-
DNS is not a firewall: splitting Traefik into LAN and public
My internal services had no public DNS, yet anyone could reach them by sending the right Host header to my public IP. How I proved it over Tor, split Traefik into LAN and public entry points, and the two test mistakes I made.
-
NetworkPolicy gotchas: hostNetwork Traefik and Docker DNAT
A hostNetwork ingress shares the node IP with everything on the host, and Docker rewrites destinations before kube-router filters egress. What that broke on my k3s cluster, how a forged header created an admin, and how to write exact policies.
-
My dynamic DNS job got my home IP banned by the registrar
Polling GoDaddy's API every 5 minutes to keep an apex A record current got my home IP banned. How to diagnose an API ban, switch to change detection with zero calls on a stable day, and avoid two related DNS traps.
-
120 fake Googlebots, 9 real ones, and the week I banned Google
ASN checks let 77 fake Googlebots on Google Cloud through. How I verify crawlers with published IP ranges and forward-confirmed rDNS, ban impostor fleets, and how I accidentally banned the real Googlebot.
-
Running a Tor bridge at home without exposing the LAN
My Tor bridge was flagged Not Recommended because a five-week-old latest image aged out. How I run an obfs4 bridge and Snowflake proxy at home: isolated, limited, current and monitored.
-
Pi-hole blocked my own analytics, and other DNS filter surprises
I thought Google Analytics had banned me: my own Pi-hole was answering 0.0.0.0 for four Google domains. Three surprises from running a DNS filter for the whole LAN, and how to test around it.
-
Search Console said 'connection error'. My router had banned Googlebot
Search Console reported connection errors while my web logs showed nothing wrong: my router's auto-ban list had caught two genuine Googlebot addresses. How I found it, and how to allowlist verified crawlers safely.