The 8 Hypervisors I'd Actually Recommend in Late 2026 #besthypervisors #virtualization #homelab https://www.virtualizationhowto.com/2026/08/the-8-hypervisors-id-actually-recommend-in-late-2026/

This Free Docker Dashboard Shows Your Entire Stack in 3D https://www.virtualizationhowto.com/2026/07/this-free-docker-dashboard-shows-your-entire-stack-in-3d/

for the Dutch among us: Nederlandse site https://homelab.patad.nl/dns/advanced-technitium/ # Technitium DNS: My Advanced Setup & High Availability What I changed: - Point 5 ( Critical Edge Cases & Troubleshooting ) and the DoH script In this document(.md file), I will describe the advanced architecture of my Technitium DNS cluster. I am documenting how I configured the Access Control Lists (ACL) for my VLANs, how my active clustering works, how I achieve High Availability via `keepalived`, and how I integrate everything with my Nginx Proxy Manager (NPM). --- ## 1. Network Access Control List (ACL) & Recursion By default, Technitium refuses DNS resolution (recursion) for IP addresses outside its own local subnet. To ensure that all my local VLANs and WireGuard clients can resolve domain names, I explicitly added these subnets to the ACL. ### My Configuration (Example Networks): In my Technitium dashboard, I navigated to **Settings** > **Recursion**, located the **Network Access Control List (ACL)**, and added my networks. *Below is the overview of the subnets I use for my VLAN structure:* * `192.168.11.0/24` (My Management / Main Network) * `192.168.21.0/24` (My IoT / VLAN 21) * `192.168.31.0/24` (My Gadgets / VLAN 31) * `192.168.41.0/24` (My Guests / VLAN 41) * `10.6.0.0/24` (My WireGuard VPN Subnet) > **Important for my setup:** If I forget to configure this, clients on my VPN subnet or other VLANs will notice they have an active network connection, but they won't be able to load any websites or local domains because the DNS queries will simply be dropped. --- ## 2. Technitium Clustering & Node Distribution To guarantee absolute redundancy against the failure of an entire hypervisor, I physically separated my two Technitium DNS servers across my Proxmox environments: * **DNS 1 (Primary Node - `192.168.11.50`):** Runs as an LXC container within my main cluster (**PVE1** / **PVE2**).

Check out The Reverse Proxy Mistakes I Still See in Home Labs (And How I Avoid Them) #reverseproxy #dns #homelab https://www.virtualizationhowto.com/2026/07/the-reverse-proxy-mistakes-i-still-see-in-home-labs-and-how-i-avoid-them/

Here is the clear, direct breakdown of my setup and the troubleshooting steps in standard homelab terms. The Architecture Setup - Edge Router: Asus RT-BE88U acting as the WireGuard VPN server. - DNS Cluster: Two Technitium DNS servers running in Proxmox LXC containers. - High Availability (HA): keepalived managing a Virtual IP (VIP) at 192.168.11.53 for DNS failover. - Upstream Resolution: Pure recursive root server resolution (no upstream forwarders like Cloudflare/Google configured). - Ad-Blocking Action: Configured to drop blocked domains using the NXDOMAIN resolution method. - Reverse Proxy & Auth: Nginx Proxy Manager (NPM) handles local SSL/domains, protected by 2FA/OTP for the dashboards. Step 1: Configuring the WireGuard Server (Asus) When spinning up the WireGuard server on the Asus RT-BE88U, the interface was assigned a dedicated tunnel subnet: - Tunnel Subnet: 10.6.0.1/32 - Max Clients: 10 (allocating tunnel IPs from 10.6.0.2 to 10.6.0.11 to connecting peers). - Peer DNS Injected: Handed out the keepalived VIP (192.168.11.53) to all VPN clients. Step 2: Fixing the "No Internet / No Loading" Issue Once the Android client connected over 5G, the tunnel established successfully but data stopped loading. This was a classic Network Access Control List (ACL) block. By default, Technitium only allows recursion requests coming from the immediate subnet it sits on. When the phone tried to query the VIP from its WireGuard IP (10.6.0.X), Technitium dropped the packets. The Fix: 1. Navigated to both Technitium LXC instances -> Settings > Recursion. 2. Located the Network Access Control List (ACL). 3. Added the WireGuard subnet 10.6.0.0/24 to the allowed list (or used the wide-open 0.0.0.0/0 flag, which is perfectly safe since port 53 isn't forwarded to the WAN). 4. Saved settings on both nodes. This immediately fixed the recursion block, allowing the 5G client to resolve names and block ads natively via NXDOMAIN. Step 3: Automating the Client (WG Tunnel App)