Welcome to the Premier League show. It's actually a good, it's a happy week for us to talk about Premier League football because I haven't won a Premier League game. I feel in a Premier League mood. I feel in a Premier League mood. No, we've been very much in Championship mode last week. But this week we can talk about the Premier League. There was a huge game over the weekend to determine where the Premier League might be heading. Barely versus Norwich. Obviously Manchester City Liverpool. Which is developing into, it is over the last three or four years really developed into a rivalry. A friendly rivalry. Well it's not what it is, it's like a high quality rivalry isn't it? Because they've been the best two teams for the last four years. I think every year's been narrow. And even at the years that the both teams have won it by a margin. When you've had the points together it's still a point narrow or something like that. Over three years. So when you look at it like that it is developing into probably maybe one of the highest quality rivalries. That's what I would say. I would say. But biggest rival, I've seen that mention a couple of times, is this the biggest rivalry? Well the lads over on the last fan stand have been discussion who they think has been the biggest Premier League rivalry. I think the most fiercest rivalry and not Darby was Manchester United Arsenal. There was always a little bit of needle there between the managers, needle between the players, the captains. Everything you see Kevin De Bruyne and that walking off the pitch, shaking each other's hands, holding each other and that. And it's all a bit friendly. So I do think in terms of football wise and the quality of football it's right up there with the Arsenal Manchester United stuff. But I do think there's not enough needle there for that to be the fiercest rivalry. That wears the Viera on the team. Although in terms of the quality of the football, it's of course right up there. In terms of a Darby, I've always thought obviously Manchester United Liverpool's biggest two teams and when we play each other, I'm more nervous for that game than anything else. But the quality of the games is never really great. As a neutral, I always enjoy watching the North London Darbys because they are usually good games of football, do you know what I mean? But yeah, in terms of the fiercest rivalry, I have to go to Manchester United Arsenal. All I've got to hold on to is the past and believe me, I'm holding on to it. Interesting, interesting. I mean they have just brought from obviously Arsenal to Manchester United, which was a different kind of rivalry. It was a two fantastic team so they were but there was real aggression and needle in them ones wasn't there. I think you talked a bit about this last week you mentioned that it was the Viera cream. All of that, you did? Yeah, that was an unbelievable rivalry for a few years ago. I think that was the best rivalry. Don't get me wrong, this man sitting there with a poor rivalry is good to quality. Probably the highest quality, don't get me wrong. But that was two teams going at it. I didn't like it or did it. Lot of needle, lot of personality, you know, North East South, managers who didn't quite get on at the time either. In later years did, you could kick each other. Which I always find is great. I always do find that. I think it's one thing missing at the moment is that you can't kick people. That's why I like to come with it so much. I really do.  Now I really like that rivalry. And listen, that just might be my age. It was two teams who absolutely flippered each other. And I know Liverpool and Man City do. And again, no issue. It's good football and stuff. But now it's very much is in the spirit of the game. No one's really touched. I mean, Liverpool players did touch some of the Man City players. But then it was just a different thing for me. Man City United at, you know, 1999 won the Champions League and won the league. We're winning all the titles when then Wenger came in and had to somehow stop that. And of course Arsenal went to Old Trafford and won the Premier League. To do that turn around and then go to... And then Arsenal then become an amazing team with Viera and with Andre. And then United had to wrestle it back. And then they beat them, I think United beat them 8-2 at Old Trafford one game here on the season. And then I think it sort of ended up actually with Man City United by Robin van Persie. And that was the last time they won the league. And that was like the end of it. I'm saying that was the end of it because Man United... That sort of was the end of Arsenal being a big team because Wenger left not long after. Maybe a year or two later. So Alex left and Moise took over. And that's where the rivalry ended. It ended with Robin van Persie leaving. And that was like the exclamation mark that Man United was like, we are the bigger team, we are the better team. And I just thought it was fat. It was just for me that's when I just think football was at its highest. The football itself might not mean as good as what it is now. But the mix of aggression and it was before... Put it this way, it was before players started doing that when they talked to each other. That has been the death of football because that to me signifies how self-aware football players are of what they say and what they do. And suddenly football has just gone very, very beige. But the football is amazing. I have to say this rivalry is incredible. Listen, there's been other rivalries I think we did speak about last week. But I just love that rivalry. I just think when people talk about like Viera and Keane and these two teams, they will look back and say the same about City and Liverpool. And it will be looked upon as the best of the best of the best. But I personally really enjoyed that rivalry. No, it was fantastic. We had the situation, didn't we? Arsenal won it in 98 with Wrenge and he came and he'd been in a couple of years and then United went better the next year by winning the league and the Champions League. And then he did have a little bit of a ding dong. Remember, Wiltshawd scoring and Old Trafford. Overmars scoring and Old Trafford. We had the van Nisterwy and Martin Key home things and Keane and Viera. And it did, it went on. I write it, it was kind of when Van Persie was bought by Manchester United and he went and won the title and then Alex Freed, Alex left. That was it. Wrenge stayed there till 2016, didn't he, over a few years. But it had gone then and Manchester City started picking off Arsenal players. Didn't he have the buy or Shania and all of that? Arsenal were dismantled a little bit because we were obviously given to the end and the money, the different ways that they couldn't spend as much money and Arsenal Wrenge was trying to still build it in the old style. And it did move away a little bit and it has been replaced with this with Liverpool City, hasn't it? I also think that played a part in it though, leaving the hybrid. It was something special about those games, the hybrid with Man United. It was something really special, that horrible tight tunnel. Like everything I've obviously got now. That hybrid was brilliant. That led to obviously the Keane and Viera situation. There was so much. What was the one at Old Stafford, the Petergate? Where Fabregas threw a Peter to Alex Ferguson? Like a hot Peter or something? There was all kinds going on. All stuff went on. To me. And I might be a little bit old fashioned now and I might be a little bit older, but I love that stuff. I love Neal. We even had Champions League with Arsenal United at Old South of Ronaldo with that free kick from about 40 yards and stuff. I love a bit of needling again. I love something extra. I love... Cos to me that's what football is. It's not about... There's the mental side. Teams have got to get over of knowing that it's going to be a battle. Football... Some of the football being played at the moment by the two teams is incredible. But it's also quite sanitised. And as I said, I've seen athletics when we did play in this week and a lot of people have said how disgusting it was and all that. I thought it was brilliant. I like that kind of stuff. I'm sorry. It might just be me. I like that kind of stuff.  That's footy. That's passion. That's what I wish there was more of them footy, but it isn't. Don't let me down. Not fouls, not kicking. It's out of each other. What I mean is that little bit of competitive... We can't tackle now. Look at another team and go on.  You're better than us.  And again, that's not like... It can be perceived in many ways. A lot of people don't like it anymore, but I love it. I love the dark arts. I absolutely love the dark arts in football. And... You know...  They know how to survive. Our players in this country now are just... They come through the academy systems and it's all 1990. And people wonder why they can't survive in the competitive games. And yet people come. And they... People come to South America in places and they will give everything, everything, and they don't mind diving, they don't mind throwing themselves on the floor, holding their face and all that kind of thing. To me that I love it all. I don't know what it is. You've just mentioned the purity. This was obviously... There was a couple of naughty challenges by Liverpool players in the game, but the game in general seemed to... Excellent club. Excellent football side. Doing battle. City probably should have won it. But you know, it's true too. And still, the point separates them at the top of the table. You know what I'm saying? I mean, just the first... The brilliant and obviously Gabriel has used to say to Alexander Arnan to say to play off side, I think. Not realising it was... I think it might have been matter if we'd keep someone on. For the second goal in Liverpool he could have been great ball by Salah Tamanai, but just when you look at Jota for Liverpool, what a sign he's been, because at Wolves, he's a good player. Got ten goals, but he's gone there. When you think he missed out on... Rena. Yeah, I know. You know what I'm saying? If he was gone... Timo Rena would have been good for Liverpool. No, I know, but it's the fact that he missed out on him. Then when he got somebody else for 20 million quid and his goal record is unbelievable, he's... Come in... It's 40, wasn't it? It's what? 40. 40? Sure he was, yeah. Right into 40. Yeah. No, he's been great. He's come in, took the pressure for me and he all doesn't really... haven't really scored a lot of goals. As a small man. As a small man, of course. He's a great striker. But he's come in and he's took over the goal... goal responsibility. And I think what actually happened by him taking over the goals was then Liverpool stopped relying on Salar and Mali to score in every single game, which meant you could leave them out then.  And then... So he comes in and he's not relied on to score because you know Josh is going to score. And suddenly, where Liverpool used to be by this time of year. They're not anymore. And that's what. Well, they've got five and if you include the league, you could wheel out a Christmas to let them win with a few goals. They've got six left. But that's the thing. But the thing about it is it used to be like you had to rely on one and to score man A or whatever. But now, they can just change the team role and they're up it. The frighteningly good. And then you've obviously got the purity of Manchester. They were just incredible anyway.  If he was, it was you talking minuscule. The post as well. Mara's last minute at the post. But don't you think though that that's the thing though is that Manchester City can play that well and then not win? Well, that's twice they played Liverpool. Two, two, twice. He's been a better side and both should have put the game to bed and both. And that's Jamie Carrick as well. By the way, not just in Evertonian speaking. Well, no. Yeah, Jamie Carrick at the Evertonian. And Liverpool have held on in there for both games. So a point in it, eight games to go. Some big games coming up for both of them. They both got through in the Champions League this week. Liverpool got Villarreal in the semi with the Fancy themselves. All of Villarreal. Won't be any four shows having not just not by me, you know, of course. Chelsea, sorry man City have got Real Madrid, haven't they? Almost at Chelsea. So they've got some big games and all of them have got United next. I think the weekend in Manchester. It's semi-final this weekend. Manchester City at Wembley on Saturday. Then they've got United. Then Everton. They've got big games coming up. Yeah, that's what you want if you're there, isn't it? But like you've just said with the players, they've got the squad, they've got them can handle it. So it's going to be very tight and you wouldn't put a past going to the last day with a point in it as well, would you? So very, very, very tight. Two, two with those. Just touch, you know, obviously that's the top too. Chelsea, who we'd seen the week before, you know, get smashed around by Brentford in a weird game. Went to Southampton and for a while looked like Southampton were on for the third consecutive 9-0 in a year. Didn't it?  But Chelsea going to Southampton and just really blitzing them. It was like they took an out on them, wasn't it? What happened in the Brentford game and what happened in the Real Madrid game and the first like, they just went after them and they just took them to bits. You know, counter-attack and pace. I mean, team over Henry. Yeah, yeah. Both post and the crossbar in the space of the first 25 minutes. And ended up with two goals. Ended up with two goals, but no, they just clicked and they made some out. It was brilliant. They have 14 attempts on target, Chelsea. They went Southampton. I'd love to be playing Southampton now. They just look like they've got the flip-flops on and they're ready. They've got their 30 odd points on and they're ready now. They'll win another game or two before the end of the season, maybe one or two, hopefully. One in a couple of weeks. Actually. And they've got the flip-flops on and Chelsea just, I wouldn't in no mood to ask about. Strange, Chelsea, aren't they? When you look at the players they've got and you see they can do that and we've seen them at the bit and they've gone midweek 3-0 up and gave a super goal away otherwise they'd have got through. I think you see them drop games, like Bradford and things like that. The main thing about Chelsea is it's just don't think they've got the squad.  I think that's where the top two get away from them is that they've just got, you look at Chelsea's bench and I think when push comes to shove they're just not good enough. They've got a kind of squad which is good in October and November when it's like, when it's, when you're in the group games of the Champions League and you can bring in maybe your Ross Barclays and you're off the cheek and people like that. But I think when push comes to shove and every single game is massive that's to me when Liverpool and City are just like, we can put out a first team, we can put out a first team, we can put out a first team. I think that's where Chelsea lost their two wing backs and they couldn't replace them. You just didn't have the quality and the minute that happened the minute Chelsea started to drop the forward options are weird. Cae Averett has ended up being the number one centre forward after spending nearly 100 million on the car crew and yet look how opposite they are they're just not compatible with each other. Chelsea are still awake in progress but they're going to have to spend big and bring in some really good players to fill that squad out. I think they'll take Gallagher back and I think he will definitely play in that Chelsea side. I think his energy will be will be massive in that Chelsea side by the way. I think, but I don't think the likes of you look at like, you look at... Probably do a bit wrong. I'd probably sell them, I'd probably sell them back to into my land. It hasn't worked. It's not going to work like Thomas Tushall did. They just don't play the same style. And I think they need to go and bring in another Cae Averett kind of centre, an intelligent centre forward. Harry Cae? No. He's intelligent but they're not going to go with any man now. But yeah, they're just, that squad it's weird but it's just not good enough. As I said, it's a good enough squad to beat. You know. Good enough to finish there. It's good enough to finish there. But when you've got the group games of the Champions League, but when you have to take it further than that, I just don't think it can, I just don't think it's got the quality that replicates the other players. So... Fair enough. Obviously that's them third. Come through the right for fourth. It's very interesting. It's very interesting. Arsenal were around to Brighton at the weekend. And Arsenal had been in really good form until Liverpool beat them in the other weekend. And since then, you know, lost heavily at Crystal Palace, didn't you? Brighton at home. The opportunity to get back on track with that. And they go and get beat. They go and get beat at home by Brighton. Two defeated a week? Yeah. For them, it's like that's big, isn't it? Yeah. Especially when you've got Tottenham. Tottenham breathing down there. No, your main rivals. And the thing about it was, United are three points behind Arsenal. And Everton had beat United at half twelve. So, you know, Everton winning one nil. We'll turn back to that. But that would have given Arsenal that. Like, we can get six points ahead of United now and really keep them away. And the goal when we use your body blowers is to get beat around by Brighton. Yeah. They haven't won many games of football. They haven't scored goals. No. They haven't scored goals. So, to score, they were going behind. They had one real factor before half time. Yeah, yeah. And then you expect them to come out to second half and they conceded the goal. And yes, they got on like time. But it's the wrong time. It's the wrong time to stumble, isn't it? It really is the wrong time. Tottenham are on the absolute, an absolute charge. And of course, Tottenham beat Willard the day before four nil. It comes to the same day. It was at half five, wasn't it? It was after it. Tottenham kicked off at half five last night. And that, to go to Willard and win four nil after you just, your rivals have just lost their home to Brighton. Spears winning Harry Kane was, was unbelievable. In this game, get Willard started. The first twenty minutes, Willard could have been ahead. Willard, Willard, Willard. Willard, he was brilliant. Willard, he couldn't have been ahead because Sonthill had the three minutes, but he should have been. Willard, Willard was brilliant. I mean, I think Gerard, at the end of the game, I've got no complaints. After Tottenham had scored, Willard must have had six or seven shots. The Reese's made some great saves. You've had blocks. You've had things off the line. You've had all sorts. And then what happened is, they come out to second half and were in a minute, I think, well, two minutes. Spears got the second one.  Son's goals.  But Willard was really unlucky in this game, actually. Willard, 52%, 19 attempts at goal to 11. Exactly. For eight on target, Willard. Five for Spears. Spears, five on target, one for him. It was not a four in the game, this. But for Spears, fantastic. See, Arsenal lose, United lose.  Of course, lot of pressure on Stephen Gerard now. Some quarter sign, he'd be gone at the end of the season. I don't know whether they believe that. But he is under pressure cos he had the one in the games of football. And every manager has to win football matches, don't he? But for Spears, brilliant. Absolutely brilliant. And that's really give them, you know? They've got that momentum just at the right time. He got Peter Burnley and Conti gave it the arm. I don't know whether I'm the right man. I might have to. I'm convinced he was going to do that. And since then, he's just been on a great run there. Day fourth now. So goals as well. Well, there are three points that have Arsenal, Arsenal have got a game in hand. But they've got to play to that. But they've got to play to that. And then obviously, it gave Westlam a great opportunity to get within three points of Spears on Sunday and they went to Brentford and end up getting beat soon, you know? Well, David Moyes was very disappointed with... They were very flat-weight. They were a little bit like when they played Everton the week before, played the week before. I think Everton should have got something out of that game. And I think in this, Brentford's need felt a little bit more than they need. And they were very, very flat in between the... The European games. No, it's in the European games. And they just felt really, really flat. And Brentford just took advantage to just basic goals. The body language to the Westam plays was... It was just like, oh, again, we've got to play this game. I said that about last week when they played Everton. It was just like it. They were there for the taking. If Everton just didn't have any mistakes and Brentford didn't have any mistakes, they've done everything the right way and got the two goals. Flying out the Brentford. It was quite an easy game for them in the end. It was in the end. They have 15 attempts at goals, so Westam's five. Yeah. Comfortable now, Brentford, whereas you've got 37 points there on now. 36 points, so 36. Moving to the other end of the table, obviously Friday night, so on Newcastle beat Wolves with a penalty. Yeah. Chris Wood penalty. Settle that one, so settle Newcastle's nears. And I think that's probably enough now. And I think for Wolves as well, though, I think that'll be one of those games where it's like you've missed a boat on Europe now. I think that top seven is the top seven. Yeah, the chance Wolves, if they'd have been able to get over the line in that. But Newcastle deserved it. Newcastle would have better said. 34 points now. Obviously if Wolves were the one with Everton's win, they'd have been adding it again. I think that's something two points for three in a trot. Big win for them. They're safe, like you say Wolves, I think. Wofford that home to Leeds. If Wofford were going to do anything, it'd have to be Shatley and Leeds. Well six, as it was straight after Everton, at one, obviously Wofford would have known. They would have known that they were six points behind, playing someone who was not that far ahead in terms of seeing the head of Everton at the time. If you're going to try and catch a couple of teams. They'd have gone with them five points, Leeds, if they'd have beaten them. Leeds just had a nice day out, didn't he? Put three past them, nice and comfortable. Wofford got punished again for the mistakes. Had a couple of chances, but got punished. I think that puts Leeds safe. I think Leeds is safe now, to be honest. I think they'll know they can get one more win or two more wins out of their remaining fixes because they'll be nice and relaxed. I know they can go and get the win. So I think that kind of has put them safe now. They're on 33 points. The Burnley. I think Leeds will get one if not two more wins. So that don't see any problem for them. But that Leeds Wofford, obviously, right in the midst. They're in trouble now, yeah. They're in big trouble. Because it's a mountain climb, isn't it? No, yeah, because absolutely. Sunday, so Norwich and Burnley. A car or road. A game that I thought would go this way, went away, I thought. For the simple reason that, I watched Burnley beat Everton and he went very good. And Burnley scored goals because Everton just made ridiculous defensive errors. One thing Dean Smith's done is made Norwich more tough to beat. They're not necessarily, because he can't make miracles, but what he's done is tighten them up. So I looked at them and thought, I'd watched them a brightening before and thought, they won't give Burnley the type of... because the centre-backs are going hand-leaning and they're big lads. And they literally didn't give Burnley anything. And they put loads of blocks in and loads of... They got the goal early on, off the great start and then goes into the second half and Coney obviously misses that big chance. Tapping at the far post and he's just got it completely wrong. Then Norwich got a late second goal. What a first touch that was. And it's all... It's gone back to four points again obviously. Seen it. That's not the be all and end all because both teams have got tough fixtures but there's still plenty to play for. Sailing with the fixtures four as well. What for the playing this weekend against Westam which it is a win. Burnley surely have got Westam this weekend but of course... What for they've got Brent for their own this weekend. Because Westam are in the European action you don't know what that will take out on them. And then Burnley playing next week after Evan have played Leicester it's still... And then Evan play like the Liverpool and Chelsea then. So it could definitely swing around between now and then. If Evan could obviously keep that nice cushion they've got now for as long as possible. If not the whole of the season that would be really really nice thanks. See what you're saying about Leeds and you're right by it it's yes you must and Leeds don't play for it. Leeds don't play till after Evan have played to get another two games. Okay one of them is Liverpool but Leeds are at Palace and Palace are playing. So if Evan would have beat Leicester next week at home which you'd like to think Leicester needs greater because Leicester aren't going up all down there fine then Evan would be two points behind Leeds but that to me just says Leeds are never in the safe now. No but I'm saying because yes you are saying that it looks good now but I expect it to be tight by the time we play again because of Evan. I mean that would be nice to pull Leeds in so that we've got some direction. But I think you might be right I think I still know what you're saying about West Ham but I still think they'll be barely. For the simple reason that Moise tends to get the results that he should but you don't know it's still tight it's very very tight barely if they'll be kicking themselves. Just mentioned Palace they went to Leicester they were level points and Evan before they're getting Leicester won a 2-1 didn't he a bit a little bit navy at times but Adam Ola Luchman and Jules Brieho fell Leicester Wylfsharhawer they two teams in the Premier League not a multiplayer I mean they've both got in cup competition so they've got something there but in the Premier League they're both with Yano Just very just briefly go back to Manchester United and Evan obviously spoke of our Evan a big win for them in the need of it. But Manchester United he watched them a close quarters on Saturday a lot of stuff about 10 har taking over and different things but you're just disappointed not disappointed because like you want United to be great but when you look at United and the money they've spent they're just so disjointed at the moment you watch them they're very very average they've got very average players they've paid a lot of money for very average players and it sounds like another team yeah there's just a very average team you don't really seem to have a strategy they don't seem to have what's wrong with Popper he's not average he's finished, he's done but again though it's that thing of what makes it a good player and I don't think I'm glad with loads loads of skill he's so kind of a good player I just see that you're saying for France and he's generally good for France it's a very straightforward thing he plays for France he's good for France and he loves playing for France and he knows he knows like the team's basically partly built around them but at Man United he's he's got issues he should have been he should have been kicked out when LeCacu went really that's when he should have gone but he wasn't ultimately they're just a team of individuals aren't they individuals who Ronaldo is like the king individual isn't he he's like the king individual who just yeah and you know he doesn't like people's mobile phones so there you go so I think they've got a long long way to go long way to go let's just have a look at the league table before we finish then Man City top of the league by a point from Liverpool and obviously we've talked about Chelsea there the race for the top four is tight between United and Spares and at the other end we've just been talking about obviously Everton Leeds, Burnley, Wafford, Norwich it's still very tight down there albeit a little bit nicer than when we done this programme last week a little bit of breathing space but it'll probably get tight again before the season finishes so yeah there you go make sure you check out the last fan stand and the rest of that for the debate about biggest rivalries the link is in the description get over there leave a comment as well as for us we'll see you later


The form ain't a big robot. Do you let children watch TV? Normally I would say there is no harm in that, just put on Nickelodeon or something and let them sit there for an hour or two. That was before my brother. They do it at random, mostly. Every couple weeks or so they find a child, the younger the better, and study them. How they study them, I do not know. A secret camera somewhere, a well-placed bug. But they watch you. Then they attack. They start by cutting away companies like Dish or Direct TV, so you are left with just basic table. Then they put in a channel. The channel number is irrelevant, because no matter what it is always on the even-numbered channels. Every second channel is this channel. Parents don't mind. What is on that channel is nothing but one show. One show with one episode, playing on Luke Forever. Johnny, my little brother, was three when he discovered Big Leo Friends. Our family just lost Dish, and were thankful he wasn't crying over Blue's clues anymore, so we just let him watch it. He loved the show. We didn't know why, he just loved it. My family, myself included, didn't bother watching it. Didn't bother noticing it was the same episode on Luke, didn't bother changing the channel. All we knew about it worked with Glance's walking through the living room. It looked okay. Bright colors, calm voices, and cheerful, fun people happily dancing around in wacky costumes. Perfectly okay for a three-year-old. Pretty soon he started showing some strange behavior. Nothing too out of the ordinary. He started acting more mature, and demanding things rather than asking for them. He never invited friends over anymore, instead all he did was watch that show. Memorized. No one could turn it off. When someone tried he didn't cry, just kept demanding, in a hushed and re-voice. Turn it back on. Though unsettling, my parents dictated it as a phase and cooperated. I however was skeptical. One day I had some time to kill, so I decided to sit down and watch the show. My brother was not phased in the slightest by my presence. I sat down, just as another episode came on. The first thing that kept me was the theme song. We are your friendly friends. As friends we are there. As friends we are everywhere. We as friends we care. As friends we share. We... Despite the lyrics, the song sounded cheerful, happy. So happy in fact that unless you actually listened to it, the little tune sounded normal. The rest of the show itself wasn't much different. Just a bunch of mascots comically dancing, and playing well explaining various phrases from the song. We are the only ones you love. We are your Biblio friends. Your own?  The phrases were said in hushed whispers, as if a parent scolding to their kids after they did something bad. Every now and again for about two minutes, an orange screen with bright blue letters would show up for two seconds, saying, Be a Biblio friend. This continued for the entire 30 minutes of the episode. I watched another, just to be sure. The same exact thing. I told my parents everything about the show. But they didn't care. Before Biblio friends, Johnny was a pain to deal with. Now he was mostly well behaved most of the day. School gave him all the exercise he needed and he was eating, and going to bed at times. They said the show was okay. They've seen it. But not like I had. It was a month or two after Biblio friends showed up. Mum and dad never went back to dish because they said they didn't have anything close to Biblio friends. I had a date that night. When I left, Johnny was watching that show. I had expected he would still be watching the show when I returned, like always. Not tonight. When I got home around 10pm, I noticed all the lights were on, just as they were when I left. I had a strange feeling. Like something was about to go wrong. Inside the family room, everything was a mess. Touches were turned and flipped. Paintings had fallen and broken. There were a few holes in the wall. Mum, dad and Johnny. No reply. I entered the living room. There was some damage but nothing major. Everything seemed fairly normal except for one thing. The TV was off. Johnny was nowhere to be found. This had me worried, scared. I kept in all my pride not to scream or cry. I quietly walked into the kitchen where I saw the most terrifying sight of all.  Everything was a mess, like a twister tore through. On the stove were heads. The heads of my parents. Removed from their bodies and displayed on the stove. The stove wasn't on, but the expression on the faces showed fear, sorrow, and confusion. Bits of chopped up body parts scattered the kitchen floor, table, and counter. It took all my strength not to puke.  He looked at me. Eyes frozen, he did not blink. His mouth moved to form a wide grotesque smile. I watched him fear as he explained in a rather disturbing voice. They were not my friends. Not my Biblio friends. Are you my Biblio friend? Without thinking I screamed at the top of my lungs. No. And ran into town. I did not stop to look behind me, nor did I ever look back. I just kept running. I took the bus and a cab, and went as far away from that house as possible. I never went back. They are making an army. An army of psychopathic kids determined on death. I do not know who they are, nor do I want to. But I know they have my brother. And as of right now, they have yours too.


Welcome to the homelab show episode 28 own your domain. And this is Tom Lawrence. And Jay LaCroy. Yes, and we decided we need to talk about this before there's a whole list of things to come after this. You know, reverse proxies and kind of fun things and maybe email talk, but you have to own a domain first to get a lot of those working. So we thought this is a good episode to put in front of all those other episodes that we want to get to. We're starting to build a tree of all the different things, but each one of these has a base before it splits off to the little trees of the things you can do with it. That's some of our thought process on this. Yep, we had all the discussion on it and there was a few things that won't spoil anything that we're considering talking about without this discussion. It's like, well, we'll have a lot of backtracking to do. Yep, but that does start with buying a domain. We don't have any recommendation for who to buy the domain from, but we do have a recommendation of who can handle DNS and maybe some of the things you want to host when you're on your domain, and that would be Linode. If you're listening to this podcast right now, you are downloading it from the Linode servers that host the HomeLab show. We've been Linode users, both me and Jay for a while. Jay, much more extensively, how much of your infrastructure's run on Linode? Everything that's internet-facing at this point, like nothing internal to my HomeLab at this point is internet-facing. So VPN is what I use to get into my HomeLab, but everything that's public-facing I throw in Linode, and it's been a great service. Yeah, it's really nice, and it supports, and this will be very relevant later, Linode supports DNS challenge for doing the ACME search. I'm correct on that, right, Jay? Because I'm not using it for that yet. I'm going to. That's what I use, yep, that's what I use, yep. As a matter of fact, if I'm not mistaken, our friend Phil, who you may, if you remember me and Jay being on the Sunday Morning Link Review, more news on that at some later date. We're trying to revive some of that, but anyways, he actually helped write some of the code to activate this. I remember he did some pull requests to fix a few things to get that activating properly. So yes, and the cool thing about doing that when you own a domain is the fact that you don't have to open up any ports to do it. That's where the DNS challenge is for those of you that don't know, it's all done through API. So it's one more good reason to Linode, and if you decide you want to use Linode, we do have an offer code down below in the description. So go ahead and use that and get started with Linode and get your domain and point it over there, get the DNS set up. It's all kinds of fun stuff you can learn. So I guess the first thing about buying domains is gonna be where, and do you have a preference Jay? I like hover. I'm gonna say, it was funny, I didn't ask this before, we didn't even discuss this part of it, because I said we don't have a sponsor for where to buy domains, but I use hover, Jay uses hover, and actually I just learned Jay uses hover, and in a look before here, it was kind of a guess, but I assumed, one of the easier ones out there, they have a lot of different, well I think they have all the common, or at least most popular top levels, so you can really find something on there. Now there's no offer code or recommendation, that's just what we use.  They go try to pack on every service, they can to try to bug you about it, that's always been the case with them, they have a lot of little aggravating things they do, and hover is just domain, it's really simple, and that's one of the reasons I like them, and they offer free email forwarding, so so much simplicity in it, and I don't know, someone said they don't do it anymore, they used to have their service where they offer to migrate domains for you automatically, I think they call it their concierge service, or something, you just feel they'll call them, they would move all the domains from one of the other carriers over for you, but they're really simple to use, they did some interface in their focus, they just sell you domains. And you mentioned GoDaddy, I think the only company that might be worse is Network Solutions, like I remember using them with the previous company I worked for, and everything was a chore, I was on GoDaddy before I knew better, like a long time ago, and when I moved all the domains off of that, and onto Hover, that was a great time because I didn't have to deal with it anymore. And I like Hover a lot for all the reasons that you mentioned, they don't do hosting, it's domains, an email, you can't buy a cert from them, they're very targeted on what they're for, they're not trying to get into too many things, which is what I like, I like the customer service as well, I think that's one of the reasons why I like to use them the most is the customer service, now the lack of hosting doesn't bother us, right? We just need a domain and we need a place to buy it from, and for email, I often recommend them for email too, I wanna say it's like $25 a year, plus the cost of a domain for an email package, if you don't wanna run your own server, if you wanna get away from Gmail, there's other solutions out there too, they're obviously not the only one, but I think their email service is great, I often steer my clients in that direction, they seem to like it quite a bit, so between the domain and email, I think they pretty much have it covered. Yeah, that's, and they're very upfront about the pricing, and because I've seen someone in the chat right away say, some of these places are really cheap on their offering, but then the renewals are really high, yeah, because of the pain of moving and the convenience of just having the same registrar and them slowly increasing the price, or not so slowly just slapping you with a high price on there, that can be an aggravation, but that's not the bigger point is where to buy them, why should you buy a domain? And that's the real crux of this issue here. And by the way, you already know you should be hosting it on Linode, if you're not hosting it at home or on your HomeLab servers, use the Linode offer code and host it on Linode, so we got that part sorted out. Yes, we do, and a domain is kind of fun, it gives you this enterprise-seeming quality of your HomeLab even though it's a HomeLab, I mean, make no mistake, some of us, we put more effort into our HomeLab than system administrators put into their business network sometimes, but having a domain is almost like making it official, obviously it's just a name, but at the end of the day, it's great to have, and then if it's something cool, something catchy, it's like, if you wanna VPN into your home network, it could be vpn.yourdomain.com, and that's your domain, so it could get you right in there, it's just easy to remember, you can have subdomains for all of your servers to get to them easily, and you can integrate it with the DNS inside your HomeLab so that way, everything resolves, and there's a little bit of a strategy I think we'll get to later that Tom and I were talking about last night as far as some of the clever workarounds that you can do to kinda make it even better. Yeah, and another, one of the things that's really important is owning your email address. Now, the email wars aren't what they used to be because I had an original at home address, and at home.com used to be one of the big first, well, I think it was one of the first big cable hosting providers, and one of the problems is when they went to belly up, your email went with it, because they got sold off and eventually became, I think, I don't know if it was Comcast or Y upon West bought some of their assets for different internet providers, but it was common in the early days, 20 years ago that you just got an email address from one of those providers, but the problem is if a provider changes, they change their domain, you suddenly have your email changed, and this is one of the really good reasons to own your domain. Even if you're forwarding it on the back end, having a consistent email address on the front end is a great reason to own domain, and another bonus, and I actually know a lot of you that sign up to my forums do this, and hey, thumbs up for doing it, I don't blame you. They come up with custom email addresses at yourdomain.com when you register for different things, such as my forums. So someone will create an email address, thomsforumsat.com, and what they're doing is, they wanna see if Tom sends spam or starts marketing or sells their address, because you would very much know if you only used it in one place, where that place is that sold that domain or sold your information. So it's another kind of bonus is, one, you can have a consistent email address, and two, you can come up with custom email addresses instead of having to use a junk email all the time, because I bet all of us still have a Yahoo email address somewhere that's just collecting all the spam for everything we signed up for, but then you have the trouble of checking it and things like that. Having a consistent domain like that is very helpful in that aspect as well. And it's a lot of fun when you are buying something from a retail store in person, and they're like, do you wanna sign up for our list? And I'll say no, but you'll save 10%, I'm like, okay, fine, what's your email address? Spam at mydomain.com. The look on their faces is priceless, but it is a real address. It's just to my email client, anything that comes into spam at thedomain.com is automatically, because of the rule, put into the spam folder, even if it's technically not spam. So that way, I have that little extra thing to give out and that checks the box. Yep, it's a really nice convenience. We have so many silly email addresses registered for LearnSystems.com. I wish I could tell them, but then people would spam them and it would ruin it, but there's some funny ones that we do for different things. Once you start doing it, it becomes part of how you manage things in logins. As a matter of fact, from a security standpoint, not knowing what email address I used to register for a service, if that service ever gets dumped or something like that, it's one more component like, oh, I think I know this password, but oh, wait, the email address isn't the one I would suspect he would be using for this. So it can add that little bit of obscurity to it. So that's one of the other advantages of having your own domain. Another one about email, and then we'll get off the email subject, is a lot of people will use their ISP email. And at first, it might not seem like that's a big deal, but if you move and then that provider is not available where you move to, I mean, depending on the ISP, you might be able to pay to keep that email, but probably not. So now you're bothered with letting everybody know what your new email address is, but if your email address is independent of your ISP, you could just carry that with you. And similarly, I have a lot of clients that'll call me and I hate this call so much, but I love to help people out, but there's nothing I could do about this when they call me and say, my Yahoo email dashboard is completely different. Please work with me to change it back. And I'm like, well, I can't because Yahoo is Yahoo. And first of all, why are you as a business using a Yahoo email? But anyway, no, I can't just call Yahoo and tell them that they need to switch it back because you don't like the interface. If you don't own an email address, you go the direction that your provider goes and that's it. I don't really have a say in that. Yeah, yeah, definitely. Those are all wonderful reasons for it. Now, the next reason really comes down to being able to, and you may have seen this, if anyone's watched my videos and Jay's videos as well, we use the fully qualified domain name and they can be used not just externally, but internally. So we're gonna, what do you think about that, Jay? That's probably a good place to start. I think it is a great place to start. And I think what I wanna do first and foremost, and I apologize if there's background noise because the law and service just decided that right now is exactly the time to do the lawn. But one thing I wanna get out of the way is this very common misconception, which is very common from people that come from a Windows environment or a Windows work environment, where they think, when we say domain, they think what we're talking about is a domain controller. Yes, you can set up a domain controller in your home lab. There's nothing stopping you from doing that, but using a domain in your home lab, it does not require a domain controller. They are not one and the same thing. We're talking about Active Directory, which is essentially an LDAP server for authentication. And often an administrator will check the box to have it be the domain controller, the DHCP, all of those different things in one box. So when people first get into this, they think of a domain in your home lab as in setting up a domain controller, which again, you can do, but you don't have to do that. So that's kind of the place to start, I think, is that misconception. I don't know if you get that question a lot, but I seem to get that one where people think that you need a domain controller specifically. And of note, despite your ability, and for example, my domain being larnesystems.com, and there are people who may do things like name their Windows domain the same as their website. Don't do that. That will cause you some drama when you're trying to get to your website from inside your network, because it'll always want to redirect to the other server. Just side note, you're not going to die deep in a topic. Just don't give it the same name exactly as your main domain if you are setting up a Windows domain. Yeah, I totally agree, yep. So you buy the domain from Hover or wherever else, and you have the domain. So, okay, now what, right? You have a domain, and obviously if you're hosting something on Linode or some other provider, you could attach that domain to your website, then you have a website of that domain, which is the lowest level of this, but we're talking about HomeLab though. So how exactly do you map a domain to your HomeLab? Now, the first thing I think we have to get out of the way is static IP versus DHCP IP from your ISP, meaning is your ISP, do they offer a static IP service? And I think all of them do, but most of them limit that to the business internet. So that means if I would venture a guest that the majority of our audience is probably not going to have access to a static IP from their ISP. Obviously I have business internet, so I can do that and you do too, because I think we have the same provider. So they charge you more for it, obviously. I don't know if I would say it's worth the extra cost to just say, hey, I'm ACP me and then get a business account because they'll charge you for it. So if you could get a static IP, it's easy because you just make your records point to that IP address.  So you could say by Proxmox is this one, PF Sense is that one, you could kind of just assign them that way. But that's probably out of reach for most. I think a lot of people are going to need dynamic DNS. So the idea is you have things internally, you wanna access them from your domain. So how do you do this? Now, one way that you could do this is using dynamic DNS, like I mentioned, and what that'll do is give you a, basically a domain name, but the problem is it's not going to be one that you chose. I mean, they'll give you some options, but it could be like user 457810.something.something.dynamicdns.com or whatever it is, and it's this long thing. It's like, well, how do you remember that? I mean, the whole point of getting a domain is to make it easy to remember. And if you use a dynamic DNS service that kind of negates the point, but one work around here is that you could use a CNAME, which you could point, basically, you could point that to your actual domain that you purchased to your dynamic DNS domain name. And you don't have to remember that anymore. And the beauty of this is that if you change dynamic DNS providers, you can just change the CNAME and you're done. So that's one way that a lot of people doing HomeLab can experience the benefit of a domain without having to get the static IPs. You might not even be able to. So a CNAME might be a way that you can do this and most of these providers have agents that run within reach of your cable modem. And if your IP changes, it'll update the dynamic IP on the dynamic DNS service. So that's one thing that you can do to consider or consider for starting. The nice thing is, and maybe this might be a little bit more of a deep dive at some point, is explaining all the different things for DNS. I've seen people asking about email and one of the things you can do is, even if you're hosting a domain and you point all your DNS at the node, you can have separate mail service, such as G Suite Office 365 or insert name of your favorite mail hosting company that you maybe want to use or go all out and hate yourself a little bit more and host it yourself. But then once you start understanding all the different record types, like a CNAME, the A records and understanding how that works, it actually becomes very, it sounds very complex, but it ends up being relatively simple when you do this. You just match the CNAME to the dynamic DNS and as the dynamic DNS keeps changing, it's no big deal. Your domain always stays the same. Yeah, and so a quick example of this playing out just so everyone's on the same page. So let's just say you have a VPN appliance and you want a VPN into your home network and you want vpn.mydomain.com.  And then in your registrar, you create an A record for a subdomain. So you create vpn.mydomain.com as a subdomain and then if you have a static IP, you could just obviously make the A record for the VPN subdomain, the static IP and you're done. Or you make that a CNAME to your dynamic DNS name. And then, you know, at that point, you have it pointing to your home network. So then you could refer to your open VPN or whatever it is as vpn.mydomain.com. Now notice that at no point in this description did I talk about a domain controller because like I mentioned, I think this is why it's confusing for a lot of people. They assume based on where they were that you need that. It's a value add. So here all we did was we bought a domain, we set the A record or a CNAME appropriately and now it points to our home network. And at no point did we set up a server to handle this. It's just using an external registrar pointing to the cable modem. And now you actually have something pointing internally to your network. So that's one place to start. And then if you wanna add proxmox.mydomain.com or pve or whatever it is, you just create that one the same way. It's another subdomain. It could point to the same IP. You could point to the same IP hundreds of times. Actually, I don't know what the limit is, but you could just keep referring to it. And then we'll get to how we route the traffic later, but I think it's important to have the starting point of knowing what we wanna accomplish and what it actually looks like. Yeah. And one of the things I've seen someone pop in and this is actually a really common question I guess. What's the best dynamic DNS service? Honestly, I don't know because I've never had to use one in the last 10 years. So we don't, most of the stuff we do with this commercial and even my home, my IP address at home has changed only when I change out my router. When for the most part it's at least the networks I've seen from Comcast, Wide Open West and Spectrum, you don't really get an IP address changed it often. So we don't run into too many problems with it. So it's hard to evaluate. And if someone mentioned Cloudflare, I think offers dynamic DNS, Cloudflare is a pretty well-known name. Try any of them and if it works well and doesn't break, awesome in a kind of availability from there. It's a pretty simple service. I don't know that there's any of them that are particularly good or particularly bad at it. It's just updating the IP address. And if you're using something like PF Sense, it's built in. There's a long list of providers built in, quite a few of them. So take the pick of whatever one looks like the nicest website. I've tried to remember the name of the one that I used. I hope somebody in the chat room knows this one. I used to use this before I had a dynamic or a static IP. And what was cool about this one is that it supported updating multiple services. So that was cool because you didn't have to make that happen yourself. You could add a bunch of things that you want it to update and it'll just proxy or do something to update all of those. I just wish I could remember the name of it. Now some routers that are available in the retail world, I know retail is not always something that we go for in HomeLab. I think some ASUS routers have dynamic DNS built into them. So you could just use that if you have it. And that might just do the trick. Otherwise, maybe if we, oh, DNS-O-Matic. Yep, someone mentioned it in the chat room. That's the one I used to use. I haven't used it in a while, but that was the one I used, DNS-O-Matic. And that's the one that'll update multiple services. That might be a good place to start if the router doesn't have that. So yeah, there you go. There's a recommendation for DNS-O-Matic DNS. Yep, so hopefully that covers that.   And the good news is in, I have videos on this, the HA proxy videos, although still there's always a lot of questions. I've got three of them now. And the third one is just a troubleshooting video of common things people overlook. And even me and Jay had a discussion, because there was a couple of things that were a little bit confusing about the way the front end and back end is handled in there. So maybe me and Jay might dive into it again. It is a little bit of a complex topic, but once you take the time to understand it, HA proxy with PF Sense combined with Let's Encrypt.  Wildcarding it means for each domain, such as graylog.lorencsystems.com, such as unify.lorencsystems.com and all these different ones that maybe you've seen me use in my videos, they're all using the same wildcard certificate for the lorencsystem.com. This allows me to create any amount without having to re-register anything. I just create a DNS entry. Matter of fact, one of the things I showed Jay is you can look up some of my public facing DNS and it resolves to local IP addresses that point to the HA proxy internally in our office for setup. There's, you know, I covered that in my video. It's some people get a little bit confused, but once you kind of get the hang of it and understand where all the data needs to go and where it needs to point, you go, oh, this makes sense. And then you can start registering any servers you want in really a few clicks. Once you have the base structure set up and you go, hey, I want to spin up another TrueNAS, give it a name or call it TrueNAS or TrueNAS one, TrueNAS two, whatever you want to call your NAS and then you create a domain for it. And now you don't have to do the self-signed certificate error. It goes through and away you go. Now you have one more device on your list. Now these can be internal or external facing depending on how you configure them and they can be both simultaneously. So there's different options and those are all covered in depth. Like I said, that my HA proxy video is a little bit long. I think it's about an hour, but there's a lot to cover to get that all working and set up. There is, and I think what I'm going to do just to also make this even better is to kind of walk everyone through another layer of this because I'll use NextCloud as an example and I'll use PFSense as an example, although you can just change PFSense to ACES or whatever your firewall slash router happens to be and same with NextCloud. If it's a web server, it doesn't really matter. So let's just, and I'll use the static IP as this example, it could be CNAME. We'll just let you, the listener, insert or remove matching terms appropriately. So you have the domain and you make the IP address, let's just say equal to the static IP of your PFSense. So at this point, if people go to router.yourdomain.com, firewall.yourdomain.com, they're getting to your PFSense or your router at this point. Now I'm not advocating for making PFSense publicly available for everyone to try to hack. I'm just using this as an example but at this point, having a domain and having the IP address attached to the domain, the IP address of your cable modem essentially, that gets external people to your PFSense which of course they're just gonna get dropped because PFSense sees that someone's requesting something and like, I don't know what to do with this. It's an external IP but I have internal IPs here so I'm not gonna do anything with that. So at this point, all you've really succeeded in doing is getting people to your PFSense. Now, the next step is taking that traffic and routing it to the proper internal server. So if it's NextCloud, then what we have to do is make it understandable that if someone on the outside is looking for NextCloud.mydomain.com, they get to your cable modem or your PFSense and PFSense needs to hand that off to something else to route it to the appropriate server. And that's the next step. You could do a proxy like nginx, HA proxy like you just mentioned that inspects the name that was requested and then forwards that individual to the proper server on the inside. I use, or I have used a container with nginx. I don't have anything externally available now but when I did, that's how I did it. I had a Proxmox container that was on there running nginx and it was looking at what was being requested and would just send you through to the proper device on the inside. So when it comes to setting up that proxy side of things that's a video slash episode in and of itself because I would love to tell you just install nginx and put these values in there but there's so many parameters and usually what I do is go to the documentation for whatever I'm running and they'll often have the nginx parameters in there that work best with that product. So that's why it's hard to make a video about this because it really depends on what you're proxying to and you just follow the documentation. But at this point, if you have proxy that's handing off the request internally then you have the completed solution.  But after that, you need proxy or something like, or even port forwarding to make that happen. Yeah, and it can be a little bit confusing when you look at reverse proxies especially when they all rely on SNI and this is where it gets a little bit confusing. Server name indication that is the SNI header and you'll have the same IP address. And I see people in the comments saying they're having some trouble with HA proxy and this is often where people get confused. You end up having, excuse me, you end up having the same IP address. So you have one static IP address or you get multiple but for simplification and do one, but you can have many domains all hosted on there. The SNI header that gets sent is based on a couple of things. The browser does a DNS lookup provide your DNS server answers correctly then it hits the IP address that IP address it hits it's gonna say, here's the thing I think should be here it's this.yourdomain.com HA proxy goes, do I have an entry for this or really any reverse proxy does this even if it's not on your firewall but the reverse proxy is gonna examine that header and then serve up the content or make the backend connection to the server that corresponds to that SNI header. Getting all that right is why these are a little bit tricky and one of the things I show and I believe I have this in my troubleshooting video is how to use the open SSL testing tools from the command line to actually send the SNI so you can essentially forge the header and make the request and see what the response is because one, do you have that set up right? You think so, great. How about we force a response and look at the or force a SNI header and then get it back. These are some of the troubleshooting that makes it a little bit tricky to set up but once it works and I've seen people say, yeah, once I got it working it's like a light bulb turns on and like this is so easy to set up all these domains on here. Yes, it's all these little mechanics are getting it right but it's really handy then at that point too. This is to go a step further for people that wanna know how this works in the enterprise world and Jay can probably speak a little bit to this. One of the advantages of having these proxies direct traffic is let's say I have this, it's all coming in it hits this IP address but the backend I can actually load balance. I can say send some of the requests to this server send some of the requests to that server or I can modify the configuration really quick to spin up another server and do them. You've done some of that work. Haven't you Jay for reverse, load balancing? Load balancing, yes. I've done that in AWS. I haven't had a home lab reason yet but I think I probably will because it'd be cool. I mean, why else do it, right? But so basically one missing layer I forgot to mention is you have the reverse proxy server whatever it is, how to get the traffic to it. Well, in my case when I was doing that I had a port forward and PF sends port 80 and port 443 were both being forwarded to that container with engine X and then the container would proxy to the each of the services. Now I considered that container to be disposable. It was highly secured when I did use it and I had like, I didn't even use the same SSH keys for this. So it was at that level of abstraction there and the beauty of it is if anything did happen to it I'll just delete it. There's no data on it that I care about. It's just a proxy. It just hands off to other services, that's all. And that being disposable is the best way to do it because if anything happened, I'll delete it and I'll just back it up from an image. I mean, it's just let's encrypt at the end of the day and they automatically renew. So it was really easy to do and having that segregated it gives you some extra security. I wouldn't say much, but it does give you, I don't know but one, one or 5% better security because your app isn't directly exposed to the internet. The proxy is, obviously it's just passed through though. So if there's a vulnerability in the app then it's still a vulnerability nonetheless, but you still have a situation where someone might just own the proxy box and then they just own that one thing. And if it's disposable, delete it, find out why or how they got in and then re-image it or whatever. But yeah, that does give you a level of abstraction and I think that's really important to have. Now, another thing, and I right away see a little more confusion here right in the comments but this is a really good thing to think of as a distinction. So we think of something like NAT. NAT is just a hole in the firewall that's gonna take something from the public IP address and land it internally to whatever you defined you wanted to land on. Proxies work a little bit different because they technically man in the middle of it because they're brokering the connection. So HAProxy handles the SSL termination. So there's HAProxy sitting at your public IP and it handles the SSL termination or if you private IP, same concept, the HAProxy handles SSL termination between the web browser and there. Then another session is created between HAProxy and whatever you told it to point to. Now, that is really important because this is where you can do some fun things if you wanna inject something in there. HAProxy is essentially man in the middle of this connection. It's terminating the TLS. So your TLS connection from a browser doesn't pass through HAProxy. HAProxy is handling the termination and then talking to the subsequent server based on what the rule sets are. The reason that's important to understand is it's where a lot of people get confused of when, well, an easy example unless you tell HAProxy to also forward some other information, HAProxy when it talks to an internal server and a bunch of external people are hitting it, the internal server logs only see HAProxy. You're like, I don't know HAProxy was requesting this and requesting that. It doesn't see that external user from their browser or anything like that. Now there's ways you can get that data to forward over but like the defaults next to yes options in HAProxy to get it configured does not forward that information. But this is also an important distinction for when people wanna do things in, this was actually brought up a couple of videos ago I did with Riley Chase talking a little bit about proxies in front of his Hostify service that he offers because by offering the proxy there he doesn't have to deal with any certificates with all the individual unified servers. It also allows him opportunity if he wants to filter or modify the data and transit for whatever reason it can be done. And if you get some of the more advanced proxies there's even filtering you may wanna do that way if someone tries to request something or tries to do, if you are following the news there's been a recent Apache problem of that was discovered. The proxy can be, it gets a little more into web application firewall but it's at least has some ability to apply some rules to it to say no, no, no don't let that type of weird data come through that's not acceptable before it gets to the backend web server. So because it's actually terminating the TLS and the security connection before it passes off to the other one. And by the way, you can have and I do for example in my Unify I don't bother installing a certificate in my Unify server itself. So the certificate brokering is has to go unchecked between HAProxy and my Unify but on the other side when I connect to unify.launchsystems.com I get a proper valid SSL cert. And that's kind of goes to the like I said where the termination is where the termination is being handled for the proxy. Yeah, I think one simple analogy is to think of this as like having an operator or a receptionist at a company you call and speak to John you talk to the receptionist first and then that person's like, okay then transfers you and you're talking to that person or if you're asking for a different person then the receptionist will say yeah, I don't know who you're talking about. So in that case, they get a 404. It's like, we don't have that here. So if we're asking for next cloud and the proxy knows what that is. Yeah, okay, you go over here that's where next cloud is and then they ask for a book stack or something I don't know. Yeah, we don't have that server they get a 404. But like you said, the SNI is basically looking at the name as being requested and making sure that everything fords properly. And that could be kind of difficult to explain but we'll just kind of keep the SNI part of it very simplistic. I know it's much more complicated than I made it out to be just now but it's like in the phone example you could have your phone number publicly available and everybody in the world can call you or you can have a proxy in front of you like receptionist that's routing traffic accordingly. And that's kind of what it is because you have that you have one hop in between or a man in the middle or person in the middle that's handing things off. And I personally, the way I am now I proxy everything. Like even if it's not an issue where I need to it's just one name, one server there's not even multiple sites on there.  I think when you get to a certain point you'll probably start proxying everything. Yeah, it becomes the hardest part is getting the base configuration set up. Once you've got one or two domains working why would you say two? Because two that way you can say oh I see the difference between these two domains. The next 30 or 40 that you add are really, really simple to add because it's just kind of repeating the same thing and changing the IP address and adding a new rule to match whichever the SNI is on there. Now you can go a little bit more advanced because you can, there's ways in HA proxy if you play with the more advanced rules in it even inside a PF sync. So you can do like some of the subdomain and then I'm trying to remember how it would be like the fully qualified domain plus then extra URL to get it to redirect to other things. There's lots of little nuances it's all about getting the base part of it set up. And then when it comes to let's encrypt I mean I think that's the ultimate goal. I mean I hate seeing that red X or that broken padlock icon in the browser even though it's something that's not externally available anyway but I hate that.  I know, I know it is. I'm the one that self-signed it. So I'm aware of this but the browser is gonna act the same whether it's internal or external. So having a let's encrypt cert is the ultimate goal. Now you have to verify that you own the domain otherwise someone else could just say yeah I own your domain and I'm just gonna point all the certs to me and be a man in the middle and just create some havoc there. So you don't want that but let's encrypt has to verify you own it. How do you do that? So the easiest way to do it if something is internet facing so I'll use Linode as an example if you have a website set up there and you have the domain pointing to the A record or the IP address to that Linode it's super easy because it's publicly available the IP address and the domain are a one-to-one match and if you request a let's encrypt cert then it's gonna send out the request and then it's going to come back and verify that it does come back to the right place and then it approves the cert. So the communication has to go out and then has to come back in in order for that to work and that's easy because it's a one-to-one match it's externally available it's out in the cloud there's an IP address there's a domain matching that IP. Now when you are inside your network that becomes a little bit more challenging because when you have a server internally asking for a let's encrypt cert it's going out your cable modem so regardless of what your server's IP is in inside your network what let's encrypt sees is your public IP coming off your cable modem and then it's gonna send the communication right back to verify this is it gonna come back to the server? No, it's gonna hit your cable modem or PF sense or whatever and PF sense is like, yeah, no, I'm not that I'm PF sense, I'm not next cloud what are you talking about and then it doesn't work because it can't verify that that's the problem the solution is you have the HA proxy engine X whatever in the middle that's routing it to the appropriate place but it can be a little confusing because now you're trying to make sure that depending what the request going out is that it comes back to the same server I think that's where people start to get confused but as long as you have the you first get the HA proxy or engine X working to where you can go to it from the outside and then you get to it even though there's no cert so you know the routing works because you're off your network you could try your phone on 3G or 4G or whatever and off the wifi, try to go to it and if you see the right site, the routing works so once that box is checked then you should be able to get the cert by doing the DNS challenge which will just go out and then come back in but then you mentioned DNS challenges there's specific ones which is a different way of doing this where Let's Encrypt uses an API call so if you have a membership at Linode, AWS there's a bunch of these you could actually hook it into that and they could just communicate directly with that DNS service and the DNS services say yeah, J owns that domain, you're good and then it verifies it and that way it's great because it doesn't really I mean, you don't really have to have as much routing there because it's not expecting a web server on the other end it's just verifying that through API which if you have an account on one of those then I think that's even better. Yeah, that's one of the easiest ways to do it because let's say you are in a situation where you're behind KiraGrade NAT and you just have no interest in opening up things to the world matter of fact, that's how J is sitting right now he has none of the things publicly exposed in those circumstances that's where using Let's Encrypt is great because you can get that wildcard certificate but that wildcard certificate does have to apply to a fully qualified domain that's as we said in the beginning why you have to buy one Let's Encrypt will validate it with the API call you can get the wildcard cert and then you can internally have all of your different things and your browser will respect it internally so it'll be your devices.yourdomain.com whatever you wanna name them you can get rid of all those SSL errors and not have to worry about them your browser will be happy with no little click, advance and go next or proceed with caution type of error messages and all of this is done without any public visibility so you're not adding any type of risk to your network because you're still not opening up your network you're just adding the convenience of having everything in a really clean looking interface because the alternative to and I will mention because someone I'm sure there's no one through in the chat there there is ways you can tell things to trust your own certs and come up with your own naming scheme it's just ways to make that work it's almost I would say in some ways more complicated and adding a bunch of cause you gotta add things to your certificate store to make that work and I'm Right Yeah I don't It's too much and I would actually if you're gonna put the time and effort it's just easier because for each new device you'd have to also do that on your network when you don't do that and you use something that's Encrypt it becomes very simple because any new device on your network if someone you just get a new phone open it up you can go to provided the DNS works any of your phones connected to the internal DNS of your internal network you can go to all the fully qualified domains for your different services and they'll all connect fine without any SSL errors Yep Yeah and I think that's the best way to think about everything another challenge that I think some of these proxy services can help solve but it's kind of like what you want to achieve the challenge is if you have something in the cloud but it's not publicly accessible which you might think like wait what it's in the cloud but it's not publicly accessible the whole definition of the cloud is publicly accessible you can always set up any cloud provider to not allow any traffic other than from your IP or you could use like zero tier or something like that and just not allow the public into the cloud instance at all and only you can get into it but then the problem is you try to do the let's Encrypt challenge and then the communication goes out it can't come back because it's not publicly accessible so then you can start to get into a challenge where you have to remember to temporarily open the firewall which I hate doing just to let that go through and then close it back down hopefully you don't forget to do that it's not really the best way to do it but sometimes you have these challenges and you have to figure this out because it's not like let's Encrypt is going to tell you these are all of our IP addresses if you whitelist these then the challenge will always work I don't think they want you to know what all their IPs are and even if they did and even if they didn't mind they'll probably just change them anyway because what the IPs are today may not be what they are tomorrow for the servers on the let's Encrypt side of things so it's really hard unless there's some kind of reverse DNS mapping or whitelisting to make that work to where you have to have something in the middle to allow that communication to happen but at the worst case you could open it up temporarily get the cert and close it down but you just have to be really good on remembering to close it back down Yes, that's um and a few people asked this question and I have a video and you can extrapolate from this video um to other services but I have a video called PF Sense DNS Overrides and what DNS override means is how you can have different external DNS versus internal DNS uh someone referred to it as split brain I don't think it's the right term for it split DNS is the right name though um that you can do so I do have a video on that for a few people asking in the comments to better understand I have dove into that topic matter of fact if you search I've actually talked how to use dig how to look up different records for DNS um I've done several videos on that topic that you'll find tutorials on my channel have you have you on your channel Jay? I'm trying to think like I have like almost 800 videos now I'm getting to the point where I'm like what have I done again? I make sure I had that video like if I don't I need to add it to my list so I'm probably just not remembering but maybe I did cover it there's a lot to this it's it's very there's a lot of different moving pieces but I think when you take away the moving pieces that aren't relevant to your use case then what you're left with is pretty much one or two pass forward and there's only one or two ways to do it and it's pretty self-explanatory at that point but you have to take away the things that don't really matter and understand your environment like do you have access to a static IP? Probably not but if you do it makes it a lot easier when it comes to VPN there's some added challenge there because I've noticed with different operating systems OpenVPN handles differently with the official client so I've noticed on Windows for example and I think macOS but I don't remember it'll automatically tell the client to forward DNS to your internal DNS so if you're looking for next cloud even if it's not externally available you're connected to your VPN to your home network from somewhere else then you know it knows where next cloud is because it's using your PF sensor your router your firewall whatever it is as your DNS server now other operating systems I think Linux is one it doesn't automatically do that so it'll just like all the name lookups fail even though you are on the VPN there's a way to get around this there's a package you install and a couple lines of config you add to the client config file that I won't go over right now but there are some challenges there that you'll probably run into but a quick Google search will get you the answer there but I mentioned this because it just seems so weird that it's so different based on the operating system even though the client comes from the same place I don't know if they fixed this yet we had a conversation about this last night so depending on your operating system you might have to do a little bit of hand editing there but one of the reasons why I bring this up is to segue into your solution though because you can just like avoid all of what I just said and do absolutely none of that and not even have that problem by using your trick for local DNS in public or local IPs in public DNS I think you explain it better than me so I'll let you do that yeah definitely definitely a fun topic it's DNS it's always DNS it's probably on your end basically if I understand correctly you're putting the internal IPs to your internal servers in the public DNS server yes yes I have that I break it down in my video because it's it's a fun way to solve like you said the VPN problem when you have people remote so you can look up some of them and there's some of the ones are still valid from the video so I can point them using my digital ocean where it's hosted on one of them because I did some that's where the demo was done for those of you wondering even though it was a sponsor I still have stuff there too and you can look that up it's kind of you can split this around quite a bit and it's it's not as cut and dry as you might think like you can only be here all here you can actually put them in multiple places for that where you can put it where if you're inside the network it resolves this way outside network resolves this way but one of the problems we had was when we were playing with phones and Android likes to use its own DNS we said you know I can solve this problem real quick we just made the public DNS point to the private because Android decided I can't really it's a way Google wants to always look up a different DNS server so it's like it's another way of solving that problem there's all kinds of clever workarounds and the CNAME combination with dynamic DNS is just one of many there's all these different clever things that people have come up with to you know route things and to you know set up DNS I think are fun but you know without going too much on a tangent I think those are probably the main two I think are the most useful to our audience and I did see because this comes on the heels of the big Facebook outage it's always DNS until it's BGP so that's true and for those of you who don't know you know depending on your list this is October 6th so it's right after the big Facebook outage I have it on October 4th and a quick explainer is the difference between DNS and BGP DNS tells you where things are and BGP tells you how to get there and both of those things were actually broken for Facebook so I wonder what the the specs or the the analytics are as far as like the human side of this without Facebook being online then people wouldn't have been upset by memes as much and there'd be less stress in the world overall and people would be sharing fewer memes because you can't so I think productivity might have increased kind of anything to see how that impacted things but yeah BGP is it's one of those convenient things but it also can conveniently break other things too yeah yeah I mean I don't know if we're going to cover BGP on The Home Lab Show but it might be a topic that we me and Jay have a mutual friend we can bring in that does manage BGP he helps protect the world against DDoS stuff so he can answer questions about it he's done some clever things so there's yeah but maybe maybe we'll do an episode on it because a lot of people ask what it is but it's not I'll tell you this much it's not likely something you're going to be using in The Home Lab but I will admit you can set it up and I thought about doing a lab demo of it because you can use BGP it's not the most ideal way but it can be a fun learning experience to actually build a network and understand how routing and pairing announcements work I actually played with it a little bit and thought it was kind of novel I just never did a video I know I don't have a video on that specific topic how to design your own internal BGP oddly we've done things like that though and reasons we've played with some of this is because internally here sometimes when we're configuring something we'll plug the public IP addresses in and actually have them routing inside of our own network before we deploy a firewall to a client so we can actually go through the whole setup if we want because we can we built a network that matched the public IP space now that's not going to actually route to the internet fully but it was us able to have the firewall tested and make sure all the different port forwardings and everything worked and we just had to do our own simulated section of the internet here but that's we're now we're getting way off topic of where we started with proxy and domain yeah that's that could be I don't know if that'll translate to an episode or not but it's yeah definitely to build these things here you know here what you guys think of all this yeah definitely something all right well I think we covered everything we had on our list for get domain so get your domain get started it's a great learning process it's it's a great aggravation process right yeah I actually have memories of just like you know when I was learning getting frustrated with it and just getting very upset shouting a few expletives and I'd go out for a jog and and then clear my head and come back oh right of course it didn't work because of whatever it was and it was just like you just get so involved in this you're trying to map it out in your head and it just you just get stressed out just you have to take a break you know just go for a run or do whatever you do for unstressing come back to it and I think it'll make a lot of sense just take your time and I think you know being frustrated is actually a good thing when it comes to learning because that means you're being challenged and that also means you're going to you know come out with a a lesson at the end of it and I think breaking things and fixing things is usually the way we learn anyway yeah it's it's just it's a lot of fun and once you have it now you have the diversity to really start playing with that it's the whole thing is being able to get some of these tools in your hand so I know there's at least a few people that want to try and host your own mail there's always people that want to do that take it from two mail server administrators me and Jay both did that for years and I mean I was a mail server administrator back in the send mail days in 1999 was my first job were commercially I did I actually ran it not commercially before then in the earliest days but yeah once you learn send mail then I learned post-fix then I also learned exchange and I admin these things I actually was kind of happy in some ways when I surrendered to G Suite and got rid of my own mail server I said I'm done I ran my own mail server for a long time and then I decided that mental health is important and then I just I just changed my MX records to a different provider and I was done with it I just had enough yeah eventually you will have enough oh something I you know we didn't touch as well last thing I'll leave you with yes if you want you can set up your own name servers that actually is a little bit more involved and I have done that with hover so you can look up I think ns1.laurancesystems.com is valid those are a little bit different type of record it gives a little off topic but if you're into hosting you can build a primary where you buy a domain create a subdomain for name servers and then there's a trick to getting them and like the scope of this because it's been a while since I've had to do this where you can be registered as authoritative name servers that then can be managed so you can manage all your other domains on it it's actually something we used to do we used to do hosting so I still have all that configured in the back end but yeah that's it is one more thing just answer the question when someone asks can you do that the answer is yes so yeah that yeah explaining that like you said it's hard then you got to talk about glue records and all these other things yeah glue record that was the word I'm looking for yeah the glue record set up so yeah that's a lot that could be its own topic it will dive into a different day but thank you for joining us on the homelab show this was a lot of fun talking about this I hopefully we gave you more things to dive into more things to buy I will give a shout out to those of you that want to dive deeper is look at the learning things they have over at Cloudflare on things like BGP they have some really good graphics and explainers on how that works and they have a lot of write ups on how DNS works so if you want to break down some of the confusion of it you can spend a lot of time in the rabbit hole but I realized that doing a video the other day that wow they have and I linked to their BGP video and one of them for they just have good explainers and solid write ups on it so it's another place you can learn to start diving into what all these records mean and things like that so yeah all right thanks everyone for joining awesome having you here thank you very much see you next time see you later