So I was looking for a way of reducing the amount of attacks on my main server. I thought there must be a way of GEO locating IP addresses and blocking, usually Russian attacks on my contact forms. And there is! It’s called pfBlocker, downloads new spam lists every night and seems currently, ‘just to work’. Will monitor for a few more days but first impressions are it works great, not a single hit on either mail or web server. I though there may be an issue with mail as if I drop the connection the sending server will then try and send via a backup server, but it looks like the backup server has a similar spam setup and also refuses the connection. Lets see how it gets on.

So fiddling with ACME trying to get it to add the backup route, but annoyingly as the backup is a dynamic IP address it doesn’t exist as an A or a CNAME record, it therefore doesn’t recognise the domain name, tried a few aliases and stuff but it really wasn’t having it. I have a feeling actually it’s the webroot on the firewall which is the issue rather than the domain name itself. Still, it’s working with the primary domain name and it’s a free certificate which should hopefully renew itself, so fairly happy days.

In other happy days I paid my corporation tax, was unable to issue my final dividend as I’m waiting on one savings interest payment. I did though do a complete financial planning spreadsheet, it makes interesting reading, actually it doesn’t, but the results are interesting. It’s certainly something I’m going to be very mindful of.

Meanwhile, I wonder if I can use that ACME thing to generate certificates for my main server….

Up fairly early and got on with it. Still on anti-alaising. There’s a couple of extra bits in it as well. One of them is ‘alpha to coverage’. Now normally when you do an alpha test on a pixel you just test it against a threshold and do a discard. But when you are doing multi-sampling you can do a bit better as you have multiple fragments to play with. So you can take the alpha value and then dither it, this gives a nice sort of faded effect which looks like alpha-blending but isn’t. The fun thing you can do in more modern hardware is actually specify which fragments to use in the actual pixel shader, so you can do your own dither patterns. Well that was the excitement of my day.

Walked the dogs, yes both went. Went to Spin, which after yesterdays car crash of a class was nice to get back to normal. Came back and worked far too hard. Upgraded pfSense, due to all this who ha on bloody SSL leaking. I need to re-key all my certificates next, that’ll be an exciting evening. Fitted new hard drive to iMac, that’s an extra 4TB there. The blu-ray recorder doesn’t seem to work though.

Time for cheese, may be wine, may be wine and cheese. (See, dithering again.)

This morning started with disappointment. I’ll blame it on a combination of too many pills.

Working on, well, basically testing lots of stuff really. Making sure everything all loads in all combinations, that sort of thing. Bloody horrible miserable day, weather wise.

I ventured out and did pump, appear to have injured my left wrist somehow.

Now I wanted to block a certain person from viewing this blog. Interesting challenge. I have one thing to my advantage, the user has an email account on one of my servers. So into Ubuntu, var/logs/mail.log look for user….ah yes, and found the IP address. Now into pfSense, add new rule, block pot 80 & 443 from said ip, and oh, lets log it for gloating purposes. Lovely, job done. Bath time.

So today started kind of late. May be at my grand old age of forty-one it’s just nice to stay in bed and spoon your husband and the dog. The radio was on in the background and I was kind of dozing. Mind you there is something to be said about getting a blow job while Richard Madeley is doing newspaper reviews. Elaine Paige came on, I then started singing ‘Mammaries’, rather than ‘Memories’ from ‘Cats’, while cupping Jamie’s rather pert titties, he was not amused.

I got up and picked up all the dog shit. I then had lunch. We decided as it was not pissing down that we would take the dog to the same field I did yesterday. It was actually very nice, we got to the top field and let her off her lead. She belted off but stayed mainly around us. We got her ball out and started chucking it around, she had a great time. Very well behaved, we had no problem calling her back and putting her lead on again, she was a really good girl.

Came back and got on with the sanding. Finished off all the coving, put some more filler on one one the cracked corners. Then actually rang out of work so put the door back on. Next job is the messy one, sanding all the walls, so I need to order a load of dust sheets. I’ll do that this week, in case next weekend is pants then I can get on with it. Want to do it in one hit really because of all the dust.

Ah yes, the network partitioning. Well I have servers mapped to one lot of IP’s, DHCP handing out a load of other addresses, plus all Jamie’s stuff was on fixed IP’s and now we have all the uPnp crap as well. It was time for a rethink. Now the servers are on a public IP starting at .136, I have a 8 IP range, so the mask is 29, leaving 3 bits in the subnet (so 8 IP’s, get-it?). So that goes from 136 to 143. So I now mapped the servers internally to 192.168.0.136->192.168.0.143 or in the rules table it will be 192.168.0.136/29. So that’s the servers covered. Now I want Jamie to be in his own subnet so I can throttle him to hell when he wears my socks, but I also need him to have a allocation that can use uPnp for the consoles. I also need an allocation for uPnp for my consoles. So I decided to have three subnets of 16 IP’s, but one of them overlapping a subnet of 32 IP’s for the uPnp. So I allocated 192.168.0.160 to 192.168.0.175 or in other words 192.168.0.160/28 to Jamie as uPnp, I then allocated 192.168.0.176/28 to me for uPnp. So the first bank I could add a rule to include the throttling for Jamie, the second bank was free. Also the first bank I set up to use Virgin and the second bank to use Zen, this is because I need me dev kits to talk on a white listed static IP. Now in the uPnp section of pfSense I then set it to 192.168.0.160/27, notice the 27, so this covers all 32 IP’s on one rule. I then finally added another subnet on 192.168.0.192/28 for Jamie’s non-consoles, this still has the throttling but not the uPnp, as that’s somewhat dangerous from a PC. Finally I then set up DHCP to hand out anything between .20 and .127, that then leaves me .1 to .19 as reserved and a block between .128 and . 135. Also I have a subnet .144 to .159 which I use for static IP’s for things like the web cam and the Sam Knows box. So there we go, all reorganised and now everything works, including all the consoles.

Time for a bath.