Building a Split-Tunneling Personal VPN Gateway: A Practical Setup with WireGuard, sing-box, and Gluetun

In a previous article, I introduced a fairly straightforward chained VPN setup: all devices first connect to a self-hosted WireGuard server, and the server then forwards traffic to Gluetun, which finally sends it to the Internet through an upstream VPN provider. The core value of that setup was clear: Each device only needs to be configured with WireGuard once; The upstream VPN only needs to be maintained on the server side; Phones, computers, tablets, and home devices can all be connected to the same virtual LAN; The exit IP is provided by a commercial VPN, corporate VPN, or another upstream VPN, rather than directly exposing the VPS IP; The whole system can be deployed with Docker, minimizing pollution of the host environment; Compared with connecting directly to a VPN provider, the provider only sees the exit of your VPN gateway, namely your VPS server, instead of the real IP address of each individual device; In addition, your local ISP and similar parties cannot easily tell whether you are using a mainstream VPN service, because they can only see that you are connecting to a VPN gateway, namely your VPS server. Where the traffic eventually goes remains unknown to them. However, as my use cases expanded, the original structure gradually started to reveal some limitations. The most typical issue was that traffic control was not fine-grained enough. By default, all traffic had to enter the upstream VPN tunnel, which could trigger risk-control mechanisms or cause access problems for certain services. It was also not very convenient to perform traffic engineering and apply different exit strategies to different services. Although split routing could be achieved with iptables and routing tables, the rules became difficult to maintain once they grew in number. ...

May 23, 2026

Long-Term Personal VPS Self-Hosting: Cleanliness and Security

I’ve been seriously working on personal self-hosting for about five or six years now. If I’m being precise, the point when I truly started managing my own VPS can be traced even further back. The original motivation was actually very simple: there were services I used every single day, such as a password manager, music streaming, note-taking, a personal website, code repositories, and so on. Given that, why not just deploy them myself? That way, the data stays in my own hands, and I’m no longer at the mercy of subscriptions and price increases from various platforms. ...

January 3, 2026

Running a “Vanilla” Mainline Kernel on Raspberry Pi 5: Full Workflow of Trimming, Cross-Compilation, and Deployment

Summary This article systematically documents how I turned a Raspberry Pi 5 into a minimal development and testing platform for the mainline Linux kernel (Vanilla Kernel) — including repository trimming strategies, custom kernel configuration, cross-compilation and automated deployment scripts, overlay removal techniques, and long-term synchronization with the mainline community. It’s aimed at geeks interested in the Linux mainline, ARM64 adaptation, kernel development, upstream contribution, or anyone who loves tinkering with the kernel. ...

June 14, 2025

Building a Personal Chained VPN Network: Efficient Privacy Protection, Unlimited Device Management, and Remote Access

In certain scenarios, we may need to set up a chained VPN structure: first connecting internal devices to a self-hosted WireGuard server (e.g., a personal VPS), then routing all traffic through that server to another VPN (a corporate, school, or commercial VPN service) before reaching the internet. Building this “VPN over VPN” network architecture offers the following clear advantages: Robust Privacy Protection: Internal devices’ data flows are first encrypted through a self-hosted WireGuard tunnel to your personal VPS. Then, the VPS forwards it again through a corporate or commercial VPN before finally exiting to the internet via that VPN’s IP address. This method completely avoids using the VPS’s own IP address to access target networks, greatly reducing the risk of your personal IP being tracked or leaked. ...

June 2, 2025

Fix grub2 boot UEFI after Ubuntu dual system reinstallation of Windows

If you have installed Ubuntu and Windows and then reinstalled Windows. Then the Grub boot entry will most likely be overwritten by Windows Boot Manager and you won’t be able to enter Ubuntu at that time. But don’t panic, follow the steps below to fix grub2 boot without installing additional software. Creating a USB boot disk for Ubuntu In order to repair the boot entries, we need to use the software tools provided with the Ubuntu system. Although we can’t get into the original Ubuntu system for now, we can use the image written on the Ubuntu USB stick to get a working basic Ubuntu environment. Download the image file from the Ubuntu website. ...

November 26, 2021

Implementation of a Hybrid Simulated Annealing Algorithm for Solving the Three-Dimensional Boxing Problem MATLAB

As I need to solve a three-dimensional packing problem in mathematical modeling, I have selected the paper “Hybrid Simulated Annealing Algorithm for Solving Three-Dimensional Packing Problems” published by Prof. Zhang Defu et al. in the Journal of Computing as the theoretical basis of the problem after searching. The abstract of the paper is as follows: A hybrid simulated annealing algorithm for efficiently solving the Three Dimensional Container Loading Problem 3D-CLP is proposed . The Three Dimensional Container Loading Problem (3D-CLP) requires loading a subset of a given set of boxes into a container such that the total volume of the loaded boxes is maximized. The hybrid simulated annealing algorithm presented in this paper is based on three important algorithms: (1) the composite block generation algorithm, which differs from the traditional algorithms in that the composite block proposed in this paper does not contain only a single type of crates, but can contain any type of crates under certain constraints. (2) Basic heuristic algorithm, which is based on block loading and can generate a placement scheme according to a specified loading sequence. (3) Simulated annealing algorithm, based on composite block generation and basic heuristic algorithm, encodes the loading sequence as a feasible placement scheme, and searches the encoding space using simulated annealing algorithm to find the approximate optimal solution of the problem. The algorithm is tested using 1,500 weakly and strongly heterogeneous data for the packing problem. Experimental results show that the fill rate of the hybrid simulated annealing algorithm exceeds that of the best known algorithms. ...

September 30, 2021

Solve the problem of oh-my-zsh plugin 'zsh-autosuggestions' not found and plugin 'zsh-syntax-highlighting' not found

When installing the zsh plugin zsh-autosuggestions or zsh-syntax-highlighting, we generally encounter the problem of oh-my-zsh plugin ‘xxx’ not found. Now, we analyze and solve the oh-my-zsh plugin ‘zsh-autosuggestions’ not found and plugin ‘zsh-syntax-highlighting’ not found problems. The reason for the problem is that the code repository of the plug-in has not been cloned to the local location, so the plug-in you want is not actually installed. Solving the problem is very simple, just simply enter the following command: ...

May 25, 2021