Ador AdroitAdorKhan

TL;DR: Default-Config Dual WAN PCC + Recursive Failover

This paste assumes a hardware MikroTik RouterBOARD with the standard MikroTik default config — hAP, hEX, RB5009-class, etc. — where ether1 is the WAN port and ether2 through etherN are LAN bridge ports. The paste removes ether2 from the LAN bridge and turns it into WAN2.

If your router is not in that default state — CHR, multi-WAN appliances, anything reconfigured, or anything where ether1 is not your WAN — read the full guide and substitute interface names. The lab report's §8.7 TL;DR validation shows the kind of remap CHR needs before this paste is safe.

Resulting layout after the paste:

WAN1 = ether1, DHCP

About

Instructions to obtain WireGuard details of your NordVPN account. These can be used to setup a WireGuard tunnel on your router to NordVPN.

Source: https://forum.gl-inet.com/t/configure-wireguard-client-to-connect-to-nordvpn-servers/10422/27

Prerequisites

If you have any linux machine, use that or install a vm if you don't have one.

Get their official linux app installed. Make sure you have wireguard installed too. And set the used technology to Nordlynx by running nordvpn set technology nordlynx

Protect your server with a strong iptables rules and ipset lists.

1. Install ipset to manage ipstables lists

apt install ipset

2. Install iptables-persistent to preserve iptables rules on reboot

Backup android app, data included, no root needed, with adb

Note: This gist may be outdated, thanks to all contributors in comments.

adb is the Android CLI tool with which you can interact with your android device, from your PC

You must enable developer mode (tap 7 times on the build version in parameters) and install adb on your PC.

Don't hesitate to read comments, there is useful tips, thanks guys for this !

7 simple-ish steps to green HTTPS on LAN with custom domain, Caddy, LetsEncrypt and Cloudflare. And a bonus tip!

Ever felt envious of those pretty green lock on sites like Github.com or Google.com? Ever wished to have one of those for services on your homelab? Well wish no more because I have a guide for you!

This guide is written for Ubuntu 16.04 server with domain registered on NameSilo and nameservers using Cloudflare. However it will work for any OS that Caddy supports (this includes Linux, Windows, macOS and many others on several architectures) and any other DNS provider with an API that Caddy supports.

What will you need:

$$ Domain
Cloudflare account, or account with other DNS provider with API listed in https://caddyserver.com/docs/automatic-https#enabling-the-dns-challenge
Basic understanding of DNS, server management and ability to RTFM

Root OnePlus5 without unlocking the bootloader

Gain adb root.

$ adb shell am start -n com.android.engineeringmode/.qualcomm.DiagEnabled --es "code" "angela"

Download Magisk-v14.0 and extract it somewhere. Download MagiskManager.

	deb https://ftp.debian.org/debian/ bookworm contrib main non-free non-free-firmware
	# deb-src https://ftp.debian.org/debian/ bookworm contrib main non-free non-free-firmware

	deb https://ftp.debian.org/debian/ bookworm-updates contrib main non-free non-free-firmware
	# deb-src https://ftp.debian.org/debian/ bookworm-updates contrib main non-free non-free-firmware

	deb https://ftp.debian.org/debian/ bookworm-proposed-updates contrib main non-free non-free-firmware
	# deb-src https://ftp.debian.org/debian/ bookworm-proposed-updates contrib main non-free non-free-firmware

	deb https://ftp.debian.org/debian/ bookworm-backports contrib main non-free non-free-firmware

	{
	/tool fetch url=https://curl.haxx.se/ca/cacert.pem
	/certificate import file-name=cacert.pem passphrase=””
	/ip firewall layer7-protocol
	add name=security.cloudflare-dns.com regexp=security.cloudflare-dns.com
	/ip dns
	set allow-remote-requests=yes cache-max-ttl=1h servers=1.1.1.2,1.0.0.2,2606:4700:4700::1112,2606:4700:4700::1002 use-doh-server=https://security.cloudflare-dns.com/dns-query verify-doh-cert=yes
	/ip firewall filter
	add action=drop chain=output comment="drop dns output if not looking for cloudflare DOH servers." dst-port=53 layer7-protocol=!security.cloudflare-dns.com out-interface-list=WAN protocol=tcp
	add action=drop chain=output comment="drop dns output if not looking for cloudflare DOH servers." dst-port=53 layer7-protocol=!security.cloudflare-dns.com out-interface-list=WAN protocol=udp

	sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y
	sudo apt -y install build-essential wget curl gcc make wget tzdata git libreadline-dev libncurses-dev libssl-dev zlib1g-dev

	sudo wget https://www.softether-download.com/files/softether/v4.41-9787-rtm-2023.03.14-tree/Linux/SoftEther_VPN_Server/64bit_-_Intel_x64_or_AMD64/softether-vpnserver-v4.41-9787-rtm-2023.03.14-linux-x64-64bit.tar.gz
	tar xzf softether-vpnserver-v4.41-9787-rtm-2023.03.14-linux-x64-64bit.tar.gz && rm softether-vpnserver-v4.41-9787-rtm-2023.03.14-linux-x64-64bit.tar.gz

	cd vpnserver && sudo make
	cd ..
	sudo mv vpnserver /usr/local && cd /usr/local/vpnserver/
	sudo chmod 600 *

	#!/bin/sh
	# This script will fetch the Googlevideo ad domains and append them to the Pi-hole block list.
	# Run this script daily with a cron job (don't forget to chmod +x)
	# More info here: https://discourse.pi-hole.net/t/how-do-i-block-ads-on-youtube/253/136

	# File to store the YT ad domains
	FILE=/etc/pihole/youtube.hosts

	# Fetch the list of domains, remove the ip's and save them
	curl 'https://api.hackertarget.com/hostsearch/?q=googlevideo.com' \