I'm strongly considering adding another backup location in the form of an old Raspberry Pi and a USB HDD.

I want the Pi to exclusively use the available network to connect to my Wireguard Server, so other devices (local to the Wireguard Server and remote connected to the server) can use it as a secondary backup location.

I'm kind of worried about a scenario, where my network is compromised and, through the VPN connection of the Pi in the external network, the external network is as well.

What are the best practices to secure such a setup?

Currently, I have two VPN clients on most of my devices:

• One for connecting to a LAN
• One commercial VPN for privacy reasons

I usually stay connected to the commercial VPN on all my devices, unless I need to access something on that LAN.

This setup has a few drawbacks:

• Most commercial VPN providers have a limit on the number of simulations connected clients
• I either obfuscate my IP or am able to access resources on that LAN, including my Pi-Hole fur custom DNS-based blocking

One possible solution for this would be to route all internet traffic through a VPN client on the router in the LAN and figuring out how to still be able to at least have a port open for the VPN docker container allowing access to the LAN. But then the ability to split tunnel around that would be pretty hard to achieve.

I want to be able to connect to a VPN host container on the LAN, which in turn routes all internet traffic through another VPN client container while allowing LAN traffic, but still be able to split tunnel specific applications on my Android/Linux/iOS devices.

Basically this:

   +---------------------+ internet traffic   +--------------------+           
   |                     | remote LAN traffic |                    |           
   | Client              |------------------->|VPN Host Container  |           
   | (Android/iOS/Linux) |                    |in remote LAN       |           
   |                     |                    |                    |           
   +---------------------+                    +--------------------+           
                      |                         |     |                        
                      |       remote LAN traffic|     | internet traffic       
split tunneled traffic|                 |--------     |                        
                      |                 |             v                        
                      v                 |         +---------------------------+
  +---------------------+               v         |                           |
  | regular LAN or      |     +-----------+       | VPN Client Container      |
  | internet connection |     |remote LAN |       | connects to commercial VPN|
  +---------------------+     +-----------+       |                           |
                                                  |                           |
                                                  +---------------------------+

Any recommendations on how to achieve this, especially considering client apps for Android and iOS with the ability to split tunnel per application?

Update:

~~Got it by following this guide.~~

Ended up modifying this setup to have better control over potential IP leakage

cross-posted from: https://slrpnk.net/post/10823519

So I wrote a little web app that allows a user to move their user data, like settings and subscribed/banned communities, from one account/instance to another.

It runs completely client-side, but is hosted on GitHub for the moment. Maybe it'll be of some use!

Features:

• Don't trust me or GitHub? Clone the project and host it yourself or run it locally (Example in Wiki)
• Export user data from any Lemmy instance (>=v0.19)
• Download user data as a text file
• Modify user data, e.g. to add or remove followed users/communites (Example in Wiki)
  • "display_name" ​
  • "bio" ​
  • "avatar" ​
  • "banner" ​
  • "matrix_id" ​
  • "bot_account" ​
  • "settings" ​
  • "followed_communities" ​
  • "saved_posts" ​
  • "saved_comments" ​
  • "blocked_communities" ​
  • "blocked_users" ​
  • "blocked_instances"
• Transfer user data to the target account on the target instance

So I wrote a little web app that allows a user to move their user data, like settings and subscribed/banned communities, from one account/instance to another.

It runs completely client-side, but is hosted on GitHub for the moment. Maybe it'll be of some use!

Features:

• Export user data from any Lemmy instance (>=v0.19)
• Download user data as a text file
• Modify user data in the browser, e.g. to add or remove followed instances
• Transfer user data to the target account on the target instance

1. Install the Userscripts extension for Safari, open the app and go through the setup as instructed by the app. Don't forget to activate the extension for Safari.
2. After fully setting up the Userscripts extension, go to the TwitchAdSolutions git repo and click on userscript next to video-swap-new. You can play around with vaft as well, but video-swap-new works way better on iOS in my experience. This script replaces ads with a lower resolution stream.
3. Install the script by opening the Userscripts extension in Safari while the script you opened in step 2 is the active tab and clicking the Install button.
4. Go to twitch.tv and enjoy your ad-free experience.

Optional:

• When you have the Twitch App installed, Safari displays the annoying "open in App" Bar on top of the website. This also leaks into Fullscreen Mode. To get rid of it, uninstall the Twitch App and optionally install another extension to remove those Bars altogether, like Unsmartifier.
• Want 7TV/BTTV/FFZ features like Emotes or a customizable Twitch Experience? Install the FFZ userscript, reload twitch.tv and configure your experience and/or install Add-ons like 7TV Emotes by clicking the new icon top right.

Using reddit without an account is a pain nowadays, especially with any commercial VPN. There are ways around that:

Some of you may known the rather short-lived Libreddit, an awesome frontend for Reddit that got struck down by its success.

Redlib is a (still working) fork of Libreddit with a few instances. Due to reddits API Limits, it's not very practical to rely on one instance.

A quite elegant solution is the Automatic Redlib Quota & Error Redirector userscript. Once installed, most Redlib errors are automatically detected and your request gets redirected to another instance. This results in an excellent user experience, altough some instances can be a bit slow if you're trying to access media.

The list of available Redlib instances the script uses gets updated quite frequently. The script also works nicely with redirect plugins, e.g. this one for Firefox, if you want to automatically redirect all Reddit URLs to Redlib.