No worries, not sure how I misunderstood the question, but hopefully it helps someone else out who’s getting into self-hosting.

When you host something on LAN only you are not exposing the service to the wider internet directly.

This means someone would need access to your LAN or local area network first (such as your WiFi password) before being able to reach said service.

Now when you expose something directly to the internet, in a way that for example it displays a publicly accessible webpage, it makes it easier for anyone to reach that webpage, and potentially figure out your login and password information through brute force. Or some other type of exploit that allows full bypass of the login credentials.

Some self-hoster’s choose to keep their “more sensitive” services on the LAN only, and then use a VPN (that’s hosted privately) to access their LAN remotely from anywhere in the world.

With a VPN hosted on your LAN it provides a good layer of security as someone would first need to have access to your VPN to then potentially try and get access into your services.

As someone else said, you can more then likely use this as a Software-Defined Radio (SDR)

If you have a Home Assistant installation you can use a app like rtl_433 which would allow your smart home to receive local 433 MHz, 868 MHz, or 915 MHz signals from weather stations, temperature sensors, tire pressure monitors, and utility meters via an RTL-SDR USB dongle.

I have my rtl_433 picking up some neighborhood outdoor weather sensor in my area.

All these types of collisions stories always use phrases like, “the vehicle hit” or “the truck/car/motorcycle collided with”.

The finger point always somehow starts with the vehicle its self, never the operator behind the wheel, or anything to do with the surrounding infrastructure. It’s always as if the driver themselves never existed.

Glad I could help!

Correct. Your manual added torrents only.

But to be clear your downloads folder should ideally have subdirectories in it, or at least that’s what I have.

*Completed Downloads", with subdirectories for movies, series, audio, books, blackhole_movies, blackhole_series, and any other category you have.

In your download client you then make sure to set it up that all downloads get a category that then dumps the completed download into the corresponding folder.

So when a movie gets added by radarr its assigned a category of movies in your download client, and when it finishes downloading it goes to the completed/movies folder. And similar if a series gets added by sonarr a category of series gets assigned and moved to the completed/series folder.

Any torrent you add manually you would then assign either blackhole movies or series and your download client would then move it to that completed folder. Radarr would then see new files appear and try and import them as it regularly will now scan that blackhole folder.

What you are looking for is under Settings > Download Clients > Torrent Blackhole

This helps create a “blackhole” folder that is now monitored for any completed files. Radar or Sonarr will then try and import these files if the naming matches anything in your library that’s missing.

So in theory you can manually add torrents to your client which you can categorize in such a way that they move to this blackhole folder on completion.

Obviously the folder or category can be called anything, but I just call them blackhole_movies, blackhole_series.

I can take some of those off your hands arrh

That’s one strange cat you got there. Generally cats and tinfoil are mortal enemies. Kind of like cats and cucumbers.

Cats vs tinfoil, captured on video: https://www.youtube.com/watch?v=aa9HUgz-v4s

deleted by creator

And Canadians still get gouged with the most expensive mobile plans

Could you provide some more information on how you perform a vuln scan, or what services/softwares you use to perform the scan?

Lines F and E don’t exists in your diagram, all your VMs inside of Proxmox are accessible and sharing port eth3. Except Opensense, as its not bridged to eth3, but instead is assigned to the NIC card you have.

OPNSense inside Proxmox is the only VM that will see the NIC card and be the only VM that uses that NIC with those interfaces.

One interface would be for WAN in like you drew, and the other is the LAN port like on any other router. This LAN port needs to connect to a switch as this is where your OPENsence will communication with the rest of the home network and handout DHCP addresses. It’s also how you would reach your OPENsense GUI through a browser. (Outside of managing it within Proxmoxs GUI, accessible on eth3)

If your OpenSense VM goes down your home network won’t have a router which means no PCs would be able to communicate as they would have no DHCP addresses, so even if all your communication is “inside of Proxmox” your VM still would not get a DHCP addresses.

What you may want to do is use something like Tailscale (or a VPN) to connect the two sites (homes) together.

Run your Tailscale setup in home A, and then in home B connected to your tailnet. You can install Tailscale on the home router of home B, or install it on any device that needs to connect to home A.

Then in home B you just connect to your Jellyfin server like you normally would if you were in home A. This could be a android box or smart tv for example or accessing it through a browser on a pc. (If those devices have Tailscale installed and are connected to your tailnet in home A)

Using a VPN like Tailscale would also mean you don’t expose your Jellyfin to the internet.

Honestly I don’t know enough to answer that question fully.

From what I understand PCI addresses (01:00.0) are dynamically assigned by the motherboard’s BIOS at boot. Adding or removing PCIe devices, enabling M.2 drives, or adjusting BIOS settings often shifts your device addresses up or down which can prevent a VM from starting up.

Reading online though, there now seems to be a workaround to this issue. I might need to give it a shot on my Proxmox machine.

“PCI ID overrides” is the term in this document to search for.

https://pve.proxmox.com/wiki/PCI(e)_Passthrough

I have been running PfSense on Proxmox for ages now.

What I do is the following.

1. Pass the NIC card through to PfSense.
2. Your motherboards ethernet port is plugged into your network switch (think of proxmox as just another pc on your network)
3. In PfSense your NIC can now be seen and all ports can be assigned as needed. Assign one as WAN and the others as LAN.

Set your pfSense /OPNsense to start at boot when you power on proxmox.

FYI, you might occasionally run into issues where the NIC “GUID” changes so your VM won’t be able to start.

When this happens your pfSense/OPNsense VM won’t start so your network will be in a “down state”. This means DHCP won’t be working either, and any PC that were not assigned a static IP won’t be able to access the Proxmox GUI to quickly fix the issue.

You might occasionally need to hook up a temporary router between a PC and your Proxmox host to access the web GUI as a result. At least this is what I do when my outrage is longer then a hour.

The Democratic Church of America 👊🇺🇸🔥

Honestly edge of my seat the whole time.

What you are looking for is something called NAT Reflection/HairPin NAT/NAT loopback.

When you search for a “domain.example.com” your router loops you back at your reverse proxy and all the traffic remains “internal”. Your website will still be externally accessible (the ones you setup to be).

Here’s a example of how to set this up on PfSense router.

https://www.youtube.com/watch?v=ngwae1UvS-Q

Gering-ding-ding-ding-dingeringeding!