Author: Andreas

  • More Tips for Using Windows 11 on a RootServer

    Part 7 of the Series: Windows 11 on Your Root Server: RDP, Tailscale & VPN for a Free Internet

    Creating a Snapshot of Our Windows PC

    Now that the configuration is complete, it’s a good idea to create a backup of the current system state. The easiest way is via a snapshot in the Server Control Panel.


    How to Create a Snapshot:

    1. Go to Media→Snapshots in the Server Control Panel
    2. Enter a short, concise name (letters and numbers only – no special characters or spaces)
    3. Select the option for an offline snapshot – this will shut down Windows to create a consistent backup
    4. Click “Create Snapshot” on the right

    Windows will now automatically shut down, the snapshot will be created, and the system will restart automatically afterwards.


    (more…)
  • Activating Windows, DNS settings, and privacy

    Part 6 of the Series: Windows 11 on Your Root Server: RDP, Tailscale & VPN for a Free Internet

    Activating Windows

    To activate Windows, you’ll need a valid Windows 11 Pro license. The best deals are often found on idealo.at.

    These inexpensive OEM licenses generally work without issues – still, I recommend that you briefly verify the seller before purchasing.

    Look out for the following safety criteria:

    • Legal notice (Impressum) available (including company address, contact person, and contact methods)
    • Company name and VAT ID are verifiable (no shell companies)
    • Read customer reviews (e.g. via Trustpilot or ShopVote)
    • Payment options: Reputable sellers offer PayPal or credit card
    • No forced download of suspicious activation tools
    • License sent via email with a valid product key
    (more…)
  • Configuring firewall and securing services

    Part 5 of the Series: Windows 11 on Your Root Server: RDP, Tailscale & VPN for a Free Internet

    Now we need to configure the firewall so that certain ports — especially for RDP — are only accessible via Tailscale.

    Download the firewall scripts from my GitHub repository: Download ZIP

    Extract the archive into a directory of your choice.

    Then open Windows PowerShell with administrator privileges to run the scripts.

    Click Start and type PowerShell into the search field. Then either:

    • Right-click Windows PowerShell → Run as administrator,

    or

    • Right-click the entry in the list and select Run as administrator.
    (more…)
  • Setting up Tailscale and RDP

    Part 4 of the Series: Windows 11 on Your Root Server: RDP, Tailscale & VPN for a Free Internet

    Download the Tailscale client for Windows from tailscale.com/download and install it on your Windows server.

    Then sign up for Tailscale – it’s quick and easy at login.tailscale.com/start.

    Don’t forget: you also need to install the Tailscale client on your local computer in order to connect to the server later.

    Download Tailscale Client
    (more…)
  • Install Windows on a vServer – Step by Step

    Part 3 of the Series: Windows 11 on Your Root Server: RDP, Tailscale & VPN for a Free Internet

    In the Server Control Panel, configure the server hardware under Settings:
    Select your preferred keyboard layout, enable autostart and UEFI mode, and set the operating system optimization to Windows.

    Konfiguration der Server-Hardware im Server Conrol Panel
    (more…)
  • Preparing the Installation Media

    Part 2 of the Series: Windows 11 on Your Root Server: RDP, Tailscale & VPN for a Free Internet

    By default, Debian Linux is preinstalled on the Netcup vServer.

    Using the Netcup Server Control Panel, you can open the remote console from the left-hand menu under _> Screen and log in with your username and password. However, it’s more convenient to connect directly via SSH from your PC – this way, you can easily copy and paste commands.

    Debian Login Screen
    (more…)
  • Provider Selection and Prerequisites

    Part 1 of the Series: Windows 11 on Your Root Server: RDP, Tailscale & VPN for a Free Internet

    First, you need to order a server. I use KVM-based root servers from Netcup, but you can choose any provider that offers similar specs.

    Windows 11 requires UEFI, Secure Boot, and TPM 2.0 – requirements that many virtual servers (VPS, Virtual Private Servers) do not meet. Even on a root server with KVM virtualization (Kernel-based Virtual Machine), TPM and Secure Boot are usually not available, so a registry hack is necessary to enable the installation. Additionally, Windows 11 requires at least 2 CPU cores, 4 GB of RAM, and 64 GB of storage. A KVM-based root server provides the necessary flexibility for ISO booting, stable performance, and full control over resources.

    For using a server as a Windows PC, a plan with 4 dedicated cores, 8 GB of DDR5 RAM, and a 256 GB NVMe SSD should be sufficient.

    (more…)
  • Windows 11 on Your Root Server: RDP, Tailscale & VPN for a Free Internet

    Many users rely on traditional VPN services like NordVPN, Surfshark, or ProtonVPN to bypass geoblocking, network restrictions, or internet censorship. However, these providers are often quickly detected and specifically blocked—by streaming platforms, online services, or restrictive networks. Even when using Tailscale as an alternative VPN, you may run into similar issues.

    By the way, I’ve already covered Tailscale in detail in a dedicated article series.

    This article series presents an alternative solution: Install Windows directly on a virtual server (vServer) and access it via Remote Desktop (RDP). The clever part: You won’t just surf “as if using a VPN”—you’ll be browsing on a real Windows PC, which is much harder to detect as a VPN.

    The only potential drawback is that the IP address may be recognized as belonging to a data center.

    (more…)
  • fail2ban and nftables – Useful Tips

    Troubleshooting Fail2Ban Issues with nftables

    Fail2Ban may sometimes cause issues. In many cases, it’s enough to delete the nftables rules created by Fail2Ban, briefly stop the service, and then restart it. On restart, Fail2Ban will automatically recreate all necessary nftables sets and rules.

    I’ll omit sudo in the following examples. It will be required when running nft commands.

    Example to delete the f2b-table in the inet family context:

    Bash
    nft delete table inet f2b-table
    (more…)
  • nftables Cheat Sheet: Useful Commands for nft Part 2

    After explaining the basic nft concepts in Part 1, I’ll now present the most important commands in Part 2..

    I’ll omit sudo in the following examples. It will be required when running nft commands.

    Display the complete configuration:

    Bash
    nft list ruleset

    This command displays the entire current nftables ruleset.

    Since the ruleset can become quite large depending on its complexity, I’ve created a custom script that trims the output to the essentials: for multiline blocks within curly braces, only the first and last line are shown.

    (more…)