• Proper DNS resolution on modern Linux systems
• Change VPN route metrics to fix access when roaming between VPN and "local" network
• OpenVPN keys & certificates can be easily embedded into .ovpn file

script-security 2
up /etc/openvpn/update-systemd-resolved/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved/update …

Just a quick tip on setting up stunnel in transparent proxy mode (ie. target service sees original source IP address) pointing at services running on localhost. (mostly based on sslh documentation)

Use the following iptables/sysctl rules:

#!/bin/bash

set -e

# Set route_localnet = 1 on all interfaces so that ssl …

A little solution for properly encrypted HTTP traffic in semi-public networks.

Let's Encrypt, as everyone knows, offers publicly-recognized SSL certificates. Pretty much the only downside is, that these are only issued with validity period of 90 days. Default ACME challenge scheme (http-01) requires some HTTP server to be publicly accessible …