Having fought for several days with this, I’d thought it would be worth sharing while it’s still fresh in what’s left of my mind:

Problem:

• OpenWRT router running latest available version (25.12) and Luci UI.
• IP cam that I want hardwired-only (Ethernet).
• Cam must have no access to internet or rest of LAN.
• Cam must only be accessed directly by the NVR software.
• Software (NVR and reverse proxy) run as docker containers on server PC.
• Any other LAN device (laptop, phone) must be able to access the NVR only via the reverse proxy.

Network topology:

• Cam is plugged physically in lan1 port on router.
• Server is plugged physically in lan3 port on router.
• The problem above basically means we need two tagged VLANs, one for regular LAN devices, and one just for NVR and camera.

Configuring the VLANs in OpenWRT:

Before anything else: try doing the next batch of configs from wireless if possible not Ethernet, in case you mess up and lose wired connectivity to the router.

• Go to Network > Interfaces > Devices and press “Configure” for the bridge that holds your router ports. This will typically be called “br-lan”.
• Go to the “Bridge VLAN filtering” tab and check “enable Vlan filtering”.
• Press the “Add” button twice to get two VLANs.
• First VLAN: set id=1, check “local”, mark lan1=off (not member), lan2=untagged, lan3=tagged (also primary), lan4=untagged. You can use any ID but “1” is traditional for the base LAN network.
• Second VLAN: set id=100, check “local”, mark lan1=untagged, lan2=off, lan3=tagged, lan4=off. Again, you can use any ID, but it’s traditional to avoid numbers under 10 because they’re typically used for core VLANs.
• Case in point, please note that my router has two physical NICs, one for LAN ports 1-4 and one for WAN, so I have a separate br-wan device just for wan. But some routers only have one physical NIC so they only have one bridge that covers both lan1-4 and wan ports. On these routers when you get to the filtering tab you will find two VLANs (1 and 2, typically) already set up. If this is the case add the VLAN 100 and modify VLAN 1 as above and mark wan as off in 100.
• After you press “save” you will notice two new virtual devices called “br-lan.1” and “br-lan.100” type VLAN 802.1q have appeared in the device list.
• Do not apply modifications yet. First go to Network > Interfaces, edit the “lan” interface and switch it from device “br-lan” to device “br-lan.1”, otherwise you may lose connectivity to router if you’re on Ethernet.
• If you’ve applied changes early and lose connectivity, don’t panic, just wait. In recent OpenWRT versions after 90s without confirmation from the UI the router will automatically rollback the last changes.

If all went well and you’re on wireless or one of the untagged Ethernet ports (lan2 or lan4) you should have retained connectivity to the router and wireless devices.

Configuring the NVR network in OpenWRT:

• Go to Network > Interfaces, click “Add new interface”.
• Call it “NVR”, protocol “static address”, device “br-lan.100”.
• Next, edit it and set up your desired IPv4 address and netmask.
• You MUST go to “firewall settings” and use the “custom” field to add a new “NVR” zone. alternatively you can go to Network > Fireall, create the NVR zone there, and choose it here.
• Enable DHCP if you want.
• If you do, please note that some routers bind dnsmasq only explicitly to select interfaces. Please check under Network > DHCP > dnsmasq > Devices & Ports and if “non-wildcard” is checked you will have to add “NVR” to the “Listen interfaces” to actually get DHCP services on that network.
• Under Network > Firewall you should have a zone called “NVR”. Set input/output/forward to accept/accept/reject.
• Under Network > Firewall > Traffic rules you have to add a new rule, calld it “NVR DHCP”, that says that protocol UDP, source zone “NVR”, destination “device (input)”, destination port 67, action “accept”, and under advanced restrict address family to IPv4. Traffic rules have priority over zone configuration so DHCP will work no matter how you fuck up your zone access.
• We will be skipping DNS because we don’t want the NVR network to benefit from any. But if we did we’d be doing the same we did for DHCP (got to Network > DNS to enable explicitly on NVR interface, and add a traffic rule for it).

Configuring the camera:

• Plug the camera into port lan1, it should pick up a DHCP address on the network you’ve defined for interface “NVR”.
• In order to be able to access that IP from your regular LAN to configure the camera with your phone you’ll have to temporarily add the “NVR” zone to the list of forward zonez of the “lan” zone.
• Would probably be a good idea to either configure the camera to a static IP or give it a static DHCP assignment based on the Ethernet MAC, so you know where to reach it from the NVR software.
• Remember to remove the “NVR” zone from the lan’s zone forwards when you’re done.

Configuring the server for tagged VLAN connectivity:

• Your server (port lan3) was marked for tagged VLAN connectivity in OpenWRT but it doesn’t (yet) actually use tagged connections. We have to fix that or it won’t be reachable.
• Feel free to mark lan3 as “untagged” on VLAN 1 to connect to it while you change the settings, but keep in mind that direct console access may be needed if you fuck up.
• My server runs Debian so configuration basically runs down to loading module 8021q (and adding it to /etc/modules just in case, although this should be largely automated), and editing /etc/network/interfaces. Feel free to adjust the example below to your needs:

# this will bring up eth0 but leave it unconfigured, merely as a support carrier for the VLANs 
auto eth0
iface eth0 inet manual

# this will set up VLAN ID 1 and tell it to use DHCP
auto eth0.1
iface eth0.1 inet dhcp

# this will set up VLAN ID 100 with a static address
auto eth0.100
iface eth0.100 inet static
	address 10.234.100.2/24

Configuring docker networks and containers:

• Remember I said the proxy and the NVR are running in docker containers. If you haven’t done anything fancy with them before, you were probably using ports: to expose a port for the proxy and one for the NVR on the host’s LAN IP, and pointing the proxy to the NVR.
• First, we will want to make an ipvlan or macvlan docker network that will use the eth0.100 interface. Containers that use this network will be placed in the NVR network/zone, and have their communications tagged with VLAN ID 100. Feel free to customize the network range. You can use either ipvlan or macvlan, the latter is not very useful since docker can’t do DHCP. Note the use of aux-address to reserve the IP you’ve assigned the camera, in case there’s potential overlap with the range you choose for automatic allocation. It’s essential that you use the eth0.100 interface as parent.

docker network create --driver ipvlan \
--ip-range=10.234.100.97/27 --subnet=10.234.100.0/24 --gateway=10.234.100.1 \
--aux-address 'cam1=10.234.100.10' \
-o parent=eth0.100 nvr-vlan

• We also need a bridge network that will allow the proxy to see the NVR container, because once the NVR container is placed on the NVR network on the VLAN ID 100 it won’t be reachable directly by the proxy.

docker network create --driver bridge \
--opt com.docker.network.bridge.name=br-docker-proxy \
--ipv4 --subnet=172.23.1.0/24 --gateway=172.23.1.1 \
proxy-bridge

• Next, in the NVR container compose, join both proxy-bridge and nvr-lan:

services:
  nvr:
    networks:
      nvr-vlan:
      proxy-bridge:
    hostname: nvr
networks:
  nvr-vlan:
    external: true
  proxy-bridge:
    external: true

• Also in the proxy container compose you will want to join the proxy-bridge network.
• Remove the ports: directive from the NVR container, it doesn’t serve any purpose now. Containers on ipvlan/macvlan are reachable by their native port assignments on the networks they’ve joined.
• Please note the hostname: nvr in the NVR compose, that’s the name you will have to use in the proxy configuration to reach the NVR. Docker will supply a DNS resolve for this automatically.
• The proxy doesn’t need to be on nvr-vlan. I mean you can, but you need to keep the proxy accessible from the main network so it will keep using ports: as usual.

Bibliography:

• docs.docker.com/engine/network/drivers/ipvlan/#ma…
• openwrt.org/docs/…/switch_configuration
• openwrt.org/docs/guide-user/…/converting-to-dsa
• openwrt.org/docs/guide-user/…/dsa-mini-tutorial
• forum.openwrt.org/t/openwrt-vlan-tagging/208098
• computingforgeeks.com/how-to-configure-vlan-inter…
• wiki.debian.org/NetworkConfiguration#Howto_use_vl…
• manpages.debian.org/…/interfaces.5.en.html
• deepwiki.com/openwrt/…/6.1-zone-configuration
• deepwiki.com/openwrt/firewall4/7-rules-and-nat

With its new watches’ “Audio Intelligence,” “Live Rewind,” and “Siri Recap” features, the company is straddling the line between accessibility and utility on one side and what starts to feel like invasive technology on the other.

“Siri Recap,” uses ambient listening to “take high-level notes” of your conversations, which can be reviewed in the Siri iOS app. These notes will automatically generate a title, summary, and key points based on what was recorded and summarized by AI.

Kore Kaite Shine, episode 10

Reminder: Please do not discuss plot points not yet seen or skipped in the show. Failing to follow the rules may result in a ban.

All discussions

This post was created by a bot. Message the mod team for feedback and comments. The original source code can be found on GitHub.

Tensei Shitara Slime Datta Ken 4th Season, episode 22

Reminder: Please do not discuss plot points not yet seen or skipped in the show. Failing to follow the rules may result in a ban.

All discussions

This post was created by a bot. Message the mod team for feedback and comments. The original source code can be found on GitHub.

Sawce is from an ancient reddit thread from the beforefore. Part of a series of cool looking things someone created that made everyone all like whaaa and huhuhh n whaaaattt and wowwww

In short: I am out of sauce.

I learned about this from Matt Parker’s Stand-Up Maths channel. It was originally conceived as a counterexample, a sorting algorithm that was obviously broken, but it does actually sort correctly. The algorithm:

for i = 1 to n do  
    for j = 1 to n do  
        if A[i] < A[j] then  
            swap A[i] and A[j]  

It has a few quirks (like j accessing elements outside of i’s range, and the A[i] < A[j] comparator being backward) that should break it, but they all work together to make the algorithm correctly (if inefficiently) sort the input.

paper describing the algorithm in more detail.

Yani Neko, episode 10

Related Communities

• !ChainsmokerCat@lemmy.blahaj.zone

Reminder: Please do not discuss plot points not yet seen or skipped in the show. Failing to follow the rules may result in a ban.

All discussions

This post was created by a bot. Message the mod team for feedback and comments. The original source code can be found on GitHub.

“China-based artificial intelligence companies are conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies’ models through industrial-scale knowledge distillation campaigns that form the core—not merely a supplement—of their AI development strategy,” the agencies wrote.

I just learned that the Qt framework that powers so much of Ubuntu Touch🇩🇪 is Finnish.

There’s a special edition of the Switch 2 in relation to commemorating the 40th anniversary of The Legend of Zelda, which is expected to release around October 29 2026. Keep in mind this is discussing the Region Locked version of the console rather than the Global Switch 2 everyone else owns. I mean, you can import it upon release but comes with caveats (must have a JP Nintendo Account and speak / understand Japanese).

Prices will differ based on region upon release for the same thing, which is like why:

• US: $519.99 (excl. Sales Tax)
• EU: 519,99€ (inc. VAT)
• UK: £419.99 (inc. VAT)
• AU: A$799.95 (inc. GST)

Will you buy the console when it releases?

The Intercept sued to obtain records that reveal an intimate relationship between the military and OpenAI, Anthropic, Google, and xAI.

Download the best classic and new games on Windows, Mac & Linux. A vast selection of titles, DRM-free, with free goodies and 30-day money-back guarantee.

“”" An open source project the size of Lemmy needs constant work to manage the project, implement new features and fix bugs. Dessalines and Nutomic work full-time on these tasks and more. As there is no advertising or tracking, all of our work is funded through donations. Even so there is barely enough time in the day, and no time for a second job. The only available option are user donations. To keep it viable donations need to reach a minimum of 5000€ per month, resulting in a modest salary of 2500€ per developer. If that goal is reached we can stop worrying about money, and fully focus on improving the software for the benefit of all users and instances. We especially rely on recurring donations to secure the long-term development and make Lemmy the best it can be.

If you want more information before donating, consider the comparison with Reddit. It began as startup funded by rich investors. The site is managed by corporate executives who over time have become more and more disconnected from normal users. Their main goal is to make investors happy and to make a profit. This leads to user-hostile decisions like firing the employee responsible for AMAs, blocking third-party apps and more. As Reddit is a single website under a single authority, it means all users need to follow the same rules, including ridiculous ones like censoring the name “Luigi”.

Lemmy represents a new type of social media which is the complete opposite of Reddit. It is split across many different websites, each with its own rules, and managed by normal people who actually care about the users. There is no company and no profit motive. Much of the work is carried out by volunteer admins, mods and posters, who contribute out of enthusiasm and not for money. For users this is great as there is no advertising nor tracking, and no chance of takeover by a billionaire. Additionally there are no builtin political or ideological restrictions. You can use the software for any purpose you like, add your own restrictions or scrutinize its inner workings. Lemmy truly belongs to everyone.

Note: Donations via OpenCollective also finance the hosting of lemmy.ml, which is used to test new versions before release.

Nutomic and Dessalines, Lemmy Developers “”“”

The European Union will suspend imports of Brazilian meat and other animal products from Thursday, citing concerns over Brazil’s compliance with EU rules on antibiotic use in livestock. The move affects poultry, beef, eggs and honey, with Brussels offering no timeline for when trade can resume.

They’re now officially supporting Apple M3 series chips alongside their existing M1 and M2 support!

cross-posted from: lemmus.org/post/25140646

Thousands of leaked internal files expose the Social Design Agency as a frontline tool for Russian hybrid warfare.

On paper, the firm looks like a standard PR agency. In reality, investigators have traced its operations to a coordinated effort to fake news stories, stage hate crimes, and flood the West with disinformation. The leaked documents reveal a calculated strategy designed to sow discord and manipulate public perception across Europe.

Investigative journalist Martin Laine examines the secret Kremlin playbook behind these operations. The reporting traces the chain of command directly to Vladimir Putin’s presidential administration, detailing how the agency executes false flag operations to destabilize foreign nations. This investigation provides a rare look at the mechanisms of modern propaganda and the state-sponsored actors behind them.

cross-posted from: lemmy.world/post/51140134

My take from this Cybernews article about an Android toolkit to trick KYC verification significantly differs from theirs!

Them: “…the existence of such tools puts users and organizations at imminent risk.” “Not a tool for the masses”

Me: “Where can I find this amazing Privacy tool?” “A tool the masses everywhere need access to ASAP”

cross-posted from: https://piefed.world/c/tech/p/1383383/wikimedia-foundation-workers-overwhelmingly-vote-to-form-union-with-cwa

As a taxpayer, I’m very thankful this patriot’s working to protect our investment!

cross-posted from: https://programming.dev/post/56282917

Please let me know if this should be posted somewhere else, and remove it if it does not go here.

Sometimes a camera just needs a sock.

The Flock Sock is a slip on cover designed to help protect a Flock camera from the harmful radiation of the sun. Your city spent their very own hard earned tax dollars scattering these cameras everywhere to keep you safe, all it cost you was a little privacy. The very least you can do is help protect these valuable civil servants from getting a bad sunburn.

When officials in Wyoming conducted a routine test on the water that was being discharged from a massive under-construction Meta datacenter, it was a shock to find it contained a rare and potentially hazardous bacterium.

While the wastewater flushed into sewers in Cheyenne, Wyoming, was never destined for the public drinking supply, the presence of Cupriavidus gilardii bacterium in 801,000 gallons of water ejected by a contractor for the datacenter earlier this year was still unnerving.

Concerned that residents could be exposed to the bacteria if they inhaled evaporating droplets of the water used for irrigation, Cheyenne officials took until July before deciding to stop taking wastewater from Meta’s contractor, Goat Systems – a decision that is now being appealed.

guardrails around AI usage

reinforce several workplace benefits that set industry-wide standards for video game workers in the

wage increases,

grievance procedures

a three-day in-office hybrid workweek

“just cause” protections

remote work

disability accommodations

the contracts now require Blizzard to discuss, evaluate, and bargain over the usage of artificial intelligence in the workplace

give workers the right to be “recalled” into open positions across any Blizzard bargaining unit for 14 months from the date of their layoff announcement

an extra 4 weeks of severance for union workers regardless of their tenure

cross-posted from: lemmy.dbzer0.com/post/75288150

“No other human activity poses this level of danger,” said ex-Anthropic researcher Jacob Coxon in a Tuesday post on X about the alleged irresponsibility of companies like his now-former employer.

“The people building AI earnestly believe that it could kill us all by the end of the decade,” Coxon wrote in that same post.

cross-posted from: discuss.online/post/44873486

I’m continuing to use an original Pi Zero and Pi Zero W, for breadboard experiments.

I have a BRAVIA 4K AE1 android/google TV.

Since a few weeks I observe the following:

If it’s disconnected from the internet for some time, 1 or 2 weeks maybe, it hides all my installed apps. Enabling internet immediately restores everything for a few days.

I tried installing a custom launcher and set it as default launcher - TV still boots into its system launcher.

Any ideas what else to try?

Self hosting relevant because jellyfin

Edit Fixed by enabling accessibility for this app. Thanks everyone who helped and @ryannathans@aussie.zone for pointing this out.