Three things people call "a VPN" that operate at different layers. The cryptographic protocol differences between WireGuard and OpenVPN, why Tailscale is a control plane rather than a competing protocol, the NAT-traversal story for each, and an honest decision framework for which to actually run.
Networking & Security
-
WireGuard vs OpenVPN vs Tailscale -
HAProxy Deep Dive: Load Balancing, ACLs, and SSL Termination at Scale The HAProxy configuration DSL from first principles: frontends, backends, ACL-based routing, all load balancing algorithms, stick tables for rate limiting, SSL termination with automatic certificate renewal, the runtime API, and Prometheus observability — all without a sidecar.
-
Tailscale and the Zero-Trust Home Network How Tailscale works under the hood — WireGuard, NAT traversal, DERP relays, the coordination server — and a practical guide to subnet routing, exit nodes, Funnel, ACLs, and self-hosting with Headscale.
-
Tailscale: The WireGuard Mesh VPN That Actually Works Everywhere A deep technical guide to Tailscale: how the mesh VPN works under the hood, complete setup for every platform, subnet routing and exit nodes for homelab access, ACL policy files, MagicDNS, Tailscale Funnel and Serve, self-hosting the control plane with Headscale, and an honest comparison with WireGuard, ZeroTier, and Netbird.
-
Network Segmentation with VLANs: Isolating Traffic on Your Homelab and Beyond A practical guide to network segmentation using VLANs — how they work, configuring managed switches, setting up VLANs on pfSense/OPNsense, isolating IoT devices, creating a DMZ, inter-VLAN routing, and Linux trunk configuration.
-
pfSense and OPNsense: The Complete Home Lab Firewall Guide A comprehensive guide to pfSense and OPNsense — comparing the two platforms, choosing hardware, installing and configuring from scratch, setting up DHCP, DNS-over-TLS, firewall rules, NAT, VLANs, WireGuard, high availability with CARP, packages like pfBlockerNG and Suricata, and hardening your router/firewall for the home lab or small business.
-
SSH Hardening: Locking Down the Door Every Server Has Open A complete SSH hardening guide — key-based authentication, sshd configuration, ProxyJump, agent forwarding, SSH certificates, port knocking, two-factor auth, and auditing who can get in and what they can do.
-
WireGuard VPN: Fast, Modern, and Actually Understandable A complete WireGuard guide — how it works, server and peer setup, split tunneling, road warrior config for laptops and phones, site-to-site networking, key management, and troubleshooting.
-
Zero Trust Networking: Principles and Practical Tools A comprehensive guide to Zero Trust networking — the philosophy, core principles, and practical implementation using Tailscale and Cloudflare Access, including ACL configs, tunnel setup, and a homelab architecture that replaces legacy VPNs.