what happens to lan traffic when you leave the local network - home reddit / selfhosted ---------------------------------------------------------------------- Lazy-Fig-5417 · 2023-10-27 22:20 I have FQDN. \# 1 I did configure unbound on opnsense router to override all hosts of [mydomain.com](https://mydomain.com) to local IP of my server. Local server is ruuning SWAG who creates ssl with lets encrypt using dns validation. I did not forward / open any ports on router so those services are NOT accessible from internet. I can access all my services localy over some\_subdomain.mydomain.com \# 2 I did configure DNS records at my registrant to point to my webhosting (normal external company) and create simple html page. So when I am browsing [mydomain.com](https://mydomain.com) and I am not at home I get that simple page. question: I leave home so I am not at home network and not using VPN then my laptop or phone are trying to resolve [mydomain.com](https://mydomain.com) because some application wants to connect to service. They get IP of webhosting and trying to communicate with it. Should I be worried about sensitive data being leaked? At least, webhosing can log requestes where it can see my subdomains and url path ... ​ what is your setup? what is your opinion? is there any better solution beside VPN { I dont want to open VPN always when leaving home } thanks ---------------------------------------------------------------------- flaming_m0e · 2023-10-27 22:27 >Should I be worried about sensitive data being leaked? If you're not exposing any services over the internet...no? Can you elaborate on this a bit more because I'm trying to figure out where you would arrive at that conclusion that it would be possible. Perhaps there's something in your setup that you haven't explained fully. ---------------------------------------------------------------------- joecool42069 · 2023-10-27 22:30 >what happens to lan traffic when you leave the local network - home it become wan traffic. ---------------------------------------------------------------------- thekrautboy · 2023-10-27 22:32 I use a subdomain for all my local services. `example.com` then `local.example.com` and for the services `service.local.example.com` This way i can still use Lets Encrypt but i also have a clear separation between actual services that are public facing and things i keep local only. Fitting this to your setup when `*.local.example.com` points as CNAME to your local reverse proxy, then you can access it fine when at home. When youre away and your laptop tries to access it again, it still retrieves a local IP from the DNS, which of course fails, and because of that your webhoster at `example.com` doesnt receive any attempts at subdomains etc, you completely bypass it. ---------------------------------------------------------------------- thekrautboy · 2023-10-27 22:33 I think they mean that when they are away that the laptop would continue to try to open `service.mydomain.com/my/secret/path` and they would like to avoid the webhoster who runs `mydomain.com` to get any sniff of that. I think. ---------------------------------------------------------------------- VeronikaKerman · 2023-10-28 08:01 The processes that run on your laptop trying to connect your LAN services, would, outside of Lan, resolve the public DNS record and try to connect to the web hosting server. If the port is 80/443, they would indeed establish connection with the public web server, which could log those requests. This is when certificates and encryption comes into play. If your client programs are using TLS and are not buggy, and you have not uploaded your private certificate key to the public web server, they would just error out, and noting will be leaked. Split horizon DNS (what you are doing) is similar to DNS spoofing attack, TLS/SSL/HTTPS defeats such attacks. You secured your server (by not opening ports), but clients need to be secured too. ---------------------------------------------------------------------- Lazy-Fig-5417 · 2023-10-28 08:43 yes, that's clear, I am trying to avoid that. before I did start to use my own domain I did used duckdns.org as many people. well, maybe they did open / forward ports to local server but if not then same problem occur. ---------------------------------------------------------------------- Lazy-Fig-5417 · 2023-10-28 08:53 just thinking about your comment and getting to conclusion : remove A record at registrant so resolving [mydomain.com](https://mydomain.com) will end without IP, I think it will fail in internet, I will also remove that static webpage. It is not necessary for my scenario. ---------------------------------------------------------------------- thekrautboy · 2023-10-28 10:33 If that works for you, okay. ---------------------------------------------------------------------- kzshantonu · 2023-10-28 15:53 I set public DNS of my internal service hostnames to 0.0.0.0. That way if my internal DNS fails, it cannot resolve to a random IP ---------------------------------------------------------------------- Lazy-Fig-5417 · 2023-10-31 08:27 thanks for good tip ---------------------------------------------------------------------- kmisterk · 2023-11-06 18:54 ## Post Removed Hey, Lazy-Fig-5417! Thanks for your submission on selfhosted. Your post has been removed due to a violation of the purpose of the subreddit: **Self Hosting** ## Not Self-Hosted When it comes to posts regarding applications in this subreddit, they must feature a self-hosted tool, or a tool that *can be* self-hosted, or some kind of related information, help request, or otherwise related to a tool that is something that one can self-host. If you believe this post *is in fact* relevant to /r/selfhosted, feel free to [message the mods](https://www.reddit.com/message/compose/?to= /r/selfhosted&subject=Removed For Not Being Self- Hosted&message=[Removed Post](https://www.reddit.com/r/selfhosted/comments/17hz5l1/-/\)) with your concerns.