If you have IPv4 addresses, I guarantee you’re behind at least one NAT gateway. What you need is a Tailscale subnet router, or something equivalent from another service.

In the most basic configuration, the Tailscale client facilitates communication (by using some UDP black magic fuckery) between one host it is running on and another host it is running on that are both connected to the same tailnet (the virtual network between Tailscale hosts). For this purpose, it uses addresses from the 100.64.0.0/10 “shared address space” subnet. These addresses will only be reachable from within your tailnet.

If you want an entire subnet (e.g. your LAN) to be accessible within your tailnet, you need to set up a subnet router. This involves configuring the Tailscale client on a device within the target subnet to advertise routes (tailscale set --advertise-routes=192.168.1.0/24), allowing the host to advertise routes in the admin page (Machines -> … -> Edit routes), and configuring the Tailscale client on external hosts to accept advertised routes (tailscale set --accept-routes).

If you want your servers to be accessible from anywhere on the internet, you’ll need Tailscale Funnel. I don’t use it personally, but it seems to work. Make sure you understand the risks and challenges involved with exposing a service to the public if you want to choose this route.

I’d love to know what an actual moderator would think if you imposed your idea on them.

report bad faith posts

You’re supposed to report posts that break instance or community rules, not whatever you happen to consider to be “bad faith”. You can’t moderate based on intent, only actions, otherwise you’re asking for a thought police where only the popular opinion is permitted to exist.

Besides, even if your instance has disabled downvotes, other instances can still see them.

Depending on your sorting method, downvoted posts will be featured less favorably in list views. You will immediately know that a heavily downvoted post is not worth your attention. Some clients might let you filter displayed posts based on vote counts or up/down ratio.

Downvote and move on. Mute accounts and communities you don’t want to see. Curate your own feed. Simple as.

The issue was ARP-related after all. Since all computers were cloned from the same image, the VMs ended up having the same MAC address, which caused collisions.

I think you need four distinct MAC addresses for this setup, are they all different?

We have a winner!

The classroom computers were mass-deployed using Clonezilla, from a disk image that already had the VM pre-configured. As a result, every VM had the same MAC address. Bridged networking put both hosts and both VMs in the same broadcast domain, which caused collisions in the ARP tables. I randomized the MAC address of one VM and everything suddenly started working.

It’s never been an issue since we’ve never needed to use anything other than the default NAT adapter, so I’ve never even questioned it. I found the solution after plugging the computers directly into an access switch without success, and cross-checking show mac address-table with the MAC reported by the VMs revealed that they were identical.

I checked ip neighbour (it also shows the ARP table, so I assume they’re identical), and it showed REACHABLE and STALE for addresses I could ping, but FAILED for the remote VM’s address. I will check arp -a when I get the chance, though.

I’ll give it a try tomorrow, thanks.

Although I’d still prefer to know why the VMs won’t talk over simple Ethernet.

Realistically, is that a factor for a Microsoft-sized company, though? I’d be shocked if they only had a single layer of redundancy. Whatever they store is probably replicated between high-availability hosts and datacenters several times, to the point where losing an entire RAID array (or whatever media redundancy scheme they use) is just a small inconvenience.

This is not meant for human beings. A creature that needs over 140 TB of storage in a single device can definitely afford to run them in some distributed redundancy scheme with hot swaps and just shred failed units. We know they’re not worried about being wasteful.

I’ve had good experiences with Rustdesk. The client is open-source and the no-cost server components (ID and Relay servers) are self-hostable. The remote server works on X11 and Windows. I use this script to run XFCE+Rustdesk in a headless session:

export SERVERNUM=69
export SCREEN_SIZE='-screen 0 2560x1440x24'
export DISPLAY=":${SERVERNUM}"
export XDG_SESSION_TYPE=x11

xvfb-run --server-num="${SERVERNUM}" --server-args "${SCREEN_SIZE}" startxfce4 & disown
sleep 1
flatpak run com.rustdesk.RustDesk & disown

Sunshine + Moonlight is also a good choice. I have Sunshine installed on a box at home and use Tailscale to connect to it from the Moonlight client. At 1440p 60 FPS it has no visible compression artifacts and responsive enough for gaming.

You should also look at which processes use the largest amount of memory. ZFS is weird and might allocate its cache memory as “used” instead of “cached”. See here to set its limits: https://forum.proxmox.com/threads/limit-zfs-memory.140803/

The most useful is probably cat /proc/meminfo. The first couple of lines tell you everything you need to know.

• MemTotal is the total useful memory.
• MemFree is how much memory is not used by anything.
• Cached is memory used by various caches, e.g. ZFS. This memory can be reallocated.
• MemAvailable is how much memory can be allocated, i.e. MemFree + Cached.

And why, pray tell, do you need Mullvad to do it? I want to know why you think that.