Practical guides to pfSense, WireGuard, IPv6 and self-hosting, written from configurations I actually built and ran — including the parts that broke.
Ghost returning 502 or "We'll be right back" every time you edit a post? The official Docker image ships without fontconfig, so any SVG in your content library segfaults libvips and takes the whole site down. Here's the diagnostic path and the two-line fix.
The most important pfSense spec isn't the CPU, it's the NIC. Plus why vendor throughput numbers overstate by 4x and AES-NI won't help your WireGuard.
Tailscale is WireGuard with a control plane on top. On pfSense there's a catch: FreeBSD can't run kernel mode, and it changes how packets are routed.
Self-hosted email, ten years in — the one real hurdle (port 25), the myths that aren't true, and the complete relay setup, hardened.
Guest and IoT VLANs on pfSense, actually isolated — firewall rules, dual-stack IPv6, and why to stop using 192.168.1.1.
Encrypt pfSense's DNS queries with DoT — setup, the DNSSEC tradeoff, and how to actually verify it's working, not just enabled.
A real multi-site WireGuard VPN on pfSense — hub-and-spoke, dual-stack, no NAT, and only the hub needs a static IP.
A complete dual-stack WireGuard VPN on pfSense — IPv6 included, both tunnel modes covered, and the firewall rules most guides leave out.
If you learned IPv6 subnetting by carrying over IPv4 habits, a few things break immediately. There’s no broadcast address, no “network address” burned out of every subnet, and the …
