Davit2005

Unfortunately if you want the money and/or progression sometimes you have to travel for it and yes I am within the M25 in a large town. I'm in the lucky position I work from home 3 days a week but if that was 5 days onsite I'd have to reconsider options.

You can always build a DHCP on Linux, sort of defeats the purpose of serverless but with DHCP there is little option unless the DHCP is on the same broadcast network or DHCP helpers/relays in place. A core switch is an option but depending on the implementation it can be pretty crude. Routers are the next option but again mixed implementation used by manufacturers. Not sure I can ever go back to waiting on a 3rd party to make that or firewall/filtering changes like I have been able to do myself for last 15 years now.

Put the question back to them in that case, what software do they want to use that is compliant with exam regulations. Let them fight between themselves. It is the exam officers responsibility at the end of the day. But I know what is likely to happen, they will give you the software to install 10mins before the exam starts, lol.

Next a server with a touch screen style (Metro) GUI like Server 2012, lol.

Not sure I would trust to let it update drivers, I've known it to bork some i.e. Intel cards that you have created sub interfaces on using the intel driver/software not good on a server which you then lose access to and have to re-install the driver from USB stick, lol.

Saving regularly should be ingrained to students. I once went to a student who had been working on an Adobe project and had not saved at all for 3 hours then it refused. I did manage to create a new project and copy over the stuff for her then save, teacher jus sat there next to student. I had this argument with another teacher once who kept telling students to save often because IT could not be trusted till I pointed out a power failure and the work is lost would of been a better statement.

I only use it at home, we have not crossed enough to implement that at work yet because all our students are over 18. Any guests under 18 the organizers have to get a signed disclaimer. I have worked at a few schools and colleges though where we had filtering, from dedicated appliances to integrated with firewalls.

Can you run a packet capture on both ends? I'd also look at time as @3s-gtech suggests, if this is over 5mins difference you could have an issue

PiHole have lists of known URLs that can be automatically updated, I have over 1.5million altogether. You can even apply groups and get these applied to different IP addresses. I'd defo have 2 PiHoles, not much more admin. There are ways to sync them too although never done this myself.

Even dealing with staff constantly asking you if it is OK to log into their computer the minute you arrive on site and have not even began to investigate or aware you have a problem is infuriating enough, lol. When ever we have been involved in an incident the strict line is no outside discussion unless goes thru official channel.

I'd also suggest nightly shutdown tasks for the PCs then using WoL to start them up again the next day, this will clear any logged in users and also help prevent any lockouts due to password resets. You will have to cater/deal with any filtering that uses IP address mapping to get user IDs.

Not uncommon to block all access in and out during a cyber incident.

Lane assist in a loan car, it lasted 1 journey till I found out how to turn it off. Overtook a car and coming back into the lane it fought with me. I do wonder how bad we have become to require such systems to be enabled by default, I've never had a problem staying in a lane. It had the speed recognition system too which was wrong 40% of the time.

Creating vlans makes laterall movement that much harder specifically when you can isolate with ACLs and firewalls (either host or network or ideally both) To start with you don't want your CCTV on the same network as any other clients, that is a big no no. Really any device should only be given access to the Internet if it requires it. Least privilege's model been best practice. IoT should be defo be separated If possible put servers on their own vlan too. Depending on the size of the org I'd contemplate having different vlans for buildings, separate vlans for Building Management and access control too not only for security and noise but also if you have a switching loop on a client network it won't effect other areas. Then separate Guest and BYOD for Staff/Student If your Dream Machine is going to be a main router/firewall follow best practices too. I think that Unifi default is to allow traffic rather than deny by default but could be wrong on that. If there is an upstream router it might complicate things slightly.

You don't need to use the default vlan, setup a specific management vlan. Aim to not having any client traffic untagged on uplinks. The Unifi controller can be kept on separate vlan ACL'd and then FQDNs used so the APs etc can talk to the controller. If you are starting with the Unifi Dream Machine and you have control over your internal address space you have the option to create separate networks, take the opportunity 🙂

I think with everything cloud you have to look at the service you are providing. If it is cloud native i.e. SaaS it is a lot simpler. IMO If it requires anything near IaaS you are potentially creating more work, jus moving the problem and not necessarily making it cheaper or easier to manage. VPNs, Microsoft Gateways, Firewall rules etc then you are managing the server too it if is IaaS

Might be different from me as I have a Business account for home so I seem to need unique ID on FTTP. Anyways don't want to derail the thread too much, lol.

Side note/hijack, how did you get on with the opensense on Sky, I thought they were pretty locked in? TBH I've never used an ISP router, even when I was with Cable & Wireless, NTL, BT or Virgin.

At home I have 2 PiHole's running as a VMs, does not necessarily need to be on a Rasp Pi 🙂 I did originally have it running as a docker container but I too had database issues so jus put it on it's own debian VM now. I also run 2 Cloudflared containers for DoH on separate ProxMox nodes with VMs running docker. I prefer having dedicated VMs running docker then can split up containers that need privileged access from those that do not.

They removed contact numbers even when you have a business account. Jut get on the chat, speak to billing and tell them you are thinking about cancelling due to technical issues. They were charging me for 2 years for CVE when I asked to have it removed. They started saying that I'd need to pay a charge to leave after those 2 years, I eventually got 2 years of refund for the service after pointing out that I asked for it to be removed and for 3 bills it was but then put back on the bill.

Kit as in server or phones. 3CX server can be self-hosted as a VM or a dedicated hardware appliance (basically a NUC when In last looked) or cloud hosted. There is no option these days for the free version and self-hosting. With phones suggest you stay with supported phones, jus makes provisioning so much easier if you have made the DHCP option changes so the phone downloads the correct config.

Another vote for Gamma.

Jus be aware when using these AI tools with sensitive/research data. Yep this was reported in Chrome via AI 🙂

Is this same device, same user?

2nd this. I ran a Prusa MK3 at home from 2020 to 2024, bought a Bambu Labs X1c in 2025. I only use the Prusa if I have something I am confident printing if my X1c is printing at the time. I like the Prusa becuase it works with OctoPrint, I don't like the Bambu Labs because it is a lot more proprietary and locked down. But hands down the Bambu Labs is more reliable not to mention quicker.