2025-08-27
The Problem with Certificates at Scale
In previous articles, we discussed that OpenVPN uses certificates for authentication. This method is reliable but has significant drawbacks:
- Inconvenience for users: Each user must manually receive and install their own certificate.
- Complex management: When an employee leaves, their certificate must be revoked, which requires extra steps.
- Lack of centralization: Each service that requires access has its own authorization system.
The solution to this problem is using a centralized identity provider such as Keycloak.
2025-08-26
VPN: Not Just an “On” Button
For many users, a VPN is simply an “On” button. However, when it comes to building your own secure tunnel, it’s important to understand its architecture. OpenVPN is based on two key ideas: the client-server model and Public Key Infrastructure (PKI).
The Client-Server Model
The concept is simple:
- Server — the entry point into your secure network. It constantly “listens” for incoming requests and is ready to accept connections.
- Client — your device (laptop, phone) that initiates the connection to the server.
Once the server and client “agree,” a secure tunnel is created between them, and all traffic passes through it.
2025-08-25
OpenVPN: A Time-Tested Standard
Introduction
In a world where the speed and simplicity of WireGuard have become the new standard, OpenVPN remains one of the most reliable and flexible VPN protocols. It works both on traditional computers and on networking equipment, providing cross-platform compatibility and a high level of security. However, to understand how to use it, it is important to distinguish between the protocol itself and its client applications.
2025-08-23
When Control Matters Most
Services like Tailscale and NetBird are convenient, but they rely on a third-party control server responsible for authentication, key distribution, and route exchange. For those who, for security or privacy reasons, don’t want to entrust this function to anyone, there are two paths: Headscale and “pure” WireGuard.
Headscale: Your Own Tailscale
Headscale is a fully open-source implementation of Tailscale’s control server. It allows you to deploy your own Tailscale alternative on a VPS or server while still using the official Tailscale clients.
2025-08-22
When Zero-config VPN Means More Than Just Tailscale
Although Tailscale has become the benchmark for simplicity, it’s not the only player in the Zero-config VPN field. ZeroTier and NetBird offer similar functionality but with important architectural and ideological differences.
ZeroTier: A Virtual Ethernet Switch
ZeroTier is one of the first and most well-known services implementing the mesh network concept. It works on the principle of a virtual local network. Instead of relying on the WireGuard protocol, ZeroTier uses its own protocol and creates a virtual L2 switch (Layer 2) that unites all devices into a single local network. Each device gets an IP address from a virtual subnet and can “see” other devices as if they were connected to the same physical switch.
2025-08-21
What is Tailscale?
Tailscale is a VPN service that positions itself as a Zero-config VPN. It uses the WireGuard protocol to create a secure mesh network between all your devices. The key difference from other solutions is its simplicity. Instead of manually configuring tunnels and managing keys, Tailscale does all the work for you. All you need to do is install the app on each device and sign in.
How does it work under the hood?
When you sign in, the Tailscale client connects to the Control Plane server. This server essentially acts as the “brain” of the network:
2025-08-20
Evolution of Remote Access
Traditional VPN services, which most of us are familiar with, work on the “hub-and-spoke” principle (star topology). This means that all traffic from the client to the protected network passes through a central server. This approach has drawbacks:
- Configuration complexity: Manual setup, port forwarding, and key management are required.
- Performance: All traffic, even between two remote clients, must go through the central server, which increases latency.
- Single point of failure: If the central server goes down, the entire network stops working.
A new concept — Zero-config VPN — solves these problems by using a mesh network architecture.
2025-08-18
Keenetic as a VPN Client: Network-Wide Protection
Why Use a Router-Level VPN Client?
Setting up a VPN client on every individual device can be tedious. Moreover, many devices (Smart TVs, gaming consoles, IoT gadgets) don’t even support VPN connections. Keenetic solves this problem by acting as a central VPN client for the entire network. This allows you to protect all devices with a single VPN connection, eliminating the need to install and configure software on each one.
2025-08-17
Keenetic as a VPN Server: Secure Remote Access
The Remote Access Problem
When you’re away from home or the office, accessing local resources — such as a network-attached storage (NAS), server, or smart devices — can be challenging. Opening ports to the public internet is unsafe. The solution is to create a secure VPN tunnel, allowing you to safely connect to your local network from anywhere in the world. Keenetic makes this task simple by offering powerful and flexible VPN server functionality right out of the box.
2025-08-15
Introduction: From Reactive Defense to Proactive Security
In 2025, attacks on servers are becoming increasingly sophisticated, and reactive measures (firewall, Fail2Ban, CrowdSec) are no longer enough. The modern DevSecOps approach requires proactive hardening—strengthening the system—to minimize the attack surface before public exploits appear.
Lynis remains one of the key open-source security auditing tools for Unix systems, but today it is crucial to complement it with integration into security standards frameworks (CIS, SCAP) and automation in CI/CD pipelines.