Timeline

I published GL.iNet Slate 7, Tailscale, and Split-Routing Around the Great Firewall, a full technical writeup of the router-level setup I run in China: a Slate 7 carrying Tailscale as the default route to a Debian VPS exit node, with PBR sending Chinese CIDRs direct out the physical uplink and a dnsmasq split so CN domains resolve via AliDNS and everything else rides stubby DoT to Cloudflare. The post spends most of its time on the two war stories that took the longest to unstick: getting PBR's fwmark rules to win over Tailscale's exit-node rule, and hunting down GL.iNet's vpn_table stamping every LAN packet with 0x8000 and quietly breaking Google and YouTube. All the shell, nftables, and dnsmasq snippets embed live from a public gist, pinned to a revision so the post never drifts underneath its own code.

rtc-bridge — TCP tunneling from a browser, explained is up. I wrote down the WebRTC signaling path, the node/coordinator/browser split, and the auth gap I think matters most before anyone uses it for sensitive services. I also compared it to my Tailscale + Caddy setup so the trade-offs stay concrete.

I published WebRTC — How it actually works as a note on how signaling, STUN/TURN, ICE, DTLS, and SRTP fit together. The useful framing here is that WebRTC is not just "peer-to-peer"; it is a browser-owned transport stack wrapped around signaling and fallback infrastructure you still have to run.