• 0 Posts
  • 192 Comments
Joined 2 years ago
cake
Cake day: December 14th, 2023

help-circle
  • BakedCatboy@lemmy.mltoSelfhosted@lemmy.worldWhat's gluetun?
    link
    fedilink
    English
    arrow-up
    12
    ·
    edit-2
    8 days ago

    I use gluetun to connect specific docker containers to a VPN without interfering with other networking, since it’s all self contained. It also has lots of providers built in which is convenient so you can just set the provider, your password, and your preferred region instead of needing to manually enter connection details manage lists of servers (it automatically updates it’s own cached server list from your provider, through the VPN connection itself)

    Another nice feature is that it supports scripts for port forwarding, which works out of the box for some providers. So it can automatically get the forwarded port and then execute a custom script to set that port in your torrent client, soulseek, or whatever.

    I could just use a wireguard or openvpn container, but this also makes it easy to hop between vpn providers just by swapping the connection details regardless of whether the providers only support wg or openvpn. Just makes it a little more universal.






  • FYI the codename for the Xiaomi Redmi Note 13 5G is “gold”. You’ll usually see stuff for your phone labeled with that codename since it’s much shorter and easier to check than the whole name where you have to check pro vs non-pro, 5G version, etc as other variants will have completely different codenames.

    If roms don’t have official support, then basically your other main option is to look for unofficial builds made by random people on XDA. I’ve used unofficial builds for many years in the past and they’re generally fine, but it’s up to you.

    I don’t see any rom threads in the XDA forum for gold, so unfortunately I can’t really help any more. Good luck!

    (Skimming around the XDA threads, it appears that the lack of roms is due to mediatek not releasing necessary source code, so if you want custom roms, it’ll be a lot easier to find them for a different phone)











  • If you search for pfsense alias script, you’ll find some examples on updating aliases from a script, so you’ll only need to write the part that gets the hostnames. Since it sounds like the hostnames are unpredictable, it might be hard as the only way to get them on the fly is to listen for what hostnames are being resolved by clients on the LAN, probably by hooking into unbound or whatever. If you can share what the service is it would make it easier to determine if there’s a shortcut, like the example I gave where all the subdomains are always in the same CIDR and if one of the hostnames is predictable (or if the subdomains are always in the same CIDR as the main domain for example, then you can have the script just look up the main domain’s cidr). Another possibly easier alternative would be to find an API that lets you search the certificate transparency logs for the main domain which would reveal all subdomains that have SSL certificates. You could then just load all those subdomains into the alias and let pfsense look up the IPs.

    I would investigate whether the IPs of each subdomain follow a pattern of a particular CIDR or unique ASN because reacting to DNS lookups in realtime will probably mean some lag between first request and the routing being updated, compared to a solution that’s able to proactively route all relevant CIDRs or all CIDRs assigned to an ASN.


  • I think the way people do it is by making a script that gets the hostnames and updates the alias, then just schedule it in pfsense. I’ve also seen ASN based routing using a script, but that’ll only work on large services that use their own AS. If the service is large enough, they might predictably use IPs from the same CIDR, so if you spend some time collecting the relevant IPs, you might find that even when the hostnames are new and random, they always go to the same pool of IPs, that’s the lazy way I did selective routing to GitHub since it was always the same subnet.