Networking on Logan's Nest

Why Sentry events silently vanished from our Fargate Node app

Wed, 20 May 2026 00:00:00 +0000

TL;DR

Sentry’s Node SDK uses Node’s native https.Agent, which in Node 18+ does Happy Eyeballs dual-stack connections by default. When DNS returns AAAA records but the host (e.g. an ECS Fargate ENI) has no IPv6 routing, the IPv6 connect attempts don’t fail fast — they hang until the agent’s default 2-second timeout, producing AggregateError [ETIMEDOUT] and silently dropping the event. curl from the same host works fine because curl falls back to IPv4 in milliseconds. The fix is one line: tell the Sentry transport to force IPv4 via a custom httpModule.

CloudFront Anycast IP

Thu, 09 Oct 2025 00:00:00 +0000

I recently worked with a new AWS product called CloudFront Anycast IP, which costs $3,000/month. After testing it, I found the offering to be quite misleading, so I’m sharing my findings here.

WireGuard Setup

Fri, 14 Mar 2025 00:00:00 +0000

I spent some time figuring out how WireGuard works and found the guidelines, including the official ones, to be rather complex. So, I’m jotting down my learnings here.

If you can’t be bothered with all the key and config files, https://www.wireguardconfig.com/ provides one click setup for that with QR code.

Add HTTP auth username into envoy proxy logging

Tue, 01 Jun 2021 00:00:00 +0000

Oddly couldn’t find any useful copy & paste solution for this.

As always, base64 decoding and split function copy & pasted from somewhere else.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42


http_filters:
- name: envoy.filters.http.lua
 typed_config:
 "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
 inline_code: |
 b='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
 function base64decode(data)
 data = string.gsub(data, '[^'..b..'=]', '')
 return (data:gsub('.', function(x)
 if (x == '=') then return '' end
 local r,f='',(b:find(x)-1)
 for i=6,1,-1 do r=r..(f%2^i-f%2^(i-1)>0 and '1' or '0') end
 return r;
 end):gsub('%d%d%d?%d?%d?%d?%d?%d?', function(x)
 if (#x ~= 8) then return '' end
 local c=0
 for i=1,8 do c=c+(x:sub(i,i)=='1' and 2^(8-i) or 0) end
 return string.char(c)
 end))
 end
 function split(s, delimiter)
 result = {};
 for match in (s..delimiter):gmatch("(.-)"..delimiter) do
 table.insert(result, match);
 end
 return result;
 end
 function envoy_on_request(request_handle)
 local auth_header = request_handle:headers():get("Authorization")
 if auth_header ~= nil then
 local auth_token = split(auth_header," ")
 if auth_token[1] == "Basic" then
 local auth_decoded = split(base64decode(auth_token[2]),":")
 request_handle:headers():replace("x-username", auth_decoded[1])
 auth_header = null
 auth_token = null
 autn_decoded = null
 end
 end
 end
- name: envoy.filters.http.router
 typed_config: {}

Then it can be added into the log by using %REQ(x-username)% from envoy.extensions.access_loggers.file.v3.FileAccessLog.format

CloudFlare Log Search

Fri, 19 Jun 2020 00:00:00 +0000

Get the Zone ID
Select domain name from the dashboard then zone ID will show on bottom right corner.
Get the API Key
Select log search template to give minimum privilege
(Optional) Look up the fields available

1

curl -s -H "X-Auth-Email: <EMAIL>" -H "Authorization: Bearer <API KEY>" "https://api.cloudflare.com/client/v4/zones/<Zone ID>/logs/received/fields" | jq .

4. Run Log Search (modify date & time bit as you need)

AWS TGW VPN using Unify UDM

Sat, 13 Jun 2020 00:00:00 +0000

Transit Gateway (TGW) is a managed cloud router service provided by AWS and it supports direct VPN attachment.

The setup is little bit tricky as UDM doesn’t support BGP.

1. Create a Customer Gateway
Select Dynamic routing and enter your router public IP

Pooq Proxy

Sun, 14 Jan 2018 00:00:00 +0000

This is my current setup for watching Pooq in Australia for anyone interested. With local proxy, below 4k streaming (UHD) seems alright with NBN via AussieBB. TPG might have better throughput as they have PPC-1 submarine cable.

F5 AAM Cache for app generated pages

Mon, 16 Nov 2015 00:00:00 +0000

Dynamic content requires cache-control(max-age) and/or expires header to be cached.

The headers also need to be honoured from AAM policy which is not enabled by default.

Debug header decode: wainfodecode [X-WA-INFO header content]

Ports for WDS

Tue, 31 Mar 2015 00:00:00 +0000

Ports for WDS

Google search said ‘The following TCP ports need to be open for WDS to work across a firewall: 135 and 5040 for RPC and 137 thru 139 for SMB.’

Run Citrix NetScaler VPX from KVM

Thu, 23 Jan 2014 00:00:00 +0000

1. Download Hyper-V image and extract .vhd

2. Covert it via running: qemu-img convert -O qcow2 NSVPX-ESX-10.1-119.7_nc-disk1.vhd NSVPX-XEN-10.1-119.7_nc.qcow2

3. Create a VM, mount the image.

4. Login via nsroot/nsroot and run ‘config ns’ for initial network setup. Oddly, this menu doesn’t list routing option including default gateway. Add it manually via ‘config add route 0.0.0.0 255.255.255.255 your_gateway_ip’

Disable msi with minimal interruption

Mon, 14 Oct 2013 00:00:00 +0000

1
2
3
4
5


ifconfig eth0 down
rmmod bnx2
modprobe bnx2 disable_msi=1
ifconfig eth0 up
route add -net default netmask 0.0.0.0 gw [default gw here] eth0

For bonding interface:

L2L VPN with ASA - Connection established but no packet coming from one side

Thu, 05 Jul 2012 00:00:00 +0000

Symtom:

1. Connection established.

2. 0 en/decapsulated packet from one side.

Solution:

Seems like ASA pickup Dynamic VPN profile if it has higher priority than L2L.

Resolved after change dynamic profile priority.

Cisco Router config for ACME PACKET

Wed, 21 Dec 2011 00:00:00 +0000

sip-ua

authentication username -snip- password 7 -snip-

registrar dns:realm.domain expires 3600

sip-server dns:realm.domain

connection-reuse

voice service voip

no ip address trusted authenticate

allow-connections sip to sip

no supplementary-service sip moved-temporarily

Using additional public ip address over pppoe nat with cisco router

Fri, 30 Sep 2011 00:00:00 +0000

To allocate router a non-NAT IP (for AWS VPC etc etc)

1. Create a loopback interface and put given ip & subnet 2. profit!

Otherwise,

ip nat inside source route-map NONAT interface Dialer1 overload ip nat inside source static 192.168.?.? PUBLIC_IP_HERE