From 8036b2c757dfaad989815859b251ec51f66797eb Mon Sep 17 00:00:00 2001
From: Pavel 'LEdoian' Turinsky <ledoian@matfyz.cz>
Date: Wed, 8 May 2024 13:25:10 +0200
Subject: [PATCH] render
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Idk why it reordered tags…
---
 output/about-blog.html                   |  2 +-
 output/archives.html                     |  5 +-
 output/categories.html                   |  2 +-
 output/category/networking.html          |  2 +-
 output/category/queer.html               |  2 +-
 output/category/talks.html               |  2 +-
 output/category/technology.html          |  2 +-
 output/category/til.html                 |  5 +-
 output/cbz-to-pdf.html                   |  2 +-
 output/custom-xkb-tweaks.html            |  2 +-
 output/do-not-gossip-identities.html     |  2 +-
 output/drafts.html                       |  2 +-
 output/drafts/ucw-keymap-on-wayland.html |  2 +-
 output/feeds/all.atom.xml                | 18 ++++-
 output/feeds/technology.atom.xml         |  2 +-
 output/feeds/til.atom.xml                | 18 ++++-
 output/forgetting-dns6.html              |  2 +-
 output/index.html                        |  2 +-
 output/masquerade-with-filter.html       | 89 ++++++++++++++++++++++++
 output/mobius-print.html                 |  2 +-
 output/smrst2023-cs.html                 |  2 +-
 output/tag/comics.html                   |  2 +-
 output/tag/dns.html                      |  2 +-
 output/tag/identity.html                 |  2 +-
 output/tag/infrastructure.html           |  2 +-
 output/tag/ipv6-only.html                |  2 +-
 output/tag/lifehack.html                 |  2 +-
 output/tag/linux.html                    |  5 +-
 output/tag/meta.html                     |  2 +-
 output/tag/print.html                    |  2 +-
 output/tag/relationships.html            |  2 +-
 output/tag/smrst.html                    |  2 +-
 output/tag/software-engineering.html     |  2 +-
 output/tag/software.html                 |  2 +-
 output/tag/trains.html                   |  2 +-
 output/tags.html                         |  2 +-
 36 files changed, 162 insertions(+), 38 deletions(-)
 create mode 100644 output/masquerade-with-filter.html

diff --git a/output/about-blog.html b/output/about-blog.html
index 618975c..ecdd6e5 100644
--- a/output/about-blog.html
+++ b/output/about-blog.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/lifehack.html">lifehack</a></li>
 	<li><a href="./tag/software.html">software</a></li>
-	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/relationships.html">relationships</a></li>
 	<li><a href="./tag/identity.html">identity</a></li>
 	<li><a href="./tag/print.html">print</a></li>
diff --git a/output/archives.html b/output/archives.html
index bd0ce17..f86e559 100644
--- a/output/archives.html
+++ b/output/archives.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/lifehack.html">lifehack</a></li>
 	<li><a href="./tag/software.html">software</a></li>
-	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/relationships.html">relationships</a></li>
 	<li><a href="./tag/identity.html">identity</a></li>
 	<li><a href="./tag/print.html">print</a></li>
@@ -63,7 +63,8 @@
 <main>
 	<div>
 <h1>Archive</h1>
-<ul> <li><a href="./custom-xkb-tweaks.html">Creating own XKB tweaks</a>
+<ul> <li><a href="./masquerade-with-filter.html">Only NAT packets you can deliver responses for</a>
+<li><a href="./custom-xkb-tweaks.html">Creating own XKB tweaks</a>
 <li><a href="./do-not-gossip-identities.html">You sure you want to hear the gossip?</a>
 <li><a href="./mobius-print.html">Print your stuff on Möbius bands!</a>
 <li><a href="./cbz-to-pdf.html">How to convert CBZ to PDF</a>
diff --git a/output/categories.html b/output/categories.html
index aa91952..84dd594 100644
--- a/output/categories.html
+++ b/output/categories.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/lifehack.html">lifehack</a></li>
 	<li><a href="./tag/software.html">software</a></li>
-	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/relationships.html">relationships</a></li>
 	<li><a href="./tag/identity.html">identity</a></li>
 	<li><a href="./tag/print.html">print</a></li>
diff --git a/output/category/networking.html b/output/category/networking.html
index 55c34d3..2f844c9 100644
--- a/output/category/networking.html
+++ b/output/category/networking.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/category/queer.html b/output/category/queer.html
index 07b0fd7..493eae8 100644
--- a/output/category/queer.html
+++ b/output/category/queer.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/category/talks.html b/output/category/talks.html
index ec864eb..f98e3ff 100644
--- a/output/category/talks.html
+++ b/output/category/talks.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/category/technology.html b/output/category/technology.html
index 0101cae..8e62f4c 100644
--- a/output/category/technology.html
+++ b/output/category/technology.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/category/til.html b/output/category/til.html
index 2f5b133..6e79adf 100644
--- a/output/category/til.html
+++ b/output/category/til.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
@@ -63,7 +63,8 @@
 <main>
 	<div>
 <h1>Category: til</h1>
-<ul> <li><a href="../cbz-to-pdf.html">How to convert CBZ to PDF</a>
+<ul> <li><a href="../masquerade-with-filter.html">Only NAT packets you can deliver responses for</a>
+<li><a href="../cbz-to-pdf.html">How to convert CBZ to PDF</a>
 </ul>
 	</div>
 </main>
diff --git a/output/cbz-to-pdf.html b/output/cbz-to-pdf.html
index 0d6027e..db35be0 100644
--- a/output/cbz-to-pdf.html
+++ b/output/cbz-to-pdf.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/lifehack.html">lifehack</a></li>
 	<li><a href="./tag/software.html">software</a></li>
-	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/relationships.html">relationships</a></li>
 	<li><a href="./tag/identity.html">identity</a></li>
 	<li><a href="./tag/print.html">print</a></li>
diff --git a/output/custom-xkb-tweaks.html b/output/custom-xkb-tweaks.html
index 6aa9151..a3922b0 100644
--- a/output/custom-xkb-tweaks.html
+++ b/output/custom-xkb-tweaks.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/lifehack.html">lifehack</a></li>
 	<li><a href="./tag/software.html">software</a></li>
-	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/relationships.html">relationships</a></li>
 	<li><a href="./tag/identity.html">identity</a></li>
 	<li><a href="./tag/print.html">print</a></li>
diff --git a/output/do-not-gossip-identities.html b/output/do-not-gossip-identities.html
index 8cf14fa..8be1a6d 100644
--- a/output/do-not-gossip-identities.html
+++ b/output/do-not-gossip-identities.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/lifehack.html">lifehack</a></li>
 	<li><a href="./tag/software.html">software</a></li>
-	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/relationships.html">relationships</a></li>
 	<li><a href="./tag/identity.html">identity</a></li>
 	<li><a href="./tag/print.html">print</a></li>
diff --git a/output/drafts.html b/output/drafts.html
index 6cb69a9..870aee1 100644
--- a/output/drafts.html
+++ b/output/drafts.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/lifehack.html">lifehack</a></li>
 	<li><a href="./tag/software.html">software</a></li>
-	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/relationships.html">relationships</a></li>
 	<li><a href="./tag/identity.html">identity</a></li>
 	<li><a href="./tag/print.html">print</a></li>
diff --git a/output/drafts/ucw-keymap-on-wayland.html b/output/drafts/ucw-keymap-on-wayland.html
index 0ff78b7..0e778c7 100644
--- a/output/drafts/ucw-keymap-on-wayland.html
+++ b/output/drafts/ucw-keymap-on-wayland.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/feeds/all.atom.xml b/output/feeds/all.atom.xml
index e89211d..e844b16 100644
--- a/output/feeds/all.atom.xml
+++ b/output/feeds/all.atom.xml
@@ -1,5 +1,21 @@
 <?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom"><title>LEdoian's Blog</title><link href="https://blog.ledoian.cz/" rel="alternate"></link><link href="https://blog.ledoian.cz/feeds/all.atom.xml" rel="self"></link><id>https://blog.ledoian.cz/</id><updated>2024-04-17T15:18:00+02:00</updated><entry><title>Creating own XKB tweaks</title><link href="https://blog.ledoian.cz/custom-xkb-tweaks.html" rel="alternate"></link><published>2024-04-17T15:18:00+02:00</published><updated>2024-04-17T15:18:00+02:00</updated><author><name>LEdoian</name></author><id>tag:blog.ledoian.cz,2024-04-17:/custom-xkb-tweaks.html</id><summary type="html">&lt;p&gt;Debugging this took me a bit too long, so I want to write about the caveat.&lt;/p&gt;
+<feed xmlns="http://www.w3.org/2005/Atom"><title>LEdoian's Blog</title><link href="https://blog.ledoian.cz/" rel="alternate"></link><link href="https://blog.ledoian.cz/feeds/all.atom.xml" rel="self"></link><id>https://blog.ledoian.cz/</id><updated>2024-05-08T00:00:00+02:00</updated><entry><title>Only NAT packets you can deliver responses for</title><link href="https://blog.ledoian.cz/masquerade-with-filter.html" rel="alternate"></link><published>2024-05-08T00:00:00+02:00</published><updated>2024-05-08T00:00:00+02:00</updated><author><name>LEdoian</name></author><id>tag:blog.ledoian.cz,2024-05-08:/masquerade-with-filter.html</id><summary type="html">&lt;p&gt;When setting up a masquerading nat, it is worth considering masquerading only
+packets from known networks. That is, instead of rule like &lt;tt class="docutils literal"&gt;iifname &lt;span class="pre"&gt;eth-inside&lt;/span&gt;
+masquerade&lt;/tt&gt; use something like &lt;tt class="docutils literal"&gt;iifname &lt;span class="pre"&gt;eth-inside&lt;/span&gt; ip saddr 198.51.100.0/24
+masquerade&lt;/tt&gt;.&lt;/p&gt;
+&lt;p&gt;I learned the hard way: my laptop in a masqueraded network picked …&lt;/p&gt;</summary><content type="html">&lt;p&gt;When setting up a masquerading nat, it is worth considering masquerading only
+packets from known networks. That is, instead of rule like &lt;tt class="docutils literal"&gt;iifname &lt;span class="pre"&gt;eth-inside&lt;/span&gt;
+masquerade&lt;/tt&gt; use something like &lt;tt class="docutils literal"&gt;iifname &lt;span class="pre"&gt;eth-inside&lt;/span&gt; ip saddr 198.51.100.0/24
+masquerade&lt;/tt&gt;.&lt;/p&gt;
+&lt;p&gt;I learned the hard way: my laptop in a masqueraded network picked a wrong
+source address from a subnet the router had no knowledge about. The outbound
+packets passed through right, but the responses came in, undergone translation,
+and since the destination was unknown to the router, it used the &lt;em&gt;default&lt;/em&gt;
+route, sending the packet back to the ISP.&lt;/p&gt;
+&lt;p&gt;The result: IDS triggered by &lt;em&gt;many&lt;/em&gt; packets from my router with source IP
+addresses from all around the Internet, all with destination to my private
+address. (The ISP was not happy about that.)&lt;/p&gt;
+</content><category term="til"></category><category term="linux"></category></entry><entry><title>Creating own XKB tweaks</title><link href="https://blog.ledoian.cz/custom-xkb-tweaks.html" rel="alternate"></link><published>2024-04-17T16:40:00+02:00</published><updated>2024-04-17T16:40:00+02:00</updated><author><name>LEdoian</name></author><id>tag:blog.ledoian.cz,2024-04-17:/custom-xkb-tweaks.html</id><summary type="html">&lt;p&gt;Debugging this took me a bit too long, so I want to write about the caveat.&lt;/p&gt;
 &lt;p&gt;My problem: My laptop does not have PageUp and PageDown keys, and many other
 keyboards I use have similar deficiencies. And I use various environments and
 various systems, some of which are shared with …&lt;/p&gt;</summary><content type="html">&lt;p&gt;Debugging this took me a bit too long, so I want to write about the caveat.&lt;/p&gt;
diff --git a/output/feeds/technology.atom.xml b/output/feeds/technology.atom.xml
index a9eb3e3..3eccfd0 100644
--- a/output/feeds/technology.atom.xml
+++ b/output/feeds/technology.atom.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom"><title>LEdoian's Blog - technology</title><link href="https://blog.ledoian.cz/" rel="alternate"></link><link href="https://blog.ledoian.cz/feeds/technology.atom.xml" rel="self"></link><id>https://blog.ledoian.cz/</id><updated>2024-04-17T15:18:00+02:00</updated><entry><title>Creating own XKB tweaks</title><link href="https://blog.ledoian.cz/custom-xkb-tweaks.html" rel="alternate"></link><published>2024-04-17T15:18:00+02:00</published><updated>2024-04-17T15:18:00+02:00</updated><author><name>LEdoian</name></author><id>tag:blog.ledoian.cz,2024-04-17:/custom-xkb-tweaks.html</id><summary type="html">&lt;p&gt;Debugging this took me a bit too long, so I want to write about the caveat.&lt;/p&gt;
+<feed xmlns="http://www.w3.org/2005/Atom"><title>LEdoian's Blog - technology</title><link href="https://blog.ledoian.cz/" rel="alternate"></link><link href="https://blog.ledoian.cz/feeds/technology.atom.xml" rel="self"></link><id>https://blog.ledoian.cz/</id><updated>2024-04-17T16:40:00+02:00</updated><entry><title>Creating own XKB tweaks</title><link href="https://blog.ledoian.cz/custom-xkb-tweaks.html" rel="alternate"></link><published>2024-04-17T16:40:00+02:00</published><updated>2024-04-17T16:40:00+02:00</updated><author><name>LEdoian</name></author><id>tag:blog.ledoian.cz,2024-04-17:/custom-xkb-tweaks.html</id><summary type="html">&lt;p&gt;Debugging this took me a bit too long, so I want to write about the caveat.&lt;/p&gt;
 &lt;p&gt;My problem: My laptop does not have PageUp and PageDown keys, and many other
 keyboards I use have similar deficiencies. And I use various environments and
 various systems, some of which are shared with …&lt;/p&gt;</summary><content type="html">&lt;p&gt;Debugging this took me a bit too long, so I want to write about the caveat.&lt;/p&gt;
diff --git a/output/feeds/til.atom.xml b/output/feeds/til.atom.xml
index 834ef69..bca284a 100644
--- a/output/feeds/til.atom.xml
+++ b/output/feeds/til.atom.xml
@@ -1,5 +1,21 @@
 <?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom"><title>LEdoian's Blog - til</title><link href="https://blog.ledoian.cz/" rel="alternate"></link><link href="https://blog.ledoian.cz/feeds/til.atom.xml" rel="self"></link><id>https://blog.ledoian.cz/</id><updated>2024-02-17T16:55:00+01:00</updated><entry><title>How to convert CBZ to PDF</title><link href="https://blog.ledoian.cz/cbz-to-pdf.html" rel="alternate"></link><published>2024-02-17T16:55:00+01:00</published><updated>2024-02-17T16:55:00+01:00</updated><author><name>LEdoian</name></author><id>tag:blog.ledoian.cz,2024-02-17:/cbz-to-pdf.html</id><summary type="html">&lt;ol class="arabic simple"&gt;
+<feed xmlns="http://www.w3.org/2005/Atom"><title>LEdoian's Blog - til</title><link href="https://blog.ledoian.cz/" rel="alternate"></link><link href="https://blog.ledoian.cz/feeds/til.atom.xml" rel="self"></link><id>https://blog.ledoian.cz/</id><updated>2024-05-08T00:00:00+02:00</updated><entry><title>Only NAT packets you can deliver responses for</title><link href="https://blog.ledoian.cz/masquerade-with-filter.html" rel="alternate"></link><published>2024-05-08T00:00:00+02:00</published><updated>2024-05-08T00:00:00+02:00</updated><author><name>LEdoian</name></author><id>tag:blog.ledoian.cz,2024-05-08:/masquerade-with-filter.html</id><summary type="html">&lt;p&gt;When setting up a masquerading nat, it is worth considering masquerading only
+packets from known networks. That is, instead of rule like &lt;tt class="docutils literal"&gt;iifname &lt;span class="pre"&gt;eth-inside&lt;/span&gt;
+masquerade&lt;/tt&gt; use something like &lt;tt class="docutils literal"&gt;iifname &lt;span class="pre"&gt;eth-inside&lt;/span&gt; ip saddr 198.51.100.0/24
+masquerade&lt;/tt&gt;.&lt;/p&gt;
+&lt;p&gt;I learned the hard way: my laptop in a masqueraded network picked …&lt;/p&gt;</summary><content type="html">&lt;p&gt;When setting up a masquerading nat, it is worth considering masquerading only
+packets from known networks. That is, instead of rule like &lt;tt class="docutils literal"&gt;iifname &lt;span class="pre"&gt;eth-inside&lt;/span&gt;
+masquerade&lt;/tt&gt; use something like &lt;tt class="docutils literal"&gt;iifname &lt;span class="pre"&gt;eth-inside&lt;/span&gt; ip saddr 198.51.100.0/24
+masquerade&lt;/tt&gt;.&lt;/p&gt;
+&lt;p&gt;I learned the hard way: my laptop in a masqueraded network picked a wrong
+source address from a subnet the router had no knowledge about. The outbound
+packets passed through right, but the responses came in, undergone translation,
+and since the destination was unknown to the router, it used the &lt;em&gt;default&lt;/em&gt;
+route, sending the packet back to the ISP.&lt;/p&gt;
+&lt;p&gt;The result: IDS triggered by &lt;em&gt;many&lt;/em&gt; packets from my router with source IP
+addresses from all around the Internet, all with destination to my private
+address. (The ISP was not happy about that.)&lt;/p&gt;
+</content><category term="til"></category><category term="linux"></category></entry><entry><title>How to convert CBZ to PDF</title><link href="https://blog.ledoian.cz/cbz-to-pdf.html" rel="alternate"></link><published>2024-02-17T16:55:00+01:00</published><updated>2024-02-17T16:55:00+01:00</updated><author><name>LEdoian</name></author><id>tag:blog.ledoian.cz,2024-02-17:/cbz-to-pdf.html</id><summary type="html">&lt;ol class="arabic simple"&gt;
 &lt;li&gt;Extract the archive (cbz is just a zip, cbr is a rar, …)&lt;/li&gt;
 &lt;li&gt;&lt;dl class="first docutils"&gt;
 &lt;dt&gt;Convert individual pictures to PDF using &lt;tt class="docutils literal"&gt;img2pdf&lt;/tt&gt;&lt;/dt&gt;
diff --git a/output/forgetting-dns6.html b/output/forgetting-dns6.html
index c1e13cb..fae6c63 100644
--- a/output/forgetting-dns6.html
+++ b/output/forgetting-dns6.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/lifehack.html">lifehack</a></li>
 	<li><a href="./tag/software.html">software</a></li>
-	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/relationships.html">relationships</a></li>
 	<li><a href="./tag/identity.html">identity</a></li>
 	<li><a href="./tag/print.html">print</a></li>
diff --git a/output/index.html b/output/index.html
index c56459d..e3d31ed 100644
--- a/output/index.html
+++ b/output/index.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/lifehack.html">lifehack</a></li>
 	<li><a href="./tag/software.html">software</a></li>
-	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/relationships.html">relationships</a></li>
 	<li><a href="./tag/identity.html">identity</a></li>
 	<li><a href="./tag/print.html">print</a></li>
diff --git a/output/masquerade-with-filter.html b/output/masquerade-with-filter.html
new file mode 100644
index 0000000..6b39f85
--- /dev/null
+++ b/output/masquerade-with-filter.html
@@ -0,0 +1,89 @@
+<!doctype html>
+<html>
+<head>
+	<meta charset=utf-8>
+	<meta name=generator content="Pelican 4.9.1">
+	<meta name=author content="LEdoian">
+	<meta name=description content="My personal webpage">
+	<meta name=referrer content=no-referrer>
+
+
+	<link rel=stylesheet href="./theme/css/theme.css">
+
+	<title>Only NAT packets you can deliver responses for – LEdoian's Blog</title>
+</head>
+<body>
+
+<header>
+<h1>LEdoian's Blog</h1>
+</header>
+
+<div id=main>
+<nav>
+<div>
+	<!-- Main navigation -->
+	<!-- TODO! -->
+</div>
+<div>
+	<h2>Categories</h2>
+	<ul>
+	<li><a href="./category/networking.html">networking</a></li>
+	<li><a href="./category/queer.html">queer</a></li>
+	<li><a href="./category/talks.html">talks</a></li>
+	<li><a href="./category/technology.html">technology</a></li>
+	<li><a href="./category/til.html">til</a></li>
+	</ul>
+
+	<h2>Tags</h2>
+	<ul>
+	<li><a href="./tag/linux.html">linux</a></li>
+	<li><a href="./tag/lifehack.html">lifehack</a></li>
+	<li><a href="./tag/software.html">software</a></li>
+	<li><a href="./tag/relationships.html">relationships</a></li>
+	<li><a href="./tag/identity.html">identity</a></li>
+	<li><a href="./tag/print.html">print</a></li>
+	<li><a href="./tag/comics.html">comics</a></li>
+	<li><a href="./tag/ipv6-only.html">ipv6-only</a></li>
+	<li><a href="./tag/dns.html">dns</a></li>
+	<li><a href="./tag/meta.html">meta</a></li>
+	<li><a href="./tag/infrastructure.html">infrastructure</a></li>
+	<li><a href="./tag/smrst.html">smršť</a></li>
+	<li><a href="./tag/trains.html">trains</a></li>
+	<li><a href="./tag/software-engineering.html">software-engineering</a></li>
+	</ul>
+</div>
+<div>
+	<h2>Stalk me also at</h2>
+	TODO!
+
+	<h2>I stalk</h2>
+	TODO!
+</nav>
+
+<main>
+	<div>
+<h1>Only NAT packets you can deliver responses for</h1>
+<p>When setting up a masquerading nat, it is worth considering masquerading only
+packets from known networks. That is, instead of rule like <tt class="docutils literal">iifname <span class="pre">eth-inside</span>
+masquerade</tt> use something like <tt class="docutils literal">iifname <span class="pre">eth-inside</span> ip saddr 198.51.100.0/24
+masquerade</tt>.</p>
+<p>I learned the hard way: my laptop in a masqueraded network picked a wrong
+source address from a subnet the router had no knowledge about. The outbound
+packets passed through right, but the responses came in, undergone translation,
+and since the destination was unknown to the router, it used the <em>default</em>
+route, sending the packet back to the ISP.</p>
+<p>The result: IDS triggered by <em>many</em> packets from my router with source IP
+addresses from all around the Internet, all with destination to my private
+address. (The ISP was not happy about that.)</p>
+
+	</div>
+</main>
+</div> <!-- #main -->
+
+<footer>
+<hr>
+Written using Pelican 4.9.1 by LEdoian.
+</footer>
+
+</body>
+</html>
diff --git a/output/mobius-print.html b/output/mobius-print.html
index 8e4ae4c..c9a8543 100644
--- a/output/mobius-print.html
+++ b/output/mobius-print.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/lifehack.html">lifehack</a></li>
 	<li><a href="./tag/software.html">software</a></li>
-	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/relationships.html">relationships</a></li>
 	<li><a href="./tag/identity.html">identity</a></li>
 	<li><a href="./tag/print.html">print</a></li>
diff --git a/output/smrst2023-cs.html b/output/smrst2023-cs.html
index f266576..e454445 100644
--- a/output/smrst2023-cs.html
+++ b/output/smrst2023-cs.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/lifehack.html">lifehack</a></li>
 	<li><a href="./tag/software.html">software</a></li>
-	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/relationships.html">relationships</a></li>
 	<li><a href="./tag/identity.html">identity</a></li>
 	<li><a href="./tag/print.html">print</a></li>
diff --git a/output/tag/comics.html b/output/tag/comics.html
index 09d850a..0bcfa5f 100644
--- a/output/tag/comics.html
+++ b/output/tag/comics.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/tag/dns.html b/output/tag/dns.html
index 1ecc6c7..a593038 100644
--- a/output/tag/dns.html
+++ b/output/tag/dns.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/tag/identity.html b/output/tag/identity.html
index 85cb11f..ec440a2 100644
--- a/output/tag/identity.html
+++ b/output/tag/identity.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/tag/infrastructure.html b/output/tag/infrastructure.html
index a6075f0..7d573be 100644
--- a/output/tag/infrastructure.html
+++ b/output/tag/infrastructure.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/tag/ipv6-only.html b/output/tag/ipv6-only.html
index 11be38c..982b4f5 100644
--- a/output/tag/ipv6-only.html
+++ b/output/tag/ipv6-only.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/tag/lifehack.html b/output/tag/lifehack.html
index 40ba2c1..c9e2166 100644
--- a/output/tag/lifehack.html
+++ b/output/tag/lifehack.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/tag/linux.html b/output/tag/linux.html
index 552582c..956019b 100644
--- a/output/tag/linux.html
+++ b/output/tag/linux.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
@@ -63,7 +63,8 @@
 <main>
 	<div>
 <h1>Articles tagged with linux</h1>
-<ul> <li><a href="../custom-xkb-tweaks.html">Creating own XKB tweaks</a>
+<ul> <li><a href="../masquerade-with-filter.html">Only NAT packets you can deliver responses for</a>
+<li><a href="../custom-xkb-tweaks.html">Creating own XKB tweaks</a>
 </ul>
 	</div>
 </main>
diff --git a/output/tag/meta.html b/output/tag/meta.html
index 76c3c44..b0c0c8a 100644
--- a/output/tag/meta.html
+++ b/output/tag/meta.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/tag/print.html b/output/tag/print.html
index 8567dda..afd2549 100644
--- a/output/tag/print.html
+++ b/output/tag/print.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/tag/relationships.html b/output/tag/relationships.html
index c1d5e64..2aa085e 100644
--- a/output/tag/relationships.html
+++ b/output/tag/relationships.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/tag/smrst.html b/output/tag/smrst.html
index ebc423d..353090d 100644
--- a/output/tag/smrst.html
+++ b/output/tag/smrst.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/tag/software-engineering.html b/output/tag/software-engineering.html
index 3e8c23e..d6e0000 100644
--- a/output/tag/software-engineering.html
+++ b/output/tag/software-engineering.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/tag/software.html b/output/tag/software.html
index e4835f4..4996962 100644
--- a/output/tag/software.html
+++ b/output/tag/software.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/tag/trains.html b/output/tag/trains.html
index 7ed6136..9dc2deb 100644
--- a/output/tag/trains.html
+++ b/output/tag/trains.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/lifehack.html">lifehack</a></li>
 	<li><a href="../tag/software.html">software</a></li>
-	<li><a href="../tag/linux.html">linux</a></li>
 	<li><a href="../tag/relationships.html">relationships</a></li>
 	<li><a href="../tag/identity.html">identity</a></li>
 	<li><a href="../tag/print.html">print</a></li>
diff --git a/output/tags.html b/output/tags.html
index aa91952..84dd594 100644
--- a/output/tags.html
+++ b/output/tags.html
@@ -36,9 +36,9 @@
 
 	<h2>Tags</h2>
 	<ul>
+	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/lifehack.html">lifehack</a></li>
 	<li><a href="./tag/software.html">software</a></li>
-	<li><a href="./tag/linux.html">linux</a></li>
 	<li><a href="./tag/relationships.html">relationships</a></li>
 	<li><a href="./tag/identity.html">identity</a></li>
 	<li><a href="./tag/print.html">print</a></li>