Tagged "networking"

I published GL.iNet Slate 7, Tailscale, and Split-Routing Around the Great Firewall, a full technical writeup of the router-level setup I run in China: a Slate 7 carrying Tailscale as the default route to a Debian VPS exit node, with PBR sending Chinese CIDRs direct out the physical uplink and a dnsmasq split so CN domains resolve via AliDNS and everything else rides stubby DoT to Cloudflare. The post spends most of its time on the two war stories that took the longest to unstick: getting PBR's fwmark rules to win over Tailscale's exit-node rule, and hunting down GL.iNet's vpn_table stamping every LAN packet with 0x8000 and quietly breaking Google and YouTube. All the shell, nftables, and dnsmasq snippets embed live from a public gist, pinned to a revision so the post never drifts underneath its own code.

A full technical walkthrough of the router-level setup I run in China: a GL.iNet Slate 7 running Tailscale as the default route to a Debian VPS exit node, with policy-based routing sending CN traffic direct and a DNS split that keeps Chinese and foreign services both fast. Includes the three gotchas that took the longest to unstick: LAN forwarding and MASQUERADE on `tailscale0`, PBR-vs-Tailscale precedence, and the GL.iNet 0x8000 mark leak.

I published WebRTC — How it actually works as a note on how signaling, STUN/TURN, ICE, DTLS, and SRTP fit together. The useful framing here is that WebRTC is not just "peer-to-peer"; it is a browser-owned transport stack wrapped around signaling and fallback infrastructure you still have to run.

rtc-bridge — TCP tunneling from a browser, explained is up. I wrote down the WebRTC signaling path, the node/coordinator/browser split, and the auth gap I think matters most before anyone uses it for sensitive services. I also compared it to my Tailscale + Caddy setup so the trade-offs stay concrete.

A friend built a tool that lets a browser reach local TCP services over WebRTC, no open ports, no install, no public IP required. I went down the rabbit hole understanding how it actually works.

A practical mental model for WebRTC: you build signaling, the browser handles ICE/DTLS/SRTP, and TURN is the fallback when direct paths fail.

A Parsec outage looked like DNS trouble at first, but the real issue was hostname-specific TLS failure on one network path. This post follows the investigation from misleading symptoms to the hotspot-based fix that exposed what was really happening.

Browsers failing while `ping`, `ssh`, and `dig` still work can point to a split macOS resolver failure. In this post, I break down how a Tailscale + Pi-hole setup triggered resolver state corruption and how resetting DNS settings immediately fixed it.

Most personal projects and homelab services don’t need to be public, but they do need to be reachable. I want to access my dev tools, internal dashboards, and side projects from anywhere, on any of my own devices, without opening ports, exposing IPs, or worrying about who might stumble across them on the internet.

This post walks through how I built an everywhere-accessible but publicly invisible ingress engine using Tailscale, Docker, Caddy, and DNS rewrites. The result is a private, domain-based setup that behaves like a small cloud. It has HTTPS, clean hostnames, and reverse proxying, but is only accessible to me, lives on my own machine, and never touches the public internet.

I spent the better half of today getting Umami analytics to cooperate with a static blog served through Cloudflare and an Nginx proxy. The tracking script was having issue in Safari (CORS) and Firefox (nothing showed up in the Developer Tools' Network tab).

This is the story of following the trail from mysterious redirects to CORS ghosts and finally to Firefox’s stealthy sendBeacon API.

Over the past few weeks, I’ve spent quite a bit of time experimenting with Tailscale, and it has quickly become one of my favorite tools.

If you haven’t heard of it, Tailscale is a secure, easy-to-use mesh VPN built on WireGuard. It lets your devices talk to each other as if they were on the same local network, no matter where in the world they are.

What started as a simple question — "Why can’t I reach my MacBook over Tailscale from my iPhone on mobile data?" — turned into a deep dive into NAT types, relay servers, and the hidden power of IPv6. This post documents the technical journey, the dead ends, and the final conclusion.

So the mystery: why do VPS connections work, but Mac connections fail?