Tutorial

In a previous article, I introduced a fairly straightforward chained VPN setup: all devices first connect to a self-hosted WireGuard server, and the server then forwards traffic to Gluetun, which finally sends it to the Internet through an upstream VPN provider. The core value of that setup was clear: Each device only needs to be configured with WireGuard once; The upstream VPN only needs to be maintained on the server side; Phones, computers, tablets, and home devices can all be connected to the same virtual LAN; The exit IP is provided by a commercial VPN, corporate VPN, or another upstream VPN, rather than directly exposing the VPS IP; The whole system can be deployed with Docker, minimizing pollution of the host environment; Compared with connecting directly to a VPN provider, the provider only sees the exit of your VPN gateway, namely your VPS server, instead of the real IP address of each individual device; In addition, your local ISP and similar parties cannot easily tell whether you are using a mainstream VPN service, because they can only see that you are connecting to a VPN gateway, namely your VPS server. Where the traffic eventually goes remains unknown to them. However, as my use cases expanded, the original structure gradually started to reveal some limitations. The most typical issue was that traffic control was not fine-grained enough. By default, all traffic had to enter the upstream VPN tunnel, which could trigger risk-control mechanisms or cause access problems for certain services. It was also not very convenient to perform traffic engineering and apply different exit strategies to different services. Although split routing could be achieved with iptables and routing tables, the rules became difficult to maintain once they grew in number. ...

In certain scenarios, we may need to set up a chained VPN structure: first connecting internal devices to a self-hosted WireGuard server (e.g., a personal VPS), then routing all traffic through that server to another VPN (a corporate, school, or commercial VPN service) before reaching the internet. Building this “VPN over VPN” network architecture offers the following clear advantages: Robust Privacy Protection: Internal devices’ data flows are first encrypted through a self-hosted WireGuard tunnel to your personal VPS. Then, the VPS forwards it again through a corporate or commercial VPN before finally exiting to the internet via that VPN’s IP address. This method completely avoids using the VPS’s own IP address to access target networks, greatly reducing the risk of your personal IP being tracked or leaked. ...

If you have installed Ubuntu and Windows and then reinstalled Windows. Then the Grub boot entry will most likely be overwritten by Windows Boot Manager and you won’t be able to enter Ubuntu at that time. But don’t panic, follow the steps below to fix grub2 boot without installing additional software. Creating a USB boot disk for Ubuntu In order to repair the boot entries, we need to use the software tools provided with the Ubuntu system. Although we can’t get into the original Ubuntu system for now, we can use the image written on the Ubuntu USB stick to get a working basic Ubuntu environment. Download the image file from the Ubuntu website. ...

When installing the zsh plugin zsh-autosuggestions or zsh-syntax-highlighting, we generally encounter the problem of oh-my-zsh plugin ‘xxx’ not found. Now, we analyze and solve the oh-my-zsh plugin ‘zsh-autosuggestions’ not found and plugin ‘zsh-syntax-highlighting’ not found problems. The reason for the problem is that the code repository of the plug-in has not been cloned to the local location, so the plug-in you want is not actually installed. Solving the problem is very simple, just simply enter the following command: ...