I have this and an Atari 800 in a tote waiting for the day I have somewhere to put them.

Enough people have already commented on the “proxy at the vps solution”. Another option is to configure routing and nat on the VPS and have it route over the wg tunnel.

Requires you to have postup/predown scripts that modify your routing tables on the wg endpoint.

I made the plunge about a year ago. Spectrum assigns me a prefix but routing was spotty at best. In the end after all the troubleshooting pointed to the problem being the ISP I gave up and stuck with what works, IPv4.

I mean, if you spent the kind of scratch on an android phone you would on an iPhone and then not fuck around with it, you’d have a similar experience on Android.

Years ago I used to flash roms and generally tinker until I decided I needed my phone to be stable and stopped. My Note 20 is polished and stable, no complaints.

My wife has always had iPhones. I’ve used both and find iOS frustrating. These days, unless you’re scraping the bottom of the barrel, it’s mostly about comfort and preference.

DDOS protection is going to depend on the VPS. But for most services you could spin up a pretty lean Debian vm running a proxy like nginx proxy manager and run that over the tunnel. Something like opnsense seems like overkill.

Burnout Paradise is going to stay in my all time hall of fame till I die.

That’s silly. Compare per sq ft, not sheet size. There’s no guaranteed sheet size. Same thing with toilet paper.

Still are if you don’t buy a select a size roll.

I gave it the old college try about 6 months ago. Found out how to send the req for a subnet to my ISP. Configured my opnsense. When it worked, it worked. But it would randomly stop routing regularly. After a lot of troubleshooting determined it was the isp and have up.

Maybe I’ll try again in another 6 months.

No. I have a monthly stipend but I don’t really take calls outside of teams.

Not everyone has a desk phone (much less a desk).

You do if you want to provide that as your “work” number. Unless you’re going to jump though VoIP hoops.

Tuesday

I just wanted to say I loved your analogy.

And even if you do everything 100% right, your emails will mostly get flagged as spam if not outright blocked anyway. Esp. if you’re using a residential IP.

Plus, the internal and external services are running on the same box. Is that where my real problem lies?

It’s one of them, yes.

If you want to limit exposure in the case of a compromise you need to put everything public facing in it’s own vlan that cannot initiate traffic into your lan.

Alternatively, I could have a reverse proxy in the DMZ only for the public service and another reverse proxy on the LAN for internal services.

I do exactly this now. Public facing services sit in a dmz vlan with a rev proxy. I almost did a 2 tiered dmz but decided it was overkill.

Private services sit on an inside vlan.

I agree with everything everyone else has said here but if you looking for the most basic solution it’s already in NPM. You can configure basic auth in an access list and apply it to the site.

Route 53 does. I’ve got a couple there now.

Redundancy is really important when it effects other people, IMO. Personally I use 2 piholes kept in sync with gravity-sync.