[1]: https://du.nkel.dev/blog/2021-11-19_pfsense_opnsense_ipsec_c...
Useless in modern days though. IP addresses with anything backed by any cloud/CDN can vanish whenever they want, you'll always need to keep track of the upstream DNS responses.
That's extra fun if you do site-to-site-VPNs with a major customer. Won't name names, but they do have a habit of going through IP renumbering sprees every year or two and it's a true pain to keep the routing table, Zerotrust provider config and firewall rulesets in sync.
Do you remember the name of the product?
PC Engines APU2, AMD x86_64, 4-core, 4GiB, 3x Gigabit Ethernet, 3 x mini PCIe, SIM slot, USB 3, Serial, SATA ports. Mine has dual band WiFi in one mPCIe, SSD in another.
Turris Mox, Marvel aarch64. This can expand via plug and go via a range of extension modules. I've got one with 25 Gigabit (3 x 8-port modules) Ethernet, 1 x SFP, 5 x USB3, Wifi, Serial.
Regulatory compliance shouldn't be hard. The idea is to quell negative externalities, not to shut off innovation itself.
> Because of unbelievably bureaucratic recycling regulations, PC Engines will NOT sell directly to end users within the EU.
https://pcengines.ch/order.htm
> EU - a single market ?
> Far from it, there are separate registration and recycling schemes for each of the 28+ EU member jurisdictions (and even a few of their provinces). What part of COMMON MARKET was so hard to understand for EU lawmakers ? Since there is no single registration available, and separate registration would involve mindboggling complexity, bureaucracy and costs, we do not sell to EU end users until the EU gets their act together. Please order from EU based distributors, or as a business customer.
> Business customers are expected to meet their obligations by registering in the EU countries they sell in.
Switzerland is not part of the EU in this timeline... But their rant sounds very much like an excuse, the WEEE is in effect at least since 2021:
"All EU Member States are required to adopt the Waste Electrical and Electronic Equipment (WEEE) Directive 2012/19/EU, which sets rules for the collection, treatment, and recycling of electronic waste. However, some countries were granted an extension until August 2021 to meet the collection targets due to infrastructure limitations, including Bulgaria, Czechia, Latvia, Lithuania, Hungary, Malta, Poland, Romania, Slovenia, and Slovakia" - courtesy Google AI overview
Btw, that's an awful website. I like simple minimalistic websites, but some people confuse "simple" with "give literally 0 fucks about the reader" and then I have 50-word long lines to read on my 32" monitor. Just put something like {max-width: 1200px; margin: 0 auto;} on the body at least.
And if they don't, the "recycling" company will do it.
Reuse is dead.
I'm running OPNSense on a GMKtec G9 (a N150-based NUC with dual 2.5Gbps NICs), and a cheap managed switch. All-in, you can get it today for well under $300. Even that is rather overpowered for running my house.
The toughest component to pin down was a mesh wifi system that supports tagging VLAN segments. That's almost exclusively enterprise territory, so it's hard to find something affordable.
For what it's worth, what I settled on is EnGenius's FitXpress products. But I'm not necessarily recommending that, I'm a bit ambivalent to it. Within its normal operational envelope it works well, but its range is far lesser than the TP-Link device I replaced, and rebooting one of the WAPs in the mesh takes seemingly forever (like, 10 minutes!).
https://www.friendlyelec.com/index.php?route=product/product...
2GB Pi5 maxes out the 1Gb port.
From the last couple of weeks of researching some stuff, it makes perfect sense - I keep stumbling across blogs and documentation that uses Imgur, and it's really quite annoying that I can't see the screenshot or image that is being referenced. It hasn't /quite/ hit the point to put something in place, but this is super helpful for the final straw - when it comes!
This simple block is relatively trivial to bypass - but if they disappear tomorrow, a lot of things break.
Tale as old as time, long-running forums are graveyards of dead Photobucket, Tinypic and Imageshack embeds. Imgur has lasted longer than most but the cycle will probably repeat eventually, especially since they were acquired by faceless corpos a few years ago.
They did a big data purge years ago, and were already enshittified almost a decade before that.
government censorship
called it for what it is
https://www.bbc.com/news/articles/c4gzxv5gy3qo
If you follow the links to earlier articles you get to this one about fining TikTok: https://www.bbc.com/news/uk-65175902
"There are laws in place to make sure our children are as safe in the digital world as they are in the physical world. TikTok did not abide by those laws." ... "When you sign up you can be targeted for advertising, you can be profiled, your data contributes to an algorithm which feeds content," said the Information Commissioner.
So even before the OSA, the idea was: social media sites using algorithmic feeds must prevent children's access, and just asking "are you over 13" isn't enough. That's a demand for age verification, in practice.
that made multiple forums I've been on rush to download everything to their servers
Which means that we'll all have to run our own VPNs, possibly masquerading as HTTPS traffic, if that remains viable against government interference (eg. they might ask to re-encrypt all traffic by ISP-level certs, and block any traffic unreadable by them).
Internet as we know it is fading away.
also, if foreign servers notice no real loss of traffic because people just circumvent draconian censorship measures from authoritarian regimes, then they can more safely ignore them without real repercussions
the EU seems to be following soon, so it's important that people have readily available tools so the power dynamics change and it doesn't become economically unfeasible to refuse censorship pressures
Reddit is worse… you can’t even view someone’s profile if they’ve ever submitted a post labeled NSFW.
Honestly you could probably even use the 0 cost back charge that visa has, which is used by some finance services to verify that you are who you say you are through the visa connection to your national digital identity.
No, we won't. Tech doesn't care about users. We saw this when Valve delisted thousands of games in Germany instead of implementing the (completely anonymous) age verification process we've had built into our ID cards for years.
Instructions using the unifi mobile app as it’s what I have to hand:
1) download wireguard conf file from vpn provider. On mobile app settings -> vpn client -> add new -> wireguard. Upload the file and save it
2) settings -> policy engine -> policy based routes. New. Select what to route -> specific traffic. Source = all devices. destination = domain name. Here add any domains you like. Interface = add the vpn you added in step 1
I ended up making a long list of firewall rules to block specific sites IPv6 ranges, which worked until I hit cloudflare backed sites.
I’m really hoping UniFi start supporting IPv6 WireGuard soon.
{"data":{"error":"Imgur is temporarily over capacity. Please try again later."},"success":false,"status":403}
Is there a way to install a VPN such that requests to/from certain domains (e.g. imgur.com) are routed via the VPN and the rest of your traffic is via non-VPN?
This would solve the problem of constantly having to dis/re connect VPN, and do it in an automatic fashion (i.e. without the manual steps of first recognising there's an unavailable asset on the page, opening VPN app, switching it on etc).
Such a configuration would also be very useful in other situations, e.g:
- using social media in countries that require age-verification
- using apps that geoblock (e.g. spotify blocks my subscription every few days because it detects a change in country, but what it's really detecting is simply whether or not my VPN happens to be on/off)
- accessing sites which are blocked (e.g. Thailand blocks common UK news sites which have said unflattering things about Thai royalty).
For example, the equivalent in Tailscale would be an "App Connector":
https://tailscale.com/kb/1342/app-connectors-setup#add-a-cus...
E.g. I'd definitely pay $10/month for an app that lets me input domains and which country to re-route traffic through.
E.g. a handful of social media apps via US (my country has age verification), a handful of news sites via UK (some countries I travel to block them entirely), spotify via a single country (I don't care which one, so long as it's constant).
I currently use ProtonVPN iPhone and macOS apps but AFAIK it routes all traffic through a single country which requires opening the app and manually changing it each time you want traffic routed via a different country.
Extremely keen to hear any solutions people have used on their own devices.
That domain could constantly resolve to different IPs, requiring updates to the routing rules, and those IPs could be shared with many other domain names that the user didn't list (for example Cloudflare IPs). So the mapping isn't clean and you're likely to miss some IPs some of the time or incorrectly intercept some traffic that the user didn't want to route through the VPN.
A proxy would not have this problem, it gets to inspect the request and hostname and then decide how to reach that host.
You don't have to. You create a container which runs openvpn to connect to your vpn provider, and also hosts an ssh daemon. The ssh daemon receives incoming SOCKS5 connections from a firefox portable browser, which has been configured to use the proxy (your Docker openvpn-container) for browsing and DNS resolution, and pipes it through the VPN tunnel.
So you have that one browser just to surf imgur. if that's your thing. And you could also use Firefox on Android (maybe also iOS) with those proxy settings (a secondary Firefox browser, like the beta version).
So you get very high control about what you are using the VPN for, you don't just pipe your entire OS's network traffic through the VPN.
You can default route domains through a VPN using a Firefox tab container, you don’t need a separate browser instance running!
> I wanted something cleaner: a solution that works for every device on my network, automatically, without any client-side configuration.
Doesn't solve the real problem, being fails of imgur embedded it many others you surf.
Also, Imgur blocks many VPN IPs. I use Mullvad and I have not yet found a single Mullvad IP that can access Imgur.
To anyone that wants to follow this article, it's more general guidance than an actual tutorial, there's a lot of holes to figure out.
It also doesn't work when directly accessing imgur, even if you add rules for the domain and the other subdomains they use, which is annoying.
I've thought about doing something similar as well! It drives me nuts this ban, everywhere I look I see these blocked images. I thought about making a chrome extension that proxies.
I haven't needed to do this since I move to the US, but IIRC the rules were based on IP subnets.
The approach in TFA is more sophisticated and fine-grained.
From Italy (no VPN) I've been getting «{"data":{"error":"Imgur is temporarily over capacity. Please try again later."},"success":false,"status":403}» for any imgur url for maybe an year
The route rule would route out a VPN instead of the main route.
If the domain name resolves to many IPs you can keep an address list up to date using a simple script.
I'm sorry but suggesting buying and setting up hardware as an easier and more accessible alternative to a purely software-based solution that will take at most a couple of hours to install is simply ridiculous.
Way to exaggerate to make a point much?
A mikrotik router can be purchased as low as $24.95 and it will not only provide you with an enterprise grade router, it will also provide you with the functionality I mentioned above.
The point of my comment was that it can be done at the router level, instead of requiring the user to run and maintain Pi-hole, Traefik, Gluetun, Nginx, and the server required to run these apps/containers.
Also browsing Minecraft mods/shaders was my motivation ha.
Install the Wireguard packages, create a connection to your VPN of choice in a nearby country (I chose Sweden). Then I used the "vpn-policy-routing" package to route Imgur IPs (199.232.196.193 199.232.192.193) through the VPN.
Works for websites that keep nagging you for age verification too.
But seriously, it's been more emotional than I'd expected to get my cat memes back.
Also fastly-hosted services are a bit awkard to configure IP ranges to cover whole blocks as they seem to not use normal CIDR-blocks for different customers.
But you use PBR's ntfset functionality to have your dns server automatically update a set whenever an DNS entry is resolved, then set the policy rules based on the set.
Unless you vpn back to your house, but then again, now you are using double vpn!
The government announced "plans to fine Imgur after probing its approach to age checks and use of children's personal data" in September 2025 [1]
Are you telling me those were unrelated? How are you going to fine a website over age checks without the law that requires age checks?
I guess you could be saying that the regulators were carrying out legal duties like blind automatons, without giving a thought to the way their requirements would have to be met.
It's an entirely different piece of regulation to the "horror" of the OSA.
It's not hard - you're not allowed to target adverts for children - if Imgur aren't able to agree to that, they are within their rights to decide they don't want to properly safeguard the private information of children and withdraw from the market. That many other providers haven't thrown their toys out of the pram and complied with the law would show they decided if they can't tailor ads to children they wouldn't be able to turn a profit in the UK.
As others have mentioned, Ofcom is responsible for enforcement of the OSA - but the investigation against Imgur was carried out by the ICO.
I just set up a similar system (Debian LXC permanently connected to a VPN, nginx proxying imgur.com and all its subdomains with the rest being dropped), and it works quite well. Setting DNS records for imgur.com and {api,i,s}.imgur.com seems to be sufficient to get the site and inline images working (not 100% if all are needed - I haven't fully tested it yet).
This is true, and I learned to hate every bit of this fact. It taught me to despise hotlinking with passion.
All of those links are now down the train, and you have to pray that someone not only backed up the specific image you're looking for, but that they did so in a discoverable way.
Haha. You mean like Meta, Google, Apple and Microsoft ? If EU really cared about children, those companies would not be doing business in the EU.
Now I’m not allowed to say “key detail”??
Angry AI-phobic keyboard warriors on the internet don't decide what's right or wrong, or what you're allowed to do.
(Is this very comment AI-generated? Make your guess. Good luck!)
We could all have disclaimers or identifiable 'stickers' such as what we had in the olden days of IE6, to send people over to Firefox/Chrome/whatever.
However, next time the tech bros scrape the web, their AI beasts could learn the trick, to decorate their piffling output with similar disclaimers.
In the olden days, 'the camera never lied', however, nowadays, 'the camera always lies'. Even if it is not AI, you know it has been staged and Photoshopped to within an inch of its pixels.
So, what to do?
One way would be to have 'guilds'. Maybe tie it into academic institutions, where teaching staff are at the sharp end of AI use and exacting penalties for AI abuse. Imagine if there was a 'guild of human writers' and being in it meant better SEO with the consequence of abusing AI meaning getting kicked out of the guild.
Ultimately though, without any 'guild system', it all comes down to quality content.
Seems the author forgot one step.
Of course, it is true that it is being supported by the current government, however the only way a future government could have avoided the law coming into force would be to repeal it with a new act of parliament (because it was already enacted).
Polling shows around 70% supported it, though far fewer thought it would be effective. Pretty much matches my views on it.
I mean, it's basically a police state.
I am in the UK.
archive.org is not blocked — not the Library or the Wayback Machine.
ETA: I just checked re: the comment toomuchtodo linked to, and it actually is blocked by default on my mobile phone as adult content, because I've never bothered to disable the adult content lock on that device. I get redirected to a page operated by my mobile network where I can undo the lock by giving them info; I might do that one day, might not.
For non-UK users: UK mobile phone providers all block adult content by default at the account level as a simple parental control measure, and have done for some time, largely because PAYG data is really rather cheap here.
Interesting but not particularly bothersome. Apparently this decision is about eleven years old.
I'm with "1p Mobile" now who are a virtual network on EE, and their adult content block is just a toggle in your online account, with no faffing around required - you can just hit the toggle. I presume the idea is that you don't give little Timmy the password to his own account portal, but I don't know what's to stop him getting his own SIM by himself.
With Three, I found the adult content block caused other problems with SSH connections dropping, various random stuff getting blocked and so on, which all went away as soon as I had it disabled, so it's worth doing even for non porn fans.
Well — perhaps the toggle is only available if the account has been topped up with a credit card?
One thing that distinguishes you getting a SIM and Little Timmy getting a SIM is that you're over the age of majority and can enter into credit contracts, whereas Little Timmy can only get a debit card.
This fact is actually central to one of Ofcom's recommended age verification techniques, though the adult block on mobile phone networks is much older than these recent measures.
it isn't
https://www.privateinternetaccess.com/blog/internet-archive-...
archive.org is blocked (along with other nsfw type sites), but as the last post in your link to an earlier discussion says, I could get it unblocked by filling in a declaration that I'm over 18. Paying by credit card isn't enough to unblock automatically for this particular package.
I've chosen not to unblock for no particular reason. The block sort of makes sense to me because archive.org records a lot of Web sites, some of which may have what is regarded as adult content, and it is unreasonable to expect archive.org to label individual records of sites according to the criteria the UK uses (each country probably has its own set of criteria e.g. gambling Web sites of certain kinds in the US).
archive.org is easily accessible in the UK from most wifi connections in cafes, libraries and, hilariously, colleges (where people under 18 gather in large numbers), and also from domestic adsl or fibre Internet connections.
That's something to do with your provider. Maybe you need a non-crappy provider.
You do not need to provide any kind of declaration that you're over 18 to access archive.org in the UK.
Given that you can buy a SIM that'll give you a couple of hundred GB of data for under a tenner, it seems reasonable that they'd block stuff you didn't want young children getting access to (easily).
Source: am British, on phone.
This is what routers are for. My router (a cheap fanless box with several network ports running linux) is the only thing on my network that knows there's a VPN. I can selectively route whatever I want through it, including having a separate SSID/VLAN from which everything is routed through the VPN. It's wireguard based so there's no "installing a VPN", just an interface/network configured in systemd-networkd (once, on the router).
Edit: Routing by domain name could be tricky, though. I haven't had a need for that, and a proxy with local DNS override (as in the article) might needed if it came to that. I'd still do it on the router, though.