Tag: Final

If you are upgrading from Arista Edge Firewall 7.0.0 to 7.1.1 and your system uses Realtek Ethernet devices, you may encounter a critical issue: Linux Ethernet drivers trigger kernel panics when Energy-Efficient Ethernet (EEE) is enabled. This guide walks you through every step to apply the official Arista patch and complete a clean installation to resolve the problem permanently.

Why This Happens

Energy-Efficient Ethernet (EEE) is a power-saving feature built into many network adapters. Unfortunately, certain Realtek Ethernet drivers in Linux — as used by the Arista Edge Firewall — are incompatible with EEE, causing the system to crash with a kernel panic during or after the upgrade. The fix is to disable EEE toggling before installation using an official patch provided by Arista.

Step 1: Download the Required Patch Files

Visit the official Arista wiki page and download the two patch scripts needed to disable EEE on Realtek devices:

Arista Wiki: Patch – Disable EEE Toggle

The two files you will need are:

• eee-ignore-realtek-patch.sh
• late_command.sh

Step 2: Create a Bootable USB Drive

Use Rufus (or a similar tool) to burn the Arista Edge Firewall 7.1.1 ISO to a USB drive and make it bootable. Once the USB drive is ready, open it in File Explorer and navigate to the simple-CDD folder.

Step 3: Copy and Extract the Patch Files

Paste the two downloaded patch files — eee-ignore-realtek-patch.sh and late_command.sh — directly into the simple-CDD folder on the USB drive. If they are compressed, extract them first so the scripts are available as plain .sh files in that directory before proceeding.

Step 4: Boot and Perform a Fresh Installation

Plug the prepared USB drive into your firewall appliance and boot from it to begin a fresh installation of Arista Edge Firewall 7.1.1. The patch scripts will automatically disable EEE toggling for Realtek Ethernet devices during the installation process, preventing the kernel panic from occurring.

Important: Keep EEE Disabled Going Forward

Once the installation is complete, do not re-enable Energy-Efficient Ethernet on your Realtek network interfaces. Doing so will cause the system to crash again. To verify that EEE remains disabled after installation, run the following command in the firewall’s Linux shell, replacing eth0 with your actual interface name:

ethtool --show-eee eth0

Confirm that the output shows EEE as disabled. If it is not, consult the official Arista wiki page for additional remediation steps.

Summary

Upgrading to Arista Edge Firewall 7.1.1 on systems with Realtek Ethernet devices requires one small but critical preparation step: patching the installer to disable Energy-Efficient Ethernet. By downloading the official Arista patch scripts, placing them in the simple-CDD folder on your bootable USB, and performing a fresh install, you can complete the upgrade successfully without kernel panics. If you run into any issues, consult the official Arista wiki page for the latest guidance.

I recently migrated all of my Google Drive data to my own self-hosted Nextcloud server—and I haven’t looked back. Now, I have complete control over my personal data. Everything is stored securely on my own hardware, rather than on third-party platforms like Google Drive, OneDrive, or iCloud. Many of these services charge ever-increasing monthly fees, even for basic file storage, and they can restrict or terminate your access at any time without warning.

Why I Chose Nextcloud

Nextcloud is a powerful, open-source cloud platform that puts privacy and control firmly in your hands. By self-hosting Nextcloud, I can store, organize, and manage all my files without depending on big tech companies. There are no surprise price hikes, no data mining, and no risk of losing access to my own files if an account gets flagged or suspended. For anyone serious about data privacy and digital independence, Nextcloud is one of the best Google Drive alternatives available today.

All-in-One Productivity

One of the biggest advantages of Nextcloud is its rich ecosystem of built-in apps. I installed an integrated office suite (powered by Collabora or OnlyOffice), which lets me create and edit documents, spreadsheets, and presentations directly inside Nextcloud—no third-party subscription required. I also use Nextcloud Talk for secure messaging, audio calls, and team collaboration. Having file storage, document editing, and communication all in one self-hosted platform has dramatically simplified my workflow and keeps everything organized in a single, secure location.

How You Can Do It Too

Ready to set up your own self-hosted cloud server? The best place to start is the official Nextcloud installation guide, which walks you through every step of the process.

Personally, I use Cloudron to manage my setup. Cloudron makes deploying Nextcloud incredibly simple by offering it as a pre-packaged, one-click app. It handles updates, backups, and security automatically, making it an excellent choice for those who want a stable, low-maintenance self-hosted solution without deep Linux expertise.

All of my data is now fully under my control. I’ve eliminated recurring payments to Google, and everything—from photos and documents to team communication—lives in one secure, private cloud that I own and operate.

Apps I’m Running on My Nextcloud Instance

• Files & Memories — Photo Management
• Office Suite — Document & Spreadsheet Editing
• Nextcloud Talk — Messaging & Video Calls
• App Marketplace — Hundreds of Add-On Apps

If you’re thinking about making the switch from Google Drive to a self-hosted Nextcloud server, feel free to reach out or explore the links above. The process is more approachable than you might expect—and the long-term benefits to your privacy and wallet are well worth it.

Here’s a look at my setup in action:

Server security is something I take seriously. I recently upgraded my entire network protection setup by deploying a dedicated hardware firewall using a BOSGAME E1 Mini PC. This compact machine handles multi-server firewall duties with ease, and I also installed WireGuard VPN directly on the firewall to allow secure remote access from a single, whitelisted IP address — effectively eliminating the risk of SSH brute-force attacks and unauthorized intrusions.

The firewall provides comprehensive protection against hacking, malware, ransomware, and phishing attempts. It also includes a built-in phishing blocker and spam blocker specifically configured for our email server — a significant advantage for business operations. The bandwidth control feature allows me to prioritize traffic and maintain consistent server performance, even during peak usage.

Speed Test Results: With and Without WireGuard VPN

A common concern when routing traffic through a mini PC firewall is whether the hardware can sustain real-world internet speeds. Here are my side-by-side speed test results.

With WireGuard VPN Enabled

Without VPN

I am very pleased with these results. The server location runs on a Comcast Business plan delivering 600 Mbps download and 200 Mbps upload. My home connection runs on Xfinity at 300 Mbps download and 35 Mbps upload. The BOSGAME Mini PC handles the VPN tunnel, firewall rules, and all additional security features without any measurable performance degradation. Upload speed is more than sufficient for remote access needs, and the web hosting environment is now significantly more secure.

Firewall Hardware Specifications

Below is a full breakdown of the BOSGAME E1 Mini PC I am using as a dedicated firewall appliance. Its small form factor makes it a perfect fit inside a locked network cabinet, keeping all critical hardware secure and organized.

I also switched from a full-size desktop PC to this compact mini PC specifically because it fits neatly inside a network cabinet, keeping everything tidy, secure, and out of the way.

Final Thoughts

Overall, this hardware firewall setup using the BOSGAME E1 Mini PC has been a game changer for our server security. If you are looking for an affordable, low-power, and capable mini PC firewall solution that supports WireGuard VPN, phishing and spam blocking, bandwidth management, and multi-server protection, this is a solid option worth serious consideration.

I finally got DNS-over-HTTPS (DoH) working with Cloudron AdGuard Home. The key issue is that AdGuard Home will not accept connections on the encrypted DNS port until you add an IP address or Client ID to the Allowed Clients list. In this guide I use a Client ID. Follow the steps below to configure DoH on your TP-Link Omada controller with AdGuard Home as your upstream DNS resolver.

What Are Client IDs?

AdGuard Home supports Client IDs as a way to identify devices or services that are allowed to use its encrypted DNS endpoints. DNS-over-HTTPS is especially useful on internal networks when you already hold a wildcard TLS certificate, because every client can reach the resolver over a secure, authenticated channel.

Step 1 — Add a Client ID in AdGuard Home

Open AdGuard Home and sign in to your admin account. Navigate to Settings → DNS Settings and locate the Allowed Clients field. Enter the Client ID you want to use for your Omada controller — in this example the ID is laketapp (a nickname for the store). Click Save when finished.

Step 2 — Log In to the TP-Link Omada Controller

Open the TP-Link Omada Controller web GUI and log in with your admin credentials. Select the site (location) where you want to enable DNS-over-HTTPS.

Step 3 — Navigate to Services → DNS Proxy

In the left-hand navigation panel, click Services, then select DNS Proxy. Enable the DNS Proxy toggle, choose DoH (DNS-over-HTTPS) as the protocol, and enter your AdGuard Home DoH server URL. In this example the URL is:

https://laketapp.dns195.richardapplegate.io

The Client ID (laketapp) is embedded in the subdomain, which is how AdGuard Home identifies and authorises the request.

Step 4 — Verify Queries Are Reaching AdGuard Home

Return to the AdGuard Home dashboard and open the Query Log. You should immediately see queries appearing from your Omada router, confirming that all DNS traffic is now flowing through AdGuard Home over an encrypted DoH connection.

Your TP-Link Omada router is now communicating with your self-hosted AdGuard Home DNS server over an encrypted, authenticated DoH connection.

Fail2Ban is a free Python tool that helps protect Linux servers from brute-force attacks. It’s especially useful for securing SSH. With Fail2Ban, you can automatically block IPs that try to guess passwords on your server.

Why Use Fail2Ban for SSH Protection?

Brute-force attacks can cause thousands of failed login attempts every day. If your server uses password-based logins, you need a way to block attackers. Fail2Ban watches your log files and blocks any IP that tries—and fails—too many times.

Step 1: Update Your Ubuntu Server

First, make sure your system is up to date:

sudo apt update && sudo apt upgrade

Step 2: Install Fail2Ban

Install Fail2Ban using apt:

sudo apt-get install fail2ban

Enable Fail2Ban to start automatically:

sudo systemctl enable fail2ban.service

Step 3: Configure SSH Protection

Do not edit the default config file!
Instead, create a new file for your custom settings:

sudo nano /etc/fail2ban/jail.local

Add these lines to protect your SSH server:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
findtime = 300
bantime = 3600
ignoreip = 127.0.0.1

What these settings mean:

• enabled: Turns on protection for SSH
• maxretry: Blocks an IP after 3 failed logins
• findtime: Looks for failed attempts in a 5-minute window (300 seconds)
• bantime: Blocks the IP for 1 hour (3600 seconds)
• ignoreip: Never blocks your own server

Step 4: Restart Fail2Ban

Apply your new settings by restarting Fail2Ban:

sudo systemctl restart fail2ban.service

Now, Fail2Ban will automatically block any IP that fails to log in 3 times in a row.

How to Unban an IP Address

If you need to remove a ban, follow this guide on unbanning with Fail2Ban.

With Fail2Ban, your Ubuntu server has stronger SSH brute-force protection. This makes your server safer and gives you peace of mind.