Can pure DNS site filtering really work these days? I have to imagine more and more of the internet is behind cloudflare / cloudfront / etc, and you probably can't block/grant access to a single site without catching a bunch of unrelated ones as well. An HTTP(S) proxy approach seems like it would work a lot better. No offense to the author, they clearly know their stuff, but this feels like they know networking pretty well and want to use it to solve a problem that it's no longer suited for. I remember the internet of the 90s and DNS filtering would have worked a treat back then.
Why does the term VLAN not show up anywhere in the guide? Can't VLANs (with radius (?)) be used to segment traffic without requiring multi-port NICs (and running N ethernet cables if I want to have access to N different network segments from the same room)? (I really, clearly, don't know that much about networking)
Increasingly, I get frustrated by network- and machine/OS-focused security measures. I don't want to bother with making sure all the unix user ids on all the machines on my network match in order for unix permissions to work right. I don't want to think about tagging traffic in iptables with unix users and only allowing traffic that belongs to my personal user to egress over the 'trusted' NIC. These things should be handled by app-layer controls, sort of BeyondCorp for everything.