Advise on setting up VLAN firewall

Advise on setting up VLAN firewall

I'm finally playing around with VLAN's and I think I got everything working as desired but hoping to get some confirmation/suggestions on improvements.

My goal is to take a single Proxmox VM and expose it to the internet via NGINX, so I want to make sure that this VM if it were ever compromised can't access anything else in my home, including the Proxmox host.

So I set up the VLAN and got everything tagged, and now that VM is on its own separate subnet. Then, I created three pfSense rules, from top to bottom:

  1. Pass all protocols to WAN subnets (ie give VM full internet access)
  2. Block access to other local subnets via an RFC1918 alias (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  3. Pass port 53 DNS to this firewall

Once I've done all this, I can still access this VM's service from my laptop browser, which I assume is because nothing is blocking my main LAN from accessing this VLAN. These rules only apply in the other direction.

And when I SSH into this VM and try to SSH from there back into something on my main network (say Home Assistant), the connection times out.

So is it safe to say that I've comprehensively blocked anyone from hacking into this VM, and using it to branch into my home network? Is there anything else I should do before setting up NGINX and exposing it to the internet?

Any help/advice would be appreciated!

https://i.imgur.com/fdCHgsE.png

u/woodford86 — 11 days ago

Help me build a photogrammetry PC

Looking at building a dedicated photogrammetry PC. My old Dell laptop is just not cutting it, and I'm out of storage space. I am not a computer hardware guy, I just use em, so its a bit overwhelming trying to piece something together that will work well.

I run DJI Terra (hard to beat that ag license price) but intend to try out WebODM. Typical projects are 5000 or 10,000 images, give or take, or 50 to 100GB sometimes more. But I want to try out elevation mapping which I believe uses significantly larger data sets.

So, starting thoughts:

  • Fast CPU, lots of memory, a fast SSD for primary and a RAID volume for secondary/data storage.
  • I hear AMD CPU's are preferred over Intel
  • Primary drive, Samsung 990 Pro
  • Secondary drive, three WD Red Plus 8TB's in RAID
  • 128GB (2x64) DDR5 memory
  • 16GB Cuda GPU

Specific questions:

  • AMD R7 7950X appears to be on a decent sale right now. Any reason not to pounce?
  • I'm aware of what memory costs these days...but if my current 64GB is a limiting factor, I'm mentally prepared to go up to 128GB DDR5. Bad idea? Does going to 128 and/or DDR5 complicate things? I saw a comment suggesting anything over 96GB gets throttled by most consumer mobo's and thats a ton of money to spend if I can't get the full benefit.
  • I would like to speed up transferring the files from MicroSD to the computer, I understand MicroSD Express is a thing but can't find any readers - any suggestions there?

Re: storage, I know I want to keep as much of my working files off the SSD as possible. But the SSD is the fast drive. What's the ideal way to set this up, put the Terra library on the C:\ and just use the secondary volume for backup? Anybody know if theres a way to set Terra to process files on the C: but store the main library on the secondary?

Thoughts/advice?

reddit.com
u/woodford86 — 1 month ago

Elevation mapping with Mavic 3M?

Hey all, just a farmer with a mavic 3M here. I’ve heard that I can possibly do elevation mapping with the drone, but that feature is locked out of my ag subscription in Terra so I have questions before I take it seriously.

The end goal is to get accurate elevation maps that I can load into Optisurface and design landform models from. Lidar would be a dream but no way I can justify that expense.

First, when doing elevation via photogrammetry with an RTK corrected drone, what can I expect for accuracy? Assuming a clear freshly tilled ground surface, is it able to construct that elevation map to inch accuracy?

Second, what kind of settings would be recommended to get accurate elevation? Flight height etc. I’m talking about farmland so 160 ac to 320 ac maps. I imagine as many photos as possible and at multiple angles, so no way out of it being a very data heavy process? For context my multi spec mapping missions are typically 50-100 gb of photos depending if it’s a quarter section or a half section.

reddit.com
u/woodford86 — 2 months ago

Are plastic straws back?

Twice this weekend I got plastic straws. Two separate establishments, one of which is definitely new enough to not have stocked up pre-ban.

Is it true? Can it be??

u/woodford86 — 2 months ago
▲ 4 r/tea

I want to like tea….recommend a drink order? (Canada)

I’ve recently went sober and man, I miss having an evening drink. Coffee well that’s a morning drink. I’ve tried tea in very basic forms before but never much got it.

Well I want to change that! Can anyone recommend a drink order I could find here in Canada (Tim Hortons, Starbucks, western cafes)?

I like my coffee black and hot, so I imagine my tea would be the same. Definitely not a fan of sweet drinks. But I also want something that’s got more substance than just “flavored hot water”.

Is there such a thing? Or is tea just not for me?

reddit.com
u/woodford86 — 3 months ago
▲ 240 r/labrador

Advice to train this excitement whining out of my boy while driving?

My younger boy does this whining I’d bet 80% of the time we’re driving. At best it’s a quiet whine, but it constantly boils over into a really sharp, excited bark/yelp. Absolutely drives me nuts.

I’ve tried making every drive as boring as possible. I’ve made a point to drive to the dog park, park and sit, and then just leave - did that every day for probably two weeks. We didn’t do actual dog park runs at all in that time. No improvement.

I’ve tried just not letting him out anytime he’s noisy. Even one little whine and nope, he’s staying inside the truck. (I’m a farmer so we’re constantly driving around to new places for him to run and sniff). No improvement.

Literally the only time he doesn’t seem to be noisy is after a grocery store visit, when I leave him in the truck. It wears on me!!

Admittedly my attempts to train this have only ever lasted maybe 10-14 days at a time. So maybe I need to get more deliberate? I just wish he were like big bro who just kind of breathes heavy when he’s excited.

Any advice?

u/woodford86 — 3 months ago

Anywhere that sells hats for big heads?

I can never fit my giant skull into the caps sold at MEC, Lids, Sport Chek etc. But now I’m seeing ads for hats specifically for big skulls (ie Oddjob Hats). They look nice but I hate buying clothes online and paying to return when they don’t fit right.

Anybody know of stores in town that carry something similar?

Or failing that, any stores that have a good selection of hats that you won’t find at those previously mentioned stores? I swear I can only find sports teams hats and then the same half dozen brands or so. Gotta be more out there!

reddit.com
u/woodford86 — 3 months ago

Is RDP the best option for remote access to a Windows desktop?

I have a couple windows programs that really need a desktops computing resources, but I also need the mobile access of my laptop. So thinking about building a dedicated tower, and just using RDP or similar to access it. As a new build it would be some version of Win 11.

For full work sessions I’d still just sit at my desk, my remote use would be more just viewing/manipulating imagery in high resolution.

Is the native windows Remote Desktop a good option? Googling just gives a bunch of threads complaining how dated it is.

Are there other/better options?

reddit.com
u/woodford86 — 3 months ago

Any way to create a legitimate anonymous account, or effective ways to separate IRL from public/internet FB activity?

I always used FB the traditional way, with only IRL friends so I didn’t much care about being anonymous. But I’ve been using groups quite a bit lately plus marketplace, so FB is no longer just my vetted group of approved contacts.

Is there any way to create an anonymous FB account (I tried making a fake and it got deleted immediately), or name change, or somehow to silo my IRL Facebook name and activity separate from stranger danger Facebook? I’m thinking like how IG lets you create multiple accounts under a single login with completely separate names, friends lists etc.

I have all my privacy settings locked down but my name still shows up in those groups and marketplace, and I know at least once my sister mentioned she saw me discussing something mundane in one of those groups. So clearly that wasn’t enough.

reddit.com
u/woodford86 — 3 months ago

Now that we hear the Sea Serpent is coming out in July, what you buying to meet the threshold?

I was afraid of this when there were no rumours of a new castle set as of Christmas - the Serpent is coming next month, and there’s simply nothing that I want to buy. May be the first time I just cave and eBay if from shutters scalpers.

Got multiple horse knight castles already, LOTR sets are too expensive, DnD (if it’s even available?) is just not enough value to buy a second.

What you guys gonna buy? Any good castle type sets i’ve overlooked?

reddit.com
u/woodford86 — 4 months ago
▲ 4 r/PleX

Are we ever going to get Lists on the Android TV app or web app?

I saw the Lists feature get added a while back and instantly got pumped since I've been wanting a way to sort my favorites, rewatchables etc. And Lists works great....... if you're using the phone app.

But move to something you'd think most people watch their content such as a TV or computer monitor (in my case, via a Shield Pro or browser) - its woefully absent.

Are they ever going to implement this feature across the entire platform? Or perhaps I've got something configured wrong? Server package is updated as of four days ago.

reddit.com
u/woodford86 — 5 months ago

Looking for: Flaked (both seasons)

Every torrent I can find of this show has zero seeds. Have had them queued for months now. Anybody got a line on available copies?

reddit.com
u/woodford86 — 5 months ago

Trouble with Reel Irrigator (Microrain MR43)

I’m stumped…bought a [MicroRain MR43](https://www.microrain.net/products/microrain-product-line/microrain-mr43) and according to my specs (30 GPM, 65 PSI) I should be able to run it slowly for 1” application.

But no matter what I tried, I have to run it full speed. If I set the speed valve any slower at all it just stops turning. So the water is bypassing without spinning the turbine I guess.

I’ve tried it with the hose only 10 ft out to eliminate drag, no improvement.

I’ve used different nozzles, no change.

I’ve tried with my pump at an idle and at full speed, no change. Pump off isn’t enough pressure to run the sprinkler.

I opened the turbine and it spins freely, no clogs, no breaks.

No leaks, no plugs anywhere. Seems as soon as that flapper valve is opened even the tiniest bit then the water just all bypasses the turbine.

Any advice what might be wrong?

reddit.com
u/woodford86 — 5 months ago

Man, this remote…I swear if I so much as look at it, it toggles the power button. Just way too sensitive.

Anybody have a good solution address this? I thought remapping the power button to require a double tap instead of single would be perfect but doesn’t seem like the power button is mappable in the two apps I tried.

Anybody got a solution?

reddit.com
u/woodford86 — 5 months ago

I haven’t been to the gym in 10 years, but I always felt confident in what I was doing - usually some form of a 5x5 compound program. My goal then was to build muscle, but I quit when one bad deadlift fucked my back for like a month.

Well, I’m now 39 and so stiff, sore, and lacking any kind of muscle definition. So thinking I want to get back into it. I also want to take up swimming but that’s a separate thing (running has always killed my shins/knees).

Any advice for a routine that is focused more on just keeping everything loose and nimble as I get older? Building some definition would be a perk but not a requirement.

reddit.com
u/woodford86 — 6 months ago