Can certain remote connections be whitelisted?

I have a number of non-tech family members that I remote assist and remote administer. Clearly, I need to be able to log in remotely via RustDesk whenever needed, and since RustDesk has no auto-updater, I would need to whitelist the website (and their GitHub page) as well.

His router is tri-band though meaning it has 2 5ghz transceivers.

Unfortunately, for many models - like the Linksys WRT 3200ACM - that second antenna (technically the third one if you include the 2.4Ghz one) doesn’t function at all without the manufacturer’s firmware. It’s a dead stick with any third-party firmware, and is 100% software-enabled.

I have found this fact to be reliable whether it is DD-WRT or OpenWRT, and across several different manufacturers including Asus and D-Link.

8Tb optical disks don’t exist. Much cheaper to just do spinning-rust or cloud.

What does “woke” mean?

WOKE:

Wisdom
Openness
Kindness
Empathy

It is a state of awareness achieved by intellectually sensitive individuals who have empathy for the plight of others, especially those suffering from injustice and oppression such as racism or systemic bigotry.

This term is also used by people without functional empathy in an attempt to insult and mock those people with empathy.

But “woke” does not mean “persecution”. “Woke” just means that casual racism, sexism, religious and gender bigotry, and general lack of human empathy are no longer acceptable in polite society.

That makes a lot more sense for your setup, then.

Fail2ban bans after 1 attempt for a year.

Fail2ban yes; one year, however, is IMO a bit excessive.

Most ISP IP assignments do tend to linger - even with DHCP the same IP will be re-assigned to the same gateway router for quite a number of sequential times - but most IPs do eventually change within a few months. I personally use 3 months as a happy medium for any blacklist I run. Most dynamic IPs don’t last this long, almost all attackers will rotate through IPs pretty quickly anyhow, and if you run a public service (website, etc.), blocking for an entire year may inadvertently catch legitimate visitors.

Plus, you also have to consider the load such a large blocklist will have on your system, if most entries no longer represent legitimate threat actors, you’ll only bog down your system by keeping them in there.

Fail2ban can be configured to allow initial issues to cycle back out quicker, while blocking known repeat offenders for a much longer time period. This is useful in keeping block lists shorter and less resource-intensive to parse.

Do either of the options you mentioned provide custom nameservers? As in, the ability for ns01.yourdomain.com to resolve to your account on their DNS servers?

I have a need for a printer and HP is solidly in the don’t-touch list.

The only HP printers I still recommend are the vintage ones from the pre-2005 era. HP 4050DTN and HP 5000DTN and the like. Absolutely rock-solid laser printers that don’t have DRM or any other shite. Hell, I can get overstuffed cartridges for the 4050 that can do 20,000 sheets at 5% coverage… who does that these days? And they’re capable of taking JetDirect cards clear up to the gigabit level.

I may have 128Gb in my current rig (Dell Precision T7610), but if this is the way you’re gonna be bloating Windows 12, imma gonna be running to OpenSUSE or some BSD.

Yes, I use Win10Privacy to lobotomize all of the spyware and cruftware that comes with Windows. But it’s gotta be re-run after every significant Windows update.