@pete-s yeah i guess im going to have to do that, it just bugs me that NGINX wont pass though the real IP

Completely defaultedChrome by deleting the entire Default folder. I only copied back the bookmarks file from there.

Other than starting to sign into my daily sites, I signed in for bookmark syncing….

Maybe in three months this won’t happen yet again.

However, all the concerns about licensing should raise red flags about your system. Yes, there are times that having something require licensing is okay or even desired. But you should always see it as a truly huge risk and one that you have to consider carefully. Licensing makes the most sense higher up the stack. For example, the application itself is the most likely object to justify licensing. The cabling is the least. Imagine how ridiculous it would be if your rack, desks, and cables required that you have a special license for each use!! It would be insane and you'd never stand for it (you might have to stand if your chair was licensed only to someone else's butt.)

Your hypervisor and operating system are closer to the cables, rack and desk than they are to the application in this way. These aren't components that you want to have at risk due to a need for licensing. Sometimes you have to, but it is rare and a "have to" would only be caused by an application and if an application puts you in that position for many companies that alone is a reason to question the viability of the developers behind said application.

At a minimum, something like ESXi introduces totally unwarranted complexity and risk and is something that can be quietly, transparently, removed and fixed during this process.

@mr-jones said in Help Sorting out a Firewall Issue:

@scottalanmiller Do you recommend any books that deep dive into this stuff? I know there's always google, but I feel like you would know of some really good reads.

It's been so long. Sadly I don't know a good one anymore. I am sure that there are lots, I just don't know which ones are good today.

@scottalanmiller No example output? 🙂

@garak0410 said in VPN Slowdowns - Anything I Can Do?:

We now have 6 people who work out of state. 4 in Texas, 1 in California and 1 in Maryland. They all have domain connected laptops that I pre-configure with our applications before they get them and they connect to our VPN via the build in VPN connector in Windows 10/11. Our VPN is provided by our Windows Server with port forwarding on our ISP provided Vigor firewall.

I understand issues like internet pipes and the "hops" it takes to get back to our office on VPN but we see some significant drops in speed. Some apps that require a lot of file transfers, are almost unusable.

Is there anything I can do on our end to aid in some speed increases? I'm also willing to spend money if we have to on software or a network appliance.

Thanks!

You should do some basic investigation so you know what you should expect.

For instance:

What is the speed in/out of your internet link to your VPN server? What traffic comes in/goes out over this link besides VPN traffic? Do you have any traffic shaping in the firewall?

It's very possible that low priority internet traffic, from clients in the office, is starving your VPN link of bandwidth.

@syko24 said in MeshCentral - Anyone tried this?:

@scottalanmiller said in MeshCentral - Anyone tried this?:

@pmoncho said in MeshCentral - Anyone tried this?:

@scottalanmiller

I misread that. Yeah only 140 agents.

Apparently I am far behind.

We use it pretty extensively 🙂

@scottalanmiller - Just curious are you still using Tactical or just Mesh these days? I've been playing around with Tactical internally and definitely a great solution. I know you mentioned a while back you were using that and Mesh separate from each other.

We use both. Tactical has been pretty good. Definitely use Mesh 90% of the time and Tactical just 10%. But it has been a good tool and we like it.

@dashrender said in Server 2012 R2 not installing Updates:

@scottalanmiller said in Server 2012 R2 not installing Updates:

@dashrender said in Server 2012 R2 not installing Updates:

Of course though - this thread is about Windows Server, not desktop - where this should be MUCH less of an issue with properly designed code.

Same code, they don't make it twice. Less hardware hotplugging, but probably just as many lines of code in use.

Less desktop apps on the platform, but you're right - the base code is the same.

Fewer desktop apps, maybe. But in the Windows world, server often is treated as a desktop (like 90% of the time) so the reduction is rarely what you'd hope. And there tends to be lots of server-only code too, often running as desktop apps.

@jt1001001 said in Reboot on ping loss:

https://www.amazon.com/dp/B0831T2DYV/ref=cm_sw_r_cp_api_glt_fabc_AVB60TSEZJDG854NV2HD

I use a product from Wattbox for this exact purpose on some comcast modems I use for POTs lines. https://www.snapav.com/shop/en/snapav/search/ip-power?krypto=5%2FcdcXS%2FV0TFwTz8d8FgC3vtSPg%2BpODS

@oliverparker said in Will faxes ever die - cheapest way to forward a DID:

It is very hard to say that whether they will die and remain out of the market. Such inventions are the ones which become the part of people everyday's routine. The Assignment Help UK Cheap services also have individuals in the team which produce the assignments after deep and thorough research to help the individuals lay the foundation for various inventions etc.

it may never die 100%, just like VHS and Betamax players are still out there and used by few.

Extenders aren't really the answer.

If you can't do real ethernet - I'd consider using ethernet over Power to get another or two wired level APs around that place.

You've mentioned that the construction is rather dense - you're halving the max bandwidth each time you setup an extender (half of max for a given extender, etc) - moving back to wired will bring about your best results.

@gjacobse said in free clone/imaging solution needed:

There are a few options and that aren't that difficult

CloneZilla
While Linux based - is not difficult to use, and if you follow the prompts (Read them unlike me) It's easy.

I use CloneZilla with CloneZilla SE (Server) to do this. Just make sure you can boot to PXE or leave a USB onsite for other people to stick in and power on.

Hint: With Wake-On-Lan and PXE we reimage PCs at schools all the time without ever going there. Takes only a few minutes to get a PC back up and running. 😀

Have you tried putting in the address?

@adamf said in Zerotier issues:

Weird

Not particularly weird at all. All services have outages, partial or full.

Could be anything. Redundancy doesn't prevent outages when the redundant nodes have a common failure mode - such as running the same software or being centrally automated by the same thing.

@pete-s said in ZeroTier & Security:

@scottalanmiller said in ZeroTier & Security:

@pete-s said in ZeroTier & Security:

@notverypunny

If you assume that being connected to an ZeroTier network is the same as having the host sitting directly on the internet, you'll be fine.

That is the basic premise of the zero trust security model - assuming that the network is hostile.

Ding ding, exactly. It's a connectivity tool, not a security tool. The security has to be provided normally. Any ZT provided security, is purely extra.

Yes, and when it comes to security ZeroTier, as any other VPN, shows up as a virtual network adapter. So you can apply the OS' firewall like you could on any network adapter.

And the ZeroTier network itself also has some limited L2 rules to control the traffic, similar to a switch. It lacks tcp sessions and other things though so it's not like a real router/firewall.

There is also the possibility to connect ZeroTier to a compatible firewall and not the host directly.

I'm running OPNSense at home and have the plugin working and connected to a client's PC's from my house.

Works great.

@dashrender said in Looking for a remote access solution:

@scottalanmiller said in Looking for a remote access solution:

@jaredbusch said in Looking for a remote access solution:

@dashrender said in Looking for a remote access solution:

@jaredbusch said in Looking for a remote access solution:

Put zerotier on the box in the DC and the user's box. restrict it to only RDP.

Done.

I really like this - sadly - our insurance policy requires MFA for remote access. I'll have to see if ZT has anything for that.

Then put the 2fa on the Windows RDP login with a service like Duo.
https://duo.com/docs/rdp
https://duo.com/editions-and-pricing/duo-free

Just use ZT to lower (all but remove) the attack surface.

That would get them up to 3FA (which isn't a bad thing) assuming ZT isn't somehow tied to some other authentication mechanism.

As it's been AGES since I've used ZT - can you make the user have to log into it each time they launch it? If yes - and it's logon isn't associated with AD (as you mentioned) then OK - I see how you consider ZT and RDP MFA.

The user can be forced to start or stop the process. The fact that it uses a key (something you have) owned by the user makes it MFA regardless of if they automate the login or force it to be manual.

Don't try to compare it to Duo or something like that which uses "something you have" to generate "something you know." Compare it to a security USB stick like YubiKey. It's a direct "something you have" 2FA in that sense.

@dashrender said in VDI Options - Modernization:

@scottalanmiller said in VDI Options - Modernization:

@pete-s said in VDI Options - Modernization:

@scottalanmiller said in VDI Options - Modernization:

@pete-s said in VDI Options - Modernization:

I'm not talking cached files here but client side databases and local storage as defined in html5. Another reason you might insert VDI into the chain.

Worth pointing out that this "should be" a configuration thing and not something you need heavy VDI to work around. But here in the real world, it isn't always configurable and VDI can be used to deal with that.

Yeah, it depends entirely on what the html/javascript code looks like. Which in most cases depends on what framework was used.

It was easier to keep track of the data when a html browser was as dumb as a vt100 terminal.

Wanna take bets that a new "HTML-lite" protocol surfaces that has modern GUI and graphical components, but none of the heavy data-handling components so that people can be confident that no data leaks beyond what is seen on the screen?

why did some move away from that model in the first place? to put the processing power onus on the end user?

Oh it makes TONS of sense. If you saw every day apps built both ways side by side you'd chose this "every" time. First, it saves the hosts and the ISPs tons of money because it shifts lots of processing power out to the end units where typically there is loads of excess power. Why do something in an expensive way when there is a free way waiting to be utilized?

Second, it makes websites a lot faster. I mean a LOT faster. It means you can do lightning fast calculations without waiting for long internet round trips, you can cache data, etc.

Third, you can work offline. People always complained that apps were unable to work offline. This is what allows things like email or document editing when you still lose your Internet connection, and what allows many things to keep working when your Internet might be flaky.

Thanks for the suggestions, help and talking it through...it is always something simple and overlooked.