2025–W06 #
I sorted the "cable too short" problem and have homed my Mini-ITX in a 2U rack-mount box which is nice. I think the first SATA connector is iffy though, but it came up again after a reboot. At least it's ZFS so if it does develop a problem then I'll know?
Also interested in dm-integrity with XFS as a more Linux-native way to get a good fs and also checksums (although not in one package).
I ported over my personal routing stuff from FRR to BIRD. FRR (well Quagga) is where I cut my teeth with BGP, and I came to it after exposure to Cisco iOS/Catalyst/PIX environments -- so its command language felt familiar. But I am not sure that it makes it good, and there's some annoying bugs in recent versions of FRR. Bugs are fine, but they are also really hard to debug because of the non-modularity of things (compared to something like BIRD -- which feels more like a toolkit language you can build a router out of).
At some point I'd like to do the same for AS401604/Colocataires.
Got more eBay networking gear for homelab reasons -- I'm learning about Clos networks and so I have a machine with 4x 1Gb links going to two "L3 switches" (these are actually PCs with a bunch of ports running Linux in my case, as I didn't have a spare five grand (each!) for Nvidia SS2201's). This, along with ECMP-vs-LACP and one other topic, are rattling around my head and need a much better, much longer write-up when I get the chance.
Learned some CSS grid things for my personal site (and I used a bit for Colocataires, but it was more misuse than anything). The snarky thing to say is that I can finally replicate the kinds of layouts that I could do in 2002 with tables, before everything went to CSS, but it really is great to not have to import someone else's whole framework just to be able to work on a grid again.
I set up NAT64 with Tayga -- a userland IPv6 to IPv4 mapper. You can combine with with a DNS64 server (or use Google's public DNS64) and then you can continue to access the IPv4-only Internet from IPv6-only clients.
What "year of" will it be first: Linux on the desktop or IPv6?
It looks like nftables are the new thing that I should move all my firewalling to. It looks fine although there's limited documentation. For now, I went back to iptables/ip6tables shims which take the input I'm familiar with and write the nft changes for me:
root@remote:~# ip6tables-save
# Generated by ip6tables-save v1.8.11 (nf_tables) on Fri Feb 7 18:20:09 2025
*filter
:INPUT ACCEPT [571:150495]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [38:8189]
-A INPUT -s 2602:f72c::/36 -j ACCEPT
-A INPUT -s 2001:470:1d:51::/64 -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp6-port-unreachable
COMMIT
# Completed on Fri Feb 7 18:20:09 2025
And:
root@remote:~# nft list ruleset ip6
# Warning: table ip6 filter is managed by iptables-nft, do not touch!
table ip6 filter {
chain INPUT {
type filter hook input priority filter; policy accept;
ip6 saddr 2602:f72c::/36 counter packets 0 bytes 0 accept
ip6 saddr 2001:470:1d:51::/64 counter packets 27 bytes 7093 accept
tcp flags & (fin | syn | rst | ack) == syn counter packets 0 bytes 0 reject
}
chain FORWARD {
type filter hook forward priority filter; policy accept;
}
chain OUTPUT {
type filter hook output priority filter; policy accept;
}
}