Oh yeah, I 100% agree with that, honestly two VPNs are better given you wouldn’t want your normal VPN to terminate into your management vlan (nor should you want your management vlan to have access to the internet). I thought we were just discussing normal homelab stuff, all administrative stuff should really be oob.
Just by making it so I can’t access from a system I don’t control. Like say I need to retrieve a document from my house, but I’m in a SCIF, or a waiting room, or anywhere else I wouldn’t have my personal device, it’s super useful to just connect to something like Nextcloud and pull it down.
Hmm… Where I work setting up a VPN on my work machine would not only break my workflow, it would probably cost me my job. Plus I’m not a big fan of giving computers I don’t control access to the internals of my network. Reverse proxies were invented for a reason, no reason not to use one.
My homelab stuff I like to be able to access from places that take all my free time (like work), making things accessible is a bit of a requirement for me.
I’ve been using Authentik for a while now and absolutely love it. Is it perfect, no, but it’s an IdP completely under my control and that definitely makes up for some shortcomings here and there.
?? Which lines are you implying? It’s blaringly obvious what the goal is, I was merely remarking at the incompetence of the current administration and likelihood of them doing it very badly.
I just assumed it was because it lined up with them destroying the GUI, the new layout is the hot garbage that finally got my wife to opt for jellyfin.
Could you specify any of those issues? I ask because the only one I’m tracking allows unauthenticated playback, but only if they know the path to the file on the machine which is very easy to change from default.
Lol… With this administration? They’ll probably just report that they recieved 10x whatever the other party gets and brag about how big America must be to get more votes than citizens.
Anyone finding a vulnerability now should really be submitting it to a broker instead of the company. Brokers pay way more for good exploits than the big guys (Google/MS/Amazon/etc) and won’t just refuse to pay claiming you found an undocumented feature.
USB’s are another really big no-no where I work, and running a different OS on my work network would 100% throw a lot of flags in our SOC as it’s essentially plugging a rogue device into the network. In my understanding, a reverse proxy allows access to specific resources, if configured properly it only allows access to your DMZ.
VPNs allow you to become part of a virtual network (like one you aren’t physically connected to), frequently providing access as though you are directly connected to the whole network. I could set up a VPN to my DMZ I suppose, but that just feels weird as hell as the whole point of a DMZ is to be an area you allow the public internet to reach (sometimes requiring authenticating to the reverse proxy).