UniFi VPN Management#

1 OpenVPN#

1.1 Client Profile#

The verified iPhone client uses OpenVPN Connect with these settings:

• Profile name: marcoue.ddns.net [OpenVPN Server]
• Server hostname: marcoue.ddns.net
• Username: marcoue
• Password: Saved in the OpenVPN client; do not document it here.
• DDNS provider: No-IP (ddns.net)

The profile uses the hostname rather than a fixed IP, so the iPhone profile normally does not need to be edited when the ISP address changes.

The OpenVPN listening port and the exact UniFi port-forward rule were not captured in the available documentation. Verify those values in the UniFi Network application if the VPN still fails after DNS is corrected.

Proxmox - Wake-on-LAN (WOL) Monitoring & Sniffer#

This guide outlines a persistent, lightweight background service for monitoring and logging Wake-on-LAN (WOL) Magic Packets on the Proxmox network. The payload is retained so the target MAC can be identified even when a server has multiple NICs or alternate MAC addresses.

2026-08-03 Antigravity chat: agy –conversation=3b2d07f7-d649-4fed-9976-8f0deadf60f9

1. Overview & Purpose#

• Primary Target: HP3 (10.1.1.13), documented MAC ec:b1:d7:7c:a9:48
• Additional Targets: Any WOL target visible on the monitored segment, including HP2 (94:57:a5:65:7e:88)
• Capture Host: MMProxmox / MacMini (10.1.1.10)
• Capture Interface: bond0 (active-backup bond; nic1 currently active)
• Objective: Capture the source IP, source Ethernet MAC, timestamp, VLAN, and WOL payload target MAC.
• Resource Overhead: Near zero (~1 MB RAM, 0% CPU overhead).

2. Systemd Service Specification#

The sniffer uses tcpdump running as a background systemd daemon. It listens on the physical uplink (bond0) for UDP port 9/7 and raw Ethernet WOL traffic, retaining the complete packet payload in /var/log/wol_sniffer.log.

Pangolin Tunnel Setup Guide#

Current VPS and SSH Access (Verified 2026-08-12)#

The current Pangolin VPS is hosted by RackNerd:

• VPS hostname: RN-VPS
• VPS public IP: 72.11.147.220
• Operating system: Ubuntu
• SSH port: TCP 22
• Current home public IP: 208.96.219.86 (may change when the ISP address changes)

SSH access is restricted by multiple layers:

1. UFW: incoming traffic is denied by default; TCP port 22 is allowed only from the current home public IP.
2. Fail2ban: the sshd jail has the current home public IP in ignoreip, so it is not accidentally banned. The value must also be present persistently in /etc/fail2ban/jail.local.
3. CrowdSec: the Pangolin container can enforce decisions through the Ubuntu host firewall via the INPUT and DOCKER-USER iptables chains.

The backup LXC connects outbound to the VPS. It does not require an inbound connection from the VPS to the home network. If the ISP IP changes, update both UFW and Fail2ban before the next backup.

Pi-hole Installation & High Availability Guide#

1. Basic Installation#

Documentation: Pi-hole Official Install

Deployment#

# Automated install script
curl -sSL [https://install.pi-hole.net](https://install.pi-hole.net) | bash

Password Management#

Save the password provided at the end of the installation.

# To change or reset the web interface password:
pihole setpassword
# Alternative:
pihole -a -p

Network Integration (UniFi)#

1. Go to UniFi Network App > Internet > [Your WAN/LAN].
2. Change DNS Server to your Pi-hole IP.

2. Synchronization (Multi-Instance)#

For Pi-hole Version 6#

Use Nebula Sync for v6 compatibility.

Tailscale Installation & Subnet Routing Guide#

1. Proxmox LXC Container Preparation#

If you are installing Tailscale inside an LXC container, you must allow TUN device access from the Proxmox host.

Modify Container Config#

On the Proxmox host, edit the configuration file for the specific container (e.g., ID 119):

nano /etc/pve/lxc/119.conf

Add these lines to the bottom:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file

Reboot the container:

pct reboot 119

2. Installation by OS#

Debian 12 (Bookworm)#

curl -fsSL [https://pkgs.tailscale.com/stable/debian/bookworm.noarmor.gpg](https://pkgs.tailscale.com/stable/debian/bookworm.noarmor.gpg) | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
curl -fsSL [https://pkgs.tailscale.com/stable/debian/bookworm.tailscale-keyring.list](https://pkgs.tailscale.com/stable/debian/bookworm.tailscale-keyring.list) | sudo tee /etc/apt/sources.list.d/tailscale.list
apt update && apt install tailscale -y

Ubuntu 24.04 (Noble)#

curl -fsSL [https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg](https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg) | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
curl -fsSL [https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list](https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list) | sudo tee /etc/apt/sources.list.d/tailscale.list
apt update && apt install tailscale -y

Ubiquiti UDM-SE#

# Install the latest version of Tailscale UDM
curl -sSLq https://raw.github.com/SierraSoftworks/tailscale-udm/main/install.sh | sh

3. Subnet Router & Exit Node Setup#

Enable IP Forwarding#

This is required if you want this node to act as a bridge to your local network.

UniFi Device SSH Configuration#

This guide covers hardening and configuring SSH access for UniFi consoles (UDM-SE, UNVR, UNAS-Pro) and management of secondary devices like Switches and Access Points.

1. Console Configuration (UDM-SE, UNVR, UNAS-Pro)#

SSH Key Setup#

1. Edit the authorized keys file to add your public keys:

nano .ssh/authorized_keys

# Restart the service
systemctl restart sshd

Install Tailscale#

For complete subnet advertising (10.1.0.0/16), exit node setup, and route approval guidelines, see the Tailscale Guide.

Wake-on-LAN (WOL) Configuration & Inventory#

This guide covers how to enable, persist, and verify Wake-on-LAN (WOL) across Linux nodes and Proxmox hosts, followed by a comprehensive MAC address inventory for the local and remote clusters.

1. Verification & Manual Activation#

Check WOL Support#

Use ethtool to check if your network interface supports the “Magic Packet” (designated by the letter g).

# Replace eno5 with your actual interface name
ethtool eno5 | grep Wake-on

Output Interpretation: