Gluetun kill switch: when the VPN drops
Gluetun installs a real firewall kill switch inside its own network namespace. What your containers see when the tunnel dies, and how to prove it holds.
#networking
Filtering by topic #networking · clear
The Ollama API and port 11434 explained
Curl your Ollama server on port 11434, read what a refused connection means, tour the API endpoints, and set OLLAMA_HOST without exposing the box.
How WireGuard works: cryptokey routing
AllowedIPs is the routing table and the access list at once. Learn cryptokey routing, the Noise handshake and rotation, and every wg0.conf reads clearly.
dsh web: http://127.0.0.1:3080 explained
dsh prints http://127.0.0.1:3080 because the Web UI binds to localhost only. Reach it safely with an SSH tunnel, and see why publishing 3080 is unsafe.
What is Tailscale and how does it work?
Tailscale explained: WireGuard tunnels between your servers, a coordination server for keys and ACLs, NAT traversal, DERP relays, and the threat model.
Tailscale serve vs funnel: which to use
Tailscale serve puts HTTPS on a tailnet-only URL. Funnel opens that same port to the public internet. Which to use, and the policy gate that blocks funnel.
SSH: Connection Refused vs Connection Timed Out
Two SSH errors, opposite causes. Refused means the server answered. Timed out means nothing answered at all. Learn which test to run, and from where.
Tor vs a VPN: which do you need?
Tor and a VPN answer different questions. See exactly who learns what at every hop, and why a VPS rented in your name is not an anonymity tool.
What is DNS? A server owner's guide
DNS decides whether your domain reaches your VPS. Learn the records, nameservers, TTL and the caching that makes a DNS change look like it failed.
Run a Tailscale subnet router on a VPS
Advertise a private network to your tailnet from a VPS: route approval, IP forwarding that survives a reboot, and the --accept-routes flag Linux needs.
Gluetun: reach the host and other containers
A container behind Gluetun has no interfaces of its own. Publish its ports on Gluetun, and open only the subnets it must reach outside the tunnel.
Route Docker containers through a VPN
Put a container behind a Gluetun sidecar and its ports vanish. Here is why the shared network namespace does that, and the compose file that works.
VPS vs VPN: what is the difference?
A VPS is a computer you rent. A VPN is an encrypted tunnel for your traffic. What each one does, what each costs, and how one can host the other.
Docker Compose networking explained
The default project bridge, DNS by service name, when host mode is worth it, sharing one network across projects, and the published port that skips UFW.
Docker bypasses UFW: why and how to fix it
Docker publishes container ports with iptables rules that skip UFW, so a denied port still answers the internet. See the mechanism and the fixes that work.
UFW firewall basics: set up a VPS firewall
UFW is the simple way to run a firewall on a VPS. Set a default-deny policy, allow only the ports you need, and turn it on without locking out SSH.
UFW and IPv6: the open door on your VPS
Your UFW rules and cloud firewall may only cover IPv4, leaving services wide open on IPv6. See why it happens on a VPS and how to close the gap.
What ports are and how Linux services listen
A port is how a server sorts incoming traffic to the right service. Learn to read what is listening with ss, and tell a local port from a public one.