Adopt UniFi devices to a VPS controller
Broadcast discovery stops at the first router. Here is how to point remote UniFi access points at a controller on your VPS, and keep port 8080 private.
#networking
Filtering by topic #networking · clear
What ports are and how Linux services listen
A port is how a server sorts incoming traffic to the right service. Learn to read what is listening with ss, and tell a local port from a public one.
How WireGuard works: cryptokey routing
AllowedIPs is the routing table and the access list at once. Learn cryptokey routing, the Noise handshake and rotation, and every wg0.conf reads clearly.
Gluetun: reach the host and other containers
A container behind Gluetun has no interfaces of its own. Publish its ports on Gluetun, and open only the subnets it must reach outside the tunnel.
Tailscale ports: what to open on your firewall
Tailscale needs no inbound port in most setups. See the outbound ports it uses, why 41641 is not 51820, and the ufw and firewalld rules that help on a VPS.
What Can You Do With Tailscale? 8 Real Uses
Eight jobs people run over a tailnet: reach home, borrow a VPS exit IP, share or publish one service, and SSH with no open ports. One command each.
Gluetun kill switch: when the VPN drops
Gluetun installs a real firewall kill switch inside its own network namespace. What your containers see when the tunnel dies, and how to prove it holds.
VPS vs VPN: what is the difference?
A VPS is a computer you rent. A VPN is an encrypted tunnel for your traffic. What each one does, what each costs, and how one can host the other.
Why Tailscale is slow: relay vs direct
Tailscale over a DERP relay is slow, direct is close to line rate. Two commands tell you which you have, plus the blocked UDP and hard NAT fixes for a VPS.
SSH: Connection Refused vs Connection Timed Out
Two SSH errors, opposite causes. Refused means the server answered. Timed out means nothing answered at all. Learn which test to run, and from where.
Route Docker containers through a VPN
Put a container behind a Gluetun sidecar and its ports vanish. Here is why the shared network namespace does that, and the compose file that works.
Docker bypasses UFW: why and how to fix it
Docker publishes container ports with iptables rules that skip UFW, so a denied port still answers the internet. See the mechanism and the fixes that work.
Docker Compose networking explained
The default project bridge, DNS by service name, when host mode is worth it, sharing one network across projects, and the published port that skips UFW.
dsh web: http://127.0.0.1:3080 explained
dsh prints http://127.0.0.1:3080 because the Web UI binds to localhost only. Reach it safely with an SSH tunnel, and see why publishing 3080 is unsafe.
UFW and IPv6: the open door on your VPS
Your cloud firewall or handwritten iptables may only cover IPv4, leaving services wide open on IPv6. See why it happens on a VPS and how to close the gap.
Tor vs a VPN: which do you need?
Tor and a VPN answer different questions. See exactly who learns what at every hop, and why a VPS rented in your name is not an anonymity tool.
What is Tailscale and how does it work?
Tailscale explained: WireGuard tunnels between your servers, a coordination server for keys and ACLs, NAT traversal, DERP relays, and the threat model.
Run a Tailscale subnet router on a VPS
Advertise a private network to your tailnet from a VPS: route approval, IP forwarding that survives a reboot, and the --accept-routes flag Linux needs.
Tailscale serve vs funnel: which to use
Tailscale serve puts HTTPS on a tailnet-only URL. Funnel opens that same port to the public internet. Which to use, and the policy gate that blocks funnel.
Why Sites Block Your VPS IP Address
Datacenter ASNs, hosting flags and shared range reputation explain most VPS blocks. Check how your own IP is classified and what you can legitimately do next.
Run Tailscale in a Docker Compose Stack
The vendor Compose example leaves your app on a public host port. Use a Tailscale sidecar so the container has no published port, only a tailnet name.
Connect two VPS on a private network
Two VPS, one private network: a provider VPC, a WireGuard tunnel you own, or a managed mesh. Subnet choice, service binding, firewall rules and MTU included.
The Ollama API and port 11434 explained
Curl your Ollama server on port 11434, read what a refused connection means, tour the API endpoints, and set OLLAMA_HOST without exposing the box.
What is DNS? A server owner's guide
DNS decides whether your domain reaches your VPS. Learn the records, nameservers, TTL and the caching that makes a DNS change look like it failed.
UFW firewall basics: set up a VPS firewall
UFW is the simple way to run a firewall on a VPS. Set a default-deny policy, allow only the ports you need, and turn it on without locking out SSH.