Networking on Margrop Blog

Stop Buying the Wrong Alibaba Cloud Load Balancer: SLB, ALB, NLB, and CLB Explained

Thu, 09 Jul 2026 21:40:00 +0800

Short version

On Alibaba Cloud, do not treat SLB as one single instance type anymore. The more accurate mental model is this: SLB is the Server Load Balancer product family, and the concrete choices are mainly ALB, NLB, and CLB.

ALB is the Application Load Balancer for Layer 7 traffic such as HTTP, HTTPS, QUIC, gRPC, and SSE. If you need routing by domain, path, header, cookie, method, or query string, start here.

NLB is the Network Load Balancer for Layer 4 traffic such as TCP, UDP, and TCPSSL. If you need massive connections, low latency, long-lived sessions, IoT, audio/video, or a message-service entry point, start here.

CLB is the Classic Load Balancer. It supports TCP, UDP, HTTP, and HTTPS, with solid Layer 4 capability and basic Layer 7 features. It is still useful for existing systems, but new designs should usually evaluate ALB or NLB first.

A simple analogy: ALB is a receptionist who understands business rules, NLB is a high-speed toll gate, CLB is an older all-in-one service counter, and SLB is the name of the whole building.

Cross-Border VPS Feels Glacial? One Kernel Sysctl Speeds International Links 20×

Thu, 02 Jul 2026 20:00:00 +0800

The short version

You’re accessing your overseas VPS from within China. SSH feels snappy. curl on a small JSON endpoint returns instantly. But downloading a 2 MB HTML file takes over a minute. Convinced it’s “peak-hour international link congestion”? Probably not — you’re being sabotaged by Linux’s default CUBIC congestion control. CUBIC treats every packet loss as “the road ahead is jammed” and immediately backs off. But international links have baseline 5–15% loss from physical-layer imperfections, not congestion. So your TCP flow gets permanently stuck in slow-mo. Switch to Google’s BBR algorithm and the exact same physical path, same moment, same loss rate delivers 15–24× more throughput.

This post walks through a real mesh-VPN investigation: pulling a 2.3 MB page from a US VPS across a Chinese home connection went from 30 KB/s to 500–1000 KB/s after four shell commands. It ships three one-shot scripts (Windows 11 / Ubuntu 26.04 / macOS 26), covering both manual execution and AI-agent-driven deployment. All internal IPs, hostnames, and public IPs have been redacted.

The Portainer 500 Error That Wasn't the YAML — A Two-librespeed_default-Network Story

Sat, 13 Jun 2026 08:00:00 +0800

The short version

You update a stack in Portainer. The browser slaps you with a red 500 Internal Server Error. You assume the YAML is wrong, fix the indentation, swap the quotes, drop the image tag. You hit Update again. Same 500. And again. And again.

The real culprit is buried at the deepest level of the HTTP response body: network librespeed_default is ambiguous (2 matches found on name). Two networks with the same name exist in the same Docker engine—two IDs, two Created timestamps, two com.docker.compose.config-hash labels, but a single shared name. Compose asks the engine to look up that name; the engine refuses to pick between them; compose up fails; Portainer wraps the error as a 500 and returns it to your browser.

The fix is embarrassingly simple: delete one of the two orphan networks (docker network rm <id> or click Remove in Portainer’s Networks page), then re-run Update the stack with the exact same content. It just works.

This post is a real debugging session: a stack update that was supposed to be a 30-second mount-path change turned into a 1-hour investigation. All private details (internal addresses, registry URLs, volume paths, container names, credentials) have been replaced with <PLACEHOLDER>. Only public source code, official docs, and the error text itself are preserved.

The Docker Container Is Running, the Port Is Dead: A Complete Walkthrough of a Silent Host-Bind Failure

Sat, 13 Jun 2026 07:30:00 +0800

TL;DR:

docker ps says everything is fine. docker inspect’s HostConfig.PortBindings clearly says 203.0.113.14:3001:3000. But on the host, no docker-proxy is listening, the iptables nat/DOCKER chain has no DNAT rule, and NetworkSettings.Networks and Ports are both empty {}. This “container alive, port dead” state is what happens when libnetwork silently rolls back the endpoint creation because the target interface wasn’t up at attach time — and Docker doesn’t bother to tell you that the port publish never actually happened. The fix is a single 30-second command: docker network connect <net> <ctr>.

VPN Connected, But Internal Hostnames Won't Resolve? A Complete macOS Routing Table Walkthrough

Mon, 01 Jun 2026 18:00:00 +0800

TL;DR:

When two VPNs run side-by-side on macOS (e.g. utun0 and utun15), an aggregate 10.0.0.0/8 route pushed by one of them can silently “swallow” every address in the 10.x.x.x range — including the one you actually wanted to reach on the other VPN. DNS resolves fine; TCP/ICMP just hangs. route -n get is the first knife you should reach for.

You Can SSH Out, but Not Back In: A Fail2Ban False Positive That Broke Reverse Access

Sat, 30 May 2026 15:45:00 +0800

Bottom line

The symptom looked simple: I could SSH from the local machine into a remote internal host, but the reverse SSH path failed when the remote host tried to connect back. sshd was listening, the route table looked fine, and the failure still happened.

The real root cause was not a broken SSH daemon. Fail2Ban had banned the VPN gateway address that represented the return path. From the local machine’s point of view, the incoming SSH session did not appear to come directly from the remote host. It appeared to come from the gateway, so the ban cut off the whole reverse path.

Home Network 1000Mbps but Games Stutter? A Complete Guide to Diagnosing and Fixing Bufferbloat

Sat, 30 May 2026 09:00:00 +0800

The Short Version

Your router has a hidden enemy called Bufferbloat — and it’s likely the reason your games lag even when your bandwidth test shows perfect speeds. When a router buffers too aggressively, download traffic fills up the queue and real-time traffic (games, video calls) gets stuck waiting behind thousands of buffered packets. Your speedtest stays at 950Mbps, but your game ping explodes from 50ms to 500ms.

In this article, I walk through the complete diagnosis and resolution of a Bufferbloat problem in a real home network environment using a multi-WAN iKuai gateway + ImmortalWrt soft router setup. The fix: deploying SQM (Smart Queue Management) + Cake qdisc on the ImmortalWrt layer, which reduced latency under full-speed download from ~300ms+ down to a stable ~12ms with zero configuration complexity.

All internal IP addresses, device hostnames, and network topologies have been sanitized for privacy.

Python App in macOS LaunchAgent Can't Reach the Internet? Here's the httpx Proxy Trap You Need to Know

Sat, 30 May 2026 09:00:00 +0800

TL;DR:

When a Python application using httpx with trust_env=True runs inside a macOS LaunchAgent, it silently picks up the system proxy settings from scutil --proxy. But the LaunchAgent process may not be able to reach that proxy server at all — resulting in All connection attempts failed or No route to host errors.

The fix is one line: add NO_PROXY=* to the LaunchAgent’s plist EnvironmentVariables.

This article documents the full debugging journey: from discovering that my AI Agent’s WeChat Enterprise (WeCom) messages weren’t being replied to, through methodical proxy troubleshooting, to finally pinning down the root cause — macOS system proxy + LaunchAgent network isolation. We’ll dive deep into Python httpx source code, macOS proxy architecture, and the many gotchas of LaunchAgent runtime environments.

Seamless Homelab Networking: Deploying Tailscale on Ubuntu 26.04 for Effortless Remote Access

Tue, 26 May 2026 14:00:00 +0800

The Short Version

Cross-carrier connectivity, lack of public IPv4 addresses, and multi-device connection management have always been the ultimate pain points for Homelab enthusiasts and enterprise sysadmins alike. This article provides a comprehensive, step-by-step guide on how to cleanly and securely install and configure the latest version of Tailscale on the newly released Ubuntu 26.04 (Resolute Raccoon) using the modern APT Keyring standards. Beyond a clean command-line install walkthrough, we delve into the architectural design of Tailscale, Subnet Router routing, and Exit Node proxying to establish a seamless, encrypted mesh network linking your home Synology NAS, Proxmox VE hypervisors, remote laptops, and mobile devices.

All setups and commands documented here have been rigorously tested on a clean Ubuntu 26.04 (Resolute Raccoon) environment. To prioritize safety and avoid leakage, all internal IP addresses, access tokens, routing tables, and server domains have been fully masked using generic placeholders.

[Transfer] Installing and Configuring an ImmortalWrt Bypass Router

Mon, 11 May 2026 21:10:55 +0800

This article is a full English translation of Egg Targaryen’s “ImmortalWrt旁路由安装与配置”. The original article is published under the CC BY-NC-SA 4.0 license. The operation order and screenshots are preserved, with minor formatting adjustments for this site.