Some dingbat that occasionally builds neat stuff without breaking others. The person running this public-but-not-promoted instance because reasons.

  • 0 Posts
  • 150 Comments
Joined 5 months ago
cake
Cake day: September 26th, 2024

help-circle
  • Indeed they do use 11x but it’s still a possibility to cause issues. It’s entirely possible to manage a fleet of IPs across a net but it takes a solid plan organization plan. My company is big on the acquiring companies game where IP overlaps are a perpetual challenge when merging sites in and you need a mess of snat/dnat conversions to keep routing from getting in a knot.


  • While handy on a personal net, on a larger corporate net this isn’t practical and even adds a security risk. By having servers request leases you run the chance that someone gets into a segment, funds the ARP association for an IP/MAC combo and can take over a server’s spot simply by spoofing their own MAC to match at the time of lease renewal.

    In the post above about setting a static address in two spots that in itself isn’t required either. So long as there are no duplicates you would just set the static address on the end device, then the network will sort it out with ARP ‘who has’ requests in local segments, or routing in the case of distinct subnets.

    Edit: the duplicate I suppose could be referring to putting names into a DNS registry, in which case yes you would need that double entry, or just reference things by IP if the environment is small enough for it to be practical.














  • Like others said, self signed or internal only domains work. Really though for the minimal cost of generally less than $20/year you can make it a lot easier by just buying a domain.

    From a pure security stance it could be argued that a personally owned CA is more secure than any public one since it’s possible for others to create a trusted cert with a public entity. Cloudflare ends up doing that for any domains you register with them, but that’s really only an issue for things facing the web and using self signed certs will typically cause problems for any pre-compiled client apps you might use.



  • My two main boxes are split to be storage vs compute. The NAS box has a minimal CPU and a pile of 3.5 drives for the low cost storage and they hypervisor has all the CPU and fairly small storage.

    Basically the goal in my setup is all the working data is in one place and the handling in another with various snapshots and RAID mixed in to avoid the risk of “oh shit did I just…?” situations.

    So anything that could be called bulk data gets offloaded to the NAS directly via mounts and any cache/working data is held locally. If your lab space grows to a notable level over time eventually you need to consider disk I/O as part of the design and having the bulk data on another box let’s you effectively trade some network load in for disk load.