Journal · Reading path
Growing the infrastructure
Proxmox, Sophos, DNS policy, tunnels and proxies, each added to answer a practical question.
Ordered as a reading path, not by date.
Following a packet through my Proxmox bridges and Sophos
I traced one connection from the laptop's uplink through three Proxmox bridges and Sophos. This is the map I use to explain where each rule applies, and where traffic never meets the firewall at all.
What my DNS logs can and cannot tell me
NextDNS gives the lab a resolver with a policy and a log of every query. I keep that log private because it reveals what my devices do, so this entry reads a simulated day honestly instead.
Tracing a DNS failure: why the firewall answered NXDOMAIN
A container could not install updates. I traced the failure through Proxmox, Sophos and my NextDNS forwarder, found the gateway answering NXDOMAIN on its own, and wrote it up the way I would for a ticket.
Reading my Sophos threat-feed snapshot
On 6 November 2026 my Sophos active threat response page showed 20 of 30 feeds active and 94% of the feed quota used. I split what that one screen says into configuration, download health, enforcement and overlap, because each needs different evidence.