• 1 Post
  • 234 Comments
Joined 1 year ago
cake
Cake day: June 4th, 2023

help-circle



  • A lot of absurdly long attack chains where it’s hard to read when you have an opening. Delayed attacks you have to memorize the timing for. Attacks where the enemy either dashes or stretches their model an absurd distance to hit you so it’s hard to get away from them or gauge distances.

    That’s also my main critique with Elden Ring. There’s so many spin to win enemies in the game that will just keep attacking for 10 seconds straight, it gets old so quickly.

    I miss the slow and methodical attacks from DS1 and to some extent DS3. DS3 was already a lot quicker than DS1 but most attacks were really well choreographed so I didn’t really mind. When an enemy pulled their sword back in DS3 you knew they were about to attack. In Elden Ring they will hold that sword back and hold and hold and hold and then after you rolled 3 times they hit you. It’s almost impossible to read an attack on the first try, which feels really unsatisfying.

    Not to say I don’t like Elden Ring, I do. But out of all From games it’s one of the weaker entries.





  • Domi@lemmy.secnd.metoSelfhosted@lemmy.worldHelp with IPv6
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    13 days ago

    Off the top of my head, why did you set the prefix to 0x1? I was under the impression that it only needs to be set if there are multiple vlans

    I have multiple VLANs, 0x1 is my LAN and 0x10 is my DMZ for example. I then get IP addresses abcd:abcd:a01::abcd in my LAN and abcd:abcd:a10::bcdf in my DMZ.

    However, I get a /56 from my ISP wich gets subnetted into /64. I heard it’s not ideal to subnet a /64 but you might want to double check what you really got.

    what are your rules for the WAN side of the firewall?

    Only IPv4 + IPv6 ICMP, the normal NAT rules for IPv4 and the same rules for IPv6 but as regular rule instead of NAT rule.

    My LAN interface is only getting an LLA so maybe it’s being blocked from communicating with the ISP router.

    If you enable DHCPv6 in your network your firewall should be the one to hand out IP addresses, your ISP assigns your OPNsense the prefix and your OPNsense then subnets them into smaller chunks for your internal networks.

    It is possible to do it without DHCPv6 but I didn’t read into it yet since DHCPv6 does exactly what I want it to do.


  • Domi@lemmy.secnd.metoSelfhosted@lemmy.worldHelp with IPv6
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    13 days ago

    I’m no expert on IPv6 but here’s how I did it on my OPNsense box:

    • Activate IPv6 on your WAN interface (probably already done)
    • Activate IPv6 on the LAN interface, use Track interface on IPv6, track the WAN interface and choose a prefix ID like 0x1
    • Activate DHCPv6 under Services -> ISC DHCPv6 for your LAN interface (you can shorten the range like ::eeee to ::ffff, you don’t have to type the full IP)
    • Activate Router advertisments under Services -> Router Advertisments for your LAN interface (set Advertisments to Managed and Priority to High

    After that your DHCP server should serve public IPv6 addresses inside of your prefix and clients should be able to connect to the internet.

    A few notes:

    • Don’t forget to add an allow rule for IPv6 on your LAN as well if you only have one for IPv4
    • Repeat the steps above for every VLAN you have, always use a different prefix ID
    • You don’t have to use NAT rules with IPv6 anymore and can just directly add a regular firewall rule to WAN with the target IP and port and you are done
    • Make sure you don’t have any of the various “Disable IPv6” toggles enabled, there’s a few in the firewall settings and general settings for example








  • This seems like common sense, no?

    Hindsight is 20/20. As seen in the post, there’s not that many APIs that don’t just blindly redirect HTTP to HTTPS since it’s sort of the default web server behaviour nowadays.

    Probably a non-issue in most cases since the URLs are usually set by developers but of course mistakes happen and it absolutely makes sense to not redirect HTTP for APIs and even invalidate any token used over HTTP.