• 0 Posts
  • 36 Comments
Joined 2 years ago
cake
Cake day: June 9th, 2023

help-circle




  • Gotta disagree, for home use at least. I have found it to be the opposite of a nightmare.

    Moving my home routing and firewall to a VM saved me hours, and hours, and hours of time in the long run. I have a pretty complex home network and firewall setup with multiple public IPs, multiple outbound gateways, and multiple inbound and outbound VPN setups for various purposes. I’m also one of those loons that does outbound firewall with deny by default on my network, except the isolated guest VLAN. With a complex setup like that, being in a VM means it’s so easy to tweak stuff safely and roll back if you mess something up or it just doesn’t work the way you expected. Turns what would be a long outage rebuilding from scratch into a 30 second outage while you roll back the VM. And being able to snapshot your setup for backup is incredibly useful when your software doesn’t behave properly (looking at you, PFsense).

    All that said, I run redundant, synced hypervisors which takes care of a lot of the risk. A person who is not well versed in hypervisor management might not be a good fit for this setup, but if you have any kind of experience with VM management (or want to), I think it’s the way to go.


  • I’ve been doing it for probably 8 years now without any major issues related to being a VM. In fact, that made recovery extremely easy the two times my PFsense VM shot itself in the head. Just load the backup of the VM taken the day before and off to the races. After switching to OPNsense a couple years ago I haven’t had a single issue.

    These days I run two identically spec’d hypervisors that constantly sync all my VMs to each other over 10GB NICs, so even a hardware failure won’t take out my routing. That is something to consider if you don’t have redundant hypervisors. Not really any different than if your physical router died, just something to plan for.


  • In the last 25 years working with approximately 700 servers that used RAID 5 I saw two of them lose an entire volume. Once was due to a malfunctioning HP RAID controller, and the other was due to a second disk dying while the rebuild from the first failure was still ongoing. There turned out to be a systemic problem with that drive model’s firmware which almost certainly contributed.

    So in my experience it’s rare but it definitely does happen.

    It can get worse. About 20 years ago the company I was at had an EMC tech yank the wrong power supply from a Symmetrix rack, where the other supply had earlier in the day caught fire! We lost that entire rack’s data (customer’s personal email accounts) due to data corruption. It was probably around 300 10k SCSI disks in that rack, a multimillion dollar expense at the time, and we had to restore all of it from tape over many, many days. Really, really sucked.










  • The only one I haven’t seen mentioned here that is a requirement for me is OPNsense. I’ve been using it for a couple years, and pfSense before that for a very long time. Never going back to commercial routers and their shitty / buggy / backdoored software. I highly recommend OPNsense over pfSense for the UI improvements alone, but there are other reasons to use/support OPNsense over pfSense.

    On my network it handles internet firewall, internal firewall, and all routing across 5 VLANs and between two internet gateways. It does 1-1 NAT for my public IPs, inbound VPN, outbound VPN for my *arr stack, and RDNS blocklists with the data source being a script I wrote that merges from several sources and deduplicates the list. It is my internal certificate authority (I don’t miss you at all, Windows CA), DHCP for the guest wifi, and does pihole-like ad blocking via DNS for my entire network. And it does all that running in a VM with 2GB of RAM, of which it only uses about 60% on my install.

    It is an incredibly powerful tool, not terribly difficult to learn, has a pretty damn good UI for FOSS, and in my opinion is a fantastic foundation for a complex home network / homelab. Unlike pfSense, which corrupted itself twice over the years I ran it, it has never let me down. And every update has been painless over the years.


  • They are making Cloud Microsoft sysadmins, as opposed to on-premises sysadmins. Which means the new crop of admins are just high tier application admins, and have no idea how to manage infrastructure, configure hardware, or actually troubleshoot problems with the application, since they don’t have access to it at that level. All of this makes businesses more and more reliant on the cloud, which is exactly what these providers want.


  • These companies are so short sighted. They are destroying the ability for the people who might push this software for use in a business environment to use it at home, test it out, learn it. This depletes the pool of experts and supporters that would expand their product’s use over time.

    Microsoft and VMware are the worst offenders at the moment. I feel if you’re a competent on-premises Microsoft sysadmin you’ll have work for the rest of your life, because they aren’t MAKING on-premises Microsoft sysadmins anymore.

    *edited my last sentence for clarity


  • It’s bursty; I tend to do a lot of work on stuff when I do a hardware upgrade, but otherwise it’s set it and forget it for the most part. The only servers I pay any significant attention to in terms of frequent maintenance and security checks are the MTAs in the DMZ for my email. Nothing else is exposed to the internet for inbound traffic except a game server VM that’s segregated (credential-wise and network-wise) from everything else, so if it does get compromised it would be a very minimal danger to the rest of my network. Everything either has automated updates, or for servers I want more control over I manually update them when the mood strikes me or a big vulnerability that affects my software hits the news.

    TL;DR If you averaged it over a year, I maybe spend 30-60 minutes a week on self hosting maintenance tasks for 4 physical servers and about 20 VM’s.


  • OPNsense all the way. I run it in a VM. I ran PFsense for years then finally went through the pain of migrating. It was worth it for the UI improvements alone. PFsense also corrupted itself twice in about 4-5 years of running it, requiring restores from VM snapshots. OPNsense has been rock solid but it’s only been 2 years since I migrated.

    I have used openwrt but only for a WiFi AP, not as a real router. I’ve since moved to a Unifi AP which works fine, but I won’t buy their stuff again for other reasons.