Yes. China’s great firewall mostly handles content filtering and deals with low hanging fruit. Getting around it is fairly simple, and the censorship is mostly focused on stuff that would otherwise be easily accessible by the broader population.

VPN is your obvious choice here. CCP blocks most public VPN providers, so you’d have to roll your own.

You can set up a VPN concentrator somewhere in the world, and you would be able to reach it. As far as I’ve noticed, they don’t block VPN as a whole, and default port should work fine - the reason for this is probably that VPN has many commercial uses that they don’t want to harm.

Source: I run a (work-related) VPN accessible from inside china.

I hear the API development for alpha centauri is pretty far behind its peer.

Note: I have not done any research on the topic, but I’m just theorizing based on what I already know, as it’s an interesting mental excersice.

Obviously the biggest problems will be uplink and power. Solar and a battery bank is the obvious choice, but other methods of powers can also work, such as a small generator in a river, etc.

Lead acid batteries are relatively cheap, and building a 12V bank out of car batteries makes sense as there is plenty of off the shelf hardware available to invert or transform 12V into whatever you need. Charging it from solar will be inefficient, but it will work, and there is also plenty of hardware for this (tip: boat-related shops can help you out here)

As for hosting hardware we’re of course dealing with the constraints of load vs power consumption. If you can go for something like a raspberry pi zero, you can run for days off of a single car battery with those cheap 5v cigarette-pkug chargers. If you need something more powerful, you need to scale up power accordingly.

As for uplink, the question is “How much” off grid we’re talking. I will assume that there’s at least GPRS coverage that you can connect to with a 4G modem, even if you don’t get 4G speeds. Plenty of off-the-shelf hardware available here. If not applicable, just substitute with whatever is available, be it CDMA, packet radio, starlink (eww), or anything else.

Any way of having this study an existing database (or dump thereof) and build the graph? I have an oracle database that nobody understands, built by someone else, and I thought something like this could help…

deleted by creator

Derp, yes. Corrected. VLAN numbers are obviously not related to port numbers in any way.

Yes, but that’s done on the switch. Basically VLAN tags are applied in one of two ways:

Untagged (sometimes called Access) is something you apply on a switch port. For example, if you assign a port to Untagged VLAN 32, anything connected to that port will only be able to see traffic assigned to VLAN 32.

Tagged (sometimesreferred to as Trunk), on the other hand, is for traffic that is already assigned a VLAN tag. For example Tagged 32 means that it will allow traffic that already has a VLAN tag of 32. It is possible to assign multiple VLANs to a Tagged port. Whatever is connected to that port will need to be able to talk to the associated VLAN(s).

In your particular case, the best practice would be to assign two ports (One for each host, obviously) to Untagged 32 (arbitrarily chosen number, any VLAN ID will do, as long as you’re consistent), and all the other ports as Untagged to a different VLAN ID. That way the switch will effectively contain two segments that cannot talk to each other.

As others have said: It will work as you’ve planned it. The subnetting will keep these two PCs separated (If they still need internet, just add a second IP in your router-PC to allow for communication with this subnet).

VLANs aren’t required, but are more relevant when you want to force network segregation based on individual ports. If you really want to, you can add tagged virtual interfaces on these two separated hosts so that the others hosts aren’t able to simply change the address to reach these. The switch should ignore the VLAN tag and pass it through anyway. But again, it’s not really needed, just something you can do if you really want to play with tagged VLAN interfaces

I use fail2ban and a non-standard SSH port. 99% of this junk disappears if you run sshd on port 9.

Also, disable password for login - Only use keys.

Any system beyond a vanilla install will need some tweaks to fit your use case(s). And these tweaks often end up as a stack of glass boxes over time, unless meticulously planned and purpose built from the beginning.

As long as it’s manageable and secure, don’t let “perfect” be the enemy of “operational”.

Wanting to rebuild from scratch is pretty common. The question is whether you need to and should. You have to weigh cost and work hours up against any benefits to figure out the answer.

No, just one. You set up one device/server as a VPN gateway (often called VPN concentrator), and you will have access to anything the concentrator has access to on your home network.

Either you use your VPN concentrator as your jump box, or you set up routing and firewalls to be able to access them directly.

I have no experience with OMV specifically, but generally making things accessible from outside your house means exposing it ti the internet.

However, what you can do is to only expose an openvpn port, so that to gain access as if you were at home you could connect via o0envpn first.

rsync if it’s a from/to I don’t need very often

More common transfer locations are done via NFS

DO NOT call the police. They will confiscate the server as evidence, and lacking any other suspect, you will be their primary lead. Police aren’t about convictions or justice, they want to consider a case solved.

By law, you are not liable. But because of law enforcement incentives, it will absolutely become your problem.

Good move. I have my home network and its home lab the same way I run my work networks and server clusters:

1. Management network over regular copper ethernet. This is what’s routed over VPN for remote access. IPMI also connects here for when something really stupid happens.
2. High speed fiber connecting all the servers. Not routed out - it’s only used for comms between the servers. This serves as a backup in case the management port dies. It has saved me a couple of times: shell in to one of the others the normal way, the from there I can jump into any other server via the fiber connection.

Now, that’s a name I haven’t heard in a long time…

After getting hooked on Metal Gear: Solid, without owning a Playstation, Bleem helped me get by.