams in frigate directly, and Home Assistant take forever to load, regardless of whether I place the rules at the datacenter, node, or VM level. Without the firewall, the streams load almost instantaneously, but enabling the firewall creates about 30s of latency for video to load.

Things I've tried, all with the same result:

• Setting default INPUT to ALLOW
• Removing all rules, while leaving default INPUT as ALLOW
• Confirmed Frigate is not using management/SSH ports

Another data point: Frigate uses go2rtc as a built-in component to distribute video streams. When I load the video streams directly from the go2rtc interface, they load instantaneously, so I'm guessing the delay sits between Frigate and go2rtc, but I'm not sure how enabling the firewall creates delay between two components of the same app. I've confirmed that these components communicate over the loopback interface, which is left unaffected by the PM firewall, according to the docs.

I'm curious if anyone has any idea why this might be happening?

I'm wondering if I can use CrowdSec to monitor and ban LAN IPs trying to brute force other devices on the network.

For example, I run ProxMox. If a Raspberry Pi on my network were to be compromised and an attacker tried to brute force into my ProxMox server, could I configure CrowdSec on the ProxMox machine such that it detects repeated logins attempts and bans the offending private IP?

I have a Sport-L, and have been looking at some roof storage options for camping. I have zero experience with this sort of thing, so I'd love the opinions of people who have, and regularly use their roof storage.

#Crossbars

First the OEM crossbars seem fairly expensive (~$200 not including shipping), and only hold 165lbs, with a strict warning not to go over this weight. I'm less concerned with the price, but the weight limit seems absurdly low. On the other end of the spectrum, random Amazon-brand aftermarket options seem too good to be true at ~$80 and a 300lb limit.

Does anyone have opinions or experience with either of these options?

#Storage and Racks

I've been interested in something like this, but it claims to only fit "adjustable" crossbars. I'm not sure what that means. Does the CR-V even have adjustable crossbars? It's my understanding the OEM crossbars have set mount points in the side rails. What storage do typically use, and do you like it?

I'm getting concerned about the number of prevented attacks on my CrowdSec instance. It seems every time a report comes in, the number of attacks prevented is significantly higher than the previous period, with the highest vector being "unknown behavior".

December of last year, I was seeing ~220k attacks prevented per week on my VPS, and now I'm seeing ~750k. This seems like a RIDICULOUS number of attempts... Is this normal? Is this just due to a rise in automated bot/AI attacks? Is anyone else seeing this? Perhaps I'm being targeted specifically?

Curious what others' experiences are like.

Am I missing something, or is it not possible to sort by project? In table view of a custom saved filter, in the Overview menu, or in the table menu, it seems there is no way to sort by which project the task belongs to.

I’ve been to KC many times and tried most of the breweries her. You’ve got a great beer town!

Unfortunately, I’m just passing through today, but would love to pick up some beer on my way. Any recommendations where I might be able to snag a couple of local selections?

My friends and I like to play old games, some of which only work over LAN.

I tried to set my friend up with a Pangolin client to access my private LAN resources (CIDR 192.168.1.0/24, TCP/UDP all ports allowed). He could ping my computer IP, but for some reason when one of us would create a game, the other person couldn't see it.

We've also tried this on an actual LAN without issue, so I'm curious what else we might try to make a VPN connection act more like a LAN connection. A couple other points:

• I made sure access controls were correct, my friend in the "friends" role, and allowing "friends" to access the private resource.

• Windows Firewall Defender allowing access to the game app. Even tried turning it off completely to test.

Any thoughts as to what might be blocking two computers one on LAN, one connected via Pangolin client from talking to each other?