Networking on Dad's a Nerd!

pfSense Hardware Guide: What to Actually Buy

Thu, 13 Aug 2026 14:31:25 -0400

Short answer: for most homes, an Intel N100 mini PC with two or more Intel i226-V ports, 8 GB of RAM, and a small SSD handles a gigabit connection without effort and draws about as much power as a light bulb. If you’d rather not think about it, a Netgate appliance starts at $269 with pfSense Plus included.

The rest of this post is about the decisions underneath that answer — because the specification that matters most isn’t the CPU, and two of the numbers you’ll see quoted everywhere don’t mean what they appear to mean.

Tailscale vs. WireGuard on pfSense: Which Should You Run?

Wed, 12 Aug 2026 19:12:37 -0400

Short answer: run WireGuard on pfSense if you can open a UDP port, and add Tailscale if you’re behind CGNAT or need to hand access to people who won’t edit a config file. The encryption is identical — Tailscale is WireGuard with a control plane on top. The deciding factor on pfSense is that FreeBSD can’t run Tailscale’s kernel mode, so subnet routing and exit nodes go through a userspace stack, which changes how packets are forwarded and makes exit node duty noticeably slow.

Host Your Own Email: Why It's Not as Hard (or Dangerous) as You've Heard

Tue, 11 Aug 2026 21:53:01 -0400

Running your own email server has a reputation as one of the worst ideas in self-hosting — guaranteed to get blacklisted, buried in maintenance, and delivered straight to everyone’s spam folder. Most of that reputation is inherited secondhand, from people repeating what they read rather than what they ran. This post covers what’s actually true, what actually goes wrong, and how Mail-in-a-Box handles the parts that genuinely used to be hard.

DNS over TLS on pfSense: Encrypt Unbound's Upstream Queries

Tue, 11 Aug 2026 16:57:45 -0400

Every unencrypted DNS query leaves the network in plaintext — your ISP, and anyone else on the path, sees every domain being looked up, even if the site itself is HTTPS. DNS over TLS (DoT) encrypts that query between pfSense’s Unbound resolver and the upstream DNS provider, closing that specific gap. This is the resolver both WireGuard guides already point client DNS at — this post covers securing it.

What this does and doesn’t protect

	Covered by DoT	Not covered
ISP seeing which domains you look up	Yes	—
On-path DNS spoofing/tampering of the upstream query	Yes	—
Traffic content once a connection is made	—	No — DoT is DNS only, not a VPN
Which IPs you connect to (visible via the connection itself)	—	No — SNI/IP are still visible unless also using something like encrypted SNI or a VPN
Local, LAN-side query visibility (anyone on your LAN)	—	No — DoT only covers the pfSense-to-upstream leg

DoT vs. DoH — why this guide uses DoT

Unbound (pfSense’s resolver) has native, GUI-exposed support for DNS over TLS. It does not natively speak DNS over HTTPS (DoH) as a client — getting DoH would mean chaining Unbound to an external DoH-capable forwarder (e.g., cloudflared) running as a separate service, adding a moving part for no real security difference at the resolver level. DoT is the natural fit for pfSense’s built-in tooling; use it unless something specific requires DoH.

Multi-Site VPN on pfSense: Connect Multiple Locations with WireGuard (No Vendor Fees)

Tue, 11 Aug 2026 16:11:27 -0400

Connects multiple pfSense-routed locations into one routed, dual-stack (IPv4 + IPv6) network using WireGuard — a self-hosted multi-site VPN on pfSense in a hub-and-spoke topology. No NAT, no per-site static IP requirement, no recurring vendor fee.

Terminology note: the underlying technique here is a site-to-site VPN — a permanent, routed tunnel connecting two networks. “Multi-site” just means using that same technique more than once: a hub site runs a separate site-to-site tunnel to each additional location. Two sites is the base case (one tunnel, one peer on each end); three or more is that same setup repeated, with the hub acting as the common point. Nothing about the core configuration changes as sites are added — Step 2 through Step 5 are simply repeated per additional spoke.

pfSense WireGuard IPv6 Setup: Full Tunnel and Split Tunnel Guide

Mon, 10 Aug 2026 21:08:26 -0400

Setting up a home WireGuard VPN on pfSense gets you your own private, self-hosted VPN — no subscription, no third-party logging policy to trust, just your own router. This guide walks through a complete pfSense WireGuard setup with IPv6 covering both major connection modes (full tunnel and split tunnel), dual-stack IPv4 and IPv6 addressing, a stable hostname via Cloudflare Dynamic DNS, and the firewall/NAT rules that actually make traffic pass — not just handshake.

IPv6 Subnetting Explained: Full CIDR Prefix & Usable Range Reference

Wed, 05 Aug 2026 21:57:48 -0400

If you learned IPv6 subnetting by carrying over IPv4 habits, a few things break immediately. There’s no broadcast address, no “network address” burned out of every subnet, and the numbers involved are so large that thinking in individual host counts stops being useful past a certain point. This post is a practical IPv6 subnetting reference: what each CIDR prefix actually gives you, how to read the ranges, and a full table you can bookmark.