tag: #networking

Part four of the NetBird series. The mesh only covers machines running the agent, but plenty of things cannot run it - a NAS, a printer, a legacy appliance, a whole cloud subnet. A routing peer bridges them in. The important 2026 change is that Networks replaced the old Network Routes and fixed the ACL caveat from part three by making access per-resource policy. Plus high availability, source-IP preservation, and exit nodes.

Part three of the NetBird series. A fresh mesh is flat - every peer reaches every other peer on every port, which is wrong to depend on. Access policies fix it, and the model is RBAC for your network - deny by default once you delete the starter policy, allow-only rules, groups as the unit of access with users as source and infrastructure as destination, and setup keys that auto-assign groups. Plus the two sharp edges (same-group peers always reach each other; subnet routes can bypass access control) and posture checks for real zero trust.

It's always DNS stays true because DNS underlies every connection, fails as some other layer's error, and returns wrong answers without ever reporting one. The confusion is almost always caching: many independent caches, each with its own TTL, expiring on its own clock.

Part two of the NetBird series. What the self-hosted control plane is actually made of - management as the brain, signal as the introducer, relay as the NAT fallback, a dashboard, and an identity provider. The big 2026 change is that NetBird now ships an embedded IdP, so you no longer have to stand up Zitadel just to get started. Plus what you have to provide, why the relay is what breaks, and how peers join with setup keys.

Plain ip link and ip addr dump a wall of text for every interface, most of it irrelevant when you just want to know what is up and what has an address. The -br flag collapses each interface to a single line, and it is the version you should be reaching for on every troubleshooting call.

The FortiGate 100F arrived this week and slots into the homelab between the Fritz!Box modem and the MikroTik core router, adding real next-generation firewall capability to a routing-strong but inspection-light architecture.

Running endlessh-go as a Docker container on Strato VPS, deployed via Ansible

Running Cisco WLC 2504 and Aironet 3600 access points in a homelab for under 300 CHF

QUIC is in late draft, HTTP/3 is shipping in Chrome and Firefox, and Cloudflare and Google are already serving meaningful traffic over both. The internet's transport layer is being rewritten. This is what changed, why it changed, and what it means for everyone who runs servers.

Mathy Vanhoef forced WPA2 to reinstall a key it was already using, resetting the nonce and handing an attacker the keystream. Every correct implementation was affected, and Linux managed to be affected worst of all by installing an all-zero key. Here is the handshake, the flaw, and why the link layer was never where your trust belonged.