What top-level domain do you use in your local network? reddit / selfhosted ---------------------------------------------------------------------- ElEd0 · 2023-11-16 09:46 I've wanted to install pihole so I can access my machines via DNS, currently I have names for my machines in my /etc/hosts files across some of my machines, but that means that I have to copy the configuration to each machine independently which is not ideal. I've seen some popular options for top-level domain in local environments are \*.box or \*.local. I would like to use something more original and just wanted to know what you guys use to give me some ideas. ---------------------------------------------------------------------- thekrautboy · 2023-11-16 09:51 If you want to avoid problems, use TLD that are assigned for this purpose, for example `.home.arpa` or `.home` or `lan` or `private` etc. Avoid using `.local` because its already used by mDNS. ---------------------------------------------------------------------- sarkyscouser · 2023-11-16 10:00 \^this. .home.arpa ---------------------------------------------------------------------- certuna · 2023-11-16 10:08 `.local` is mDNS - and I'm using that, saves me so much hassle with split-horizon issues etc. I also use global DNS (AAAA records with my own domain), again, this eliminates split-horizon issues. ---------------------------------------------------------------------- 404invalid-user · 2023-11-16 10:19 I had problems with .local because it’s used for MDNS and too lazy to figure out how that works so now I just use lan but I also own a .com domain so I have started to use that more ---------------------------------------------------------------------- katrinatransfem · 2023-11-16 10:28 .uk, but it is an actual .uk that I've registered. ---------------------------------------------------------------------- Deathmeter · 2023-11-16 10:37 Nothing. I have all devices using tailscale DNS and I refer to things in my network by their host name directly. ---------------------------------------------------------------------- Stetsed · 2023-11-16 10:39 I just use my domain inside my network which is a .net ---------------------------------------------------------------------- Delyzr · 2023-11-16 10:39 I have a registered domain and my lan domain is "int.registereddomain.com". This way I can use letsencrypt etc for my internal hosts (*.int.registereddomain.com via dns challenge). The actual dns for my internal domain itself is not public but static records in pihole. ---------------------------------------------------------------------- DotDamo · 2023-11-16 10:45 .damo ---------------------------------------------------------------------- super_nicktendo22 · 2023-11-16 10:46 Same, with Cloudflare tunnelling. ---------------------------------------------------------------------- PizzaUltra · 2023-11-16 10:55 everything under *.home.mydomain.tld is reserved for internal use. ---------------------------------------------------------------------- ElEd0 · 2023-11-16 10:55 .lan seems nice. I was looking for something short to type fast ---------------------------------------------------------------------- Awesomest_Maximus · 2023-11-16 11:04 For my email i use my lastname.id. Mostly because my country’s tld was taken for my last name, but also because my email is more often the not my ID for websites. ---------------------------------------------------------------------- ElEd0 · 2023-11-16 11:05 Your username literally contains your answer ---------------------------------------------------------------------- iavael · 2023-11-16 11:09 I've never used DNS in my local network (because it's additional burden to support, so I tried to avoid it), but couple of month ago when I needed several internal web-sites on standard http port, I've just came up with "localdomain." Yep, it's non-standard too, but probability of it's usage of gTLD is lowest among all other variants because of it's usage in Unix world and how non-pretty it is :) ---------------------------------------------------------------------- SwingPrestigious695 · 2023-11-16 11:21 Similar, for TLS certs. ---------------------------------------------------------------------- KD_done · 2023-11-16 11:23 A customer of mine chose for he own domains.. and it was his mistake that he wanted specific "top level domains" in his network for his factory, storage facility and vehicles on the road that connected with wifi at home. He decided, and I realized immediately that this would be a bad idea (\*cough\* .. no I didn't.. but lets pretend I did), that he wanted something that looked like; * company.fabriek (fabrication) * company.waren (warehousing) * company.vrachtwagen (trucks) I think he adopted the idea because I had a singular setup at my office/shop where my synology, placed in a 8U rack in the back on the 4th flloor with a hostname.. just a hostname "I.am.on.the.forth.floor.in.the.back". Just a singular name.. I remember him laughing when he found the server where the hostname said it was. So, the systems (electronic toolbag for in the trucks) installed in the trucks would only work a 100% if connected to the wifi at home base. All interfaces with any relation to the outside world had to be brought within the lan to be able to get to warehouse data, and the fabrication department (his pride and joy) just did what it always did.. it fabricated stuff. All choices were made motivated by the path of least resistance. Yeah.. a lot of stuff didn't work as planned. Mainly connectivity things that did not work as expected, misconfiguration of DHCP servers, VPN clients and all other types of "employee owned" gear that were unable to resolve the funky domains. I started to protest, and explain why what I did was funny, but what he was doing was foolish.. especially after I gave him a rough idea of what was neede to be done. I proposed a split dns solution with a real domain, even that would have been easier and less intrusive to work on or fix things in for sure.. but it looked "less cool" according to his lordship. Customer is king is a stupid concept, but if the customer claims to be King, his highness can pay for the time required to serve him. So.. Pick a singular host, get a real domain and setup a split DNS environment (easiest and funnest imo).. but if you don't care (and why should you :)) pick something fun and cool that makes sense to use for you. All our suggestions are pure personal preference in the end :) ---------------------------------------------------------------------- kneticz · 2023-11-16 11:31 do not use `.local`, as tempting as it may be use `.home` personally ---------------------------------------------------------------------- TheCaptain53 · 2023-11-16 11:34 Same. For my domain, lastname.uk was really cheap. I use home.lastname.uk for my services at home. ---------------------------------------------------------------------- ev0lution37 · 2023-11-16 11:48 I use a .lol and a .xyz because they were the cheapest 3 character TLDs I could find. Used .lan for a while but wanted legit LE certs so moved to Cloudflare managed domains. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-16 11:52 Only `.home.arpa` is \~standardized, the others are just mentioned in RFC - that they 'have been used' historically, without endorsement to use them again. ---------------------------------------------------------------------- slackjack2014 · 2023-11-16 11:53 This is the way. Own the domain and use a subdomain for the internal network. ---------------------------------------------------------------------- aiQon · 2023-11-16 11:55 .vpn ---------------------------------------------------------------------- mlazzarotto · 2023-11-16 11:55 I use lab.mydomain.it just because I own mydomain.it ---------------------------------------------------------------------- krysztal · 2023-11-16 12:00 `.asdf` ---------------------------------------------------------------------- MrSliff84 · 2023-11-16 12:00 I Just use a .de tld and for all my sites a *.mysite.mydomain.de. Ssl certs from cloudflare with a dns challenge for internal use. ---------------------------------------------------------------------- thekrautboy · 2023-11-16 12:04 Thats why i link the wikipedia article and people can read those fine details there, if they care ;) ---------------------------------------------------------------------- thekrautboy · 2023-11-16 12:11 Thanks for sharing that nice anecdote :) > Customer is king is a stupid concept, but if the customer claims to be King, his highness can pay for the time required to serve him. Oh i must remember that line for the future. ---------------------------------------------------------------------- KoppleForce · 2023-11-16 12:13 if you go this route to map your entire network wont it break the moment the internet goes down and unable to reach external DNS? ---------------------------------------------------------------------- signed- · 2023-11-16 12:25 .home.arpa will **not** work with AD if you have one ---------------------------------------------------------------------- marcuspig · 2023-11-16 12:27 With a local DNS (ie PiHole) it responds to the int.domain.com and passes on request that it doesn’t know how to answer (google.com). If internet is out, the local ones still get answered but the web ones won’t. Which doesn’t matter cause internet is out. If the local DNS dies, then everything stops (probably, cause now you’re getting into primary and secondary DNS and other configurations). ---------------------------------------------------------------------- TryHardEggplant · 2023-11-16 12:37 I own two of each domain I use. I use a .io/.com/.net or similar for external use and a .xyz of the same domain for internal use. Makes it so I can just regex the TLD for proxies and can use DNS challenges to get certificates for both. ---------------------------------------------------------------------- lucaprinaorg · 2023-11-16 12:37 I installed an NSD on a FreeBSD on a RPI1 and I serve to the lan the "fantasy local" TLD ...works like a charm ---------------------------------------------------------------------- yrro · 2023-11-16 12:38 Others have suggested various TLDs that are sanctioned or not sanctioned for use. Here's a suggestion no one else has made: invent your own domain using one of the [user assigned ISO 3166-1 alpha-2 country codes](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2#User- assigned_code_elements). * `aaaaaa.aa` * `gg.qq` * `tired.zz` ---------------------------------------------------------------------- KoppleForce · 2023-11-16 12:48 Oh I thought they meant using a registered domain to map your entire local network by pointjng subdomains at internal ip addresses. ---------------------------------------------------------------------- kysfu · 2023-11-16 12:49 Can you explain this process a little more? I want to do it on my own network. ---------------------------------------------------------------------- mrcaptncrunch · 2023-11-16 12:50 I have MyLastName-WifeLastName.com I use `*.home.MyLastName-WifeLastName.com` which points to my reverse proxy. ---------------------------------------------------------------------- Zeal514 · 2023-11-16 12:51 *.local.box It doesn't conflict with any public domains, simple, and short. I wouldn't want something that ends in *.local, to much typing. ---------------------------------------------------------------------- Zeal514 · 2023-11-16 12:52 Why? ---------------------------------------------------------------------- kneticz · 2023-11-16 12:54 mDNS conflicts ---------------------------------------------------------------------- Zeal514 · 2023-11-16 12:56 Ssls get stored in cache, shouldn't be a issue. I could be wrong, but I think if he clears cache, while Internet is down, it won't be able to do the tls challenge properly? Thus restricting him. But if that is the case, he could very easily set up a http version of all the sites, and just not use them, unless need be. ---------------------------------------------------------------------- unixuser011 · 2023-11-16 13:01 worth noting, if you use somthing like .lan, letsencrypt won't work with it and you'll have to setup your own CA ---------------------------------------------------------------------- JivanP · 2023-11-16 13:06 mDNS works by sending out a broadcast packet that shouts, "hey, does *anyone* know who *example.local* is??", and waiting for a response from someone, anyone. It is the responsibility of the host who is called *example.local* to respond to such queries. It also only works over a single broadcast domain / layer-2 link, unless you set up an mDNS proxy on each of your routers. ---------------------------------------------------------------------- DullPhilosopher · 2023-11-16 13:09 I've got a .com for my internal only services with tls and a .pro for my external facing services. I could probably throw them all on one but because legacy (I didn't think things through) I have two ---------------------------------------------------------------------- JivanP · 2023-11-16 13:17 Refer to Certbot's [documentation on this](https://eff- certbot.readthedocs.io/en/latest/using.html#getting-certificates-and- choosing-plugins). You want to complete DNS-01 challenges against DNS records kept on Cloudflare, then you want to use the Cloudflare DNS plugin for Certbot. More info available at the linked page. ---------------------------------------------------------------------- crusader-kenned · 2023-11-16 13:23 This great advise, i have been doing something similar for years and it’s great.. I can really recommend buying a very short domain to cut down on typing, like *initials*ho.me ---------------------------------------------------------------------- joost00719 · 2023-11-16 13:34 *.oob.mydomain.tld ---------------------------------------------------------------------- pver297 · 2023-11-16 13:37 Lot of the browsers are not recognising it as a real TLD so you will end up in your search engine a lot. ---------------------------------------------------------------------- DIYiT · 2023-11-16 13:38 I own both *mydomain*.com as well as *mydomain*.me. use the *.me as my local domain and *.com for the real world. ---------------------------------------------------------------------- MrSliff84 · 2023-11-16 13:40 First of all, you need a tld. Where you get it does not matter. Male an account at cloudflare and set up your domain there. It tells you two domain servers which you have to change in your resellers settings, so cloudflare can provide dns resolving for your domain. You need a reverse proxy (the easiest way) like nginx proxy manager, haproxy or traefik. Set up your subdomain in cloudflare, for example the entry for *.yoursite.yourdomain.com is *.yoursite. Be aware, cloudflare does not support public ips for sub-sub-domains in the free tier, however you can still use local ips. So you can put the local ip of your http proxy. One advantage of doing this in cloudflare is, you don't need to do extra dns entries on your local dns server, however I've read this is not the "best-practice" (I don't care 😁) The next steps are proxy specific, so do a quick Google like " cloudflare dns challenge tutorial": In your domain in cloudflare, set up an API key to use for dns challenge in your proxy. Set up a new dns challenge like it's described in the tutorial of your choice. It can happen provisioning a cert does not work the first time, then try a second and third time. ---------------------------------------------------------------------- Nuuki9 · 2023-11-16 13:47 I do something similar. The complication is that I use my (UniFi) router as a DNS server, as it integrates with NextDNS very nicely. I've configured a forwarder on my router for both my internal and external domains to point to a local dnsmasq DNS instance, which simply resolves them to my reverse proxy. That way all hosted apps are accessed via my proxy (and get SSL in the process), and even visiting an externally exposed app will resolve it internally. Most importantly, if the internal DNS / server goes down, the only thing affected is access to my own stuff, and not general Internet browsing. Its a bit more complicated than I'd like, but its been rock solid, and should allow me to add future enhancement fairly easily, such as a LanCache server. ---------------------------------------------------------------------- prone-to-drift · 2023-11-16 13:53 Hmm, not everything. Tell your router to have primary DNS as the pihole and secondary as another pihole, or Google's servers. Local network dies but internet still remains on so at least the less tech savvy users of the network wouldn't notice issues. ---------------------------------------------------------------------- JunglistFPV · 2023-11-16 13:58 Interesting, I went the way of just using my tld.com via dns challenge but not allowing public access to any of services (except for wireguard) and added static records to Adguard, what would be the advantages of doing it "your" way? I like that I can acceas wireguard without having to remember my ip, even tho honestly its a config once use forever type situation, as my external IP is technically dynamic but hasn't changed since I moved in here. ---------------------------------------------------------------------- ewleonardspock · 2023-11-16 14:01 I use homelab..org ---------------------------------------------------------------------- krimsonstudios · 2023-11-16 14:14 It's not advised to put Google / etc as a secondary. DNS doesn't "fail over" in a strict sense, and the secondary could be used even if the primary is still operational. If you don't mind a few ads going through, it's one thing, but it's really frustrating when 5% of the time your internal host entries don't resolve because your computer / device decided to use the secondary DNS server to look it up. ---------------------------------------------------------------------- uapyro · 2023-11-16 14:15 Got a guide for that by any chance? ---------------------------------------------------------------------- FlowLabel · 2023-11-16 14:16 .app is suuuper cheap even for three letter domains. I picked one up for pennies with three letters that mean something to me and my partner and use a pair of redundanct piholes to serve local DNS for that domain. Externally it’s hosted on DigitalOcean for stuff I want external. ---------------------------------------------------------------------- 404invalid-user · 2023-11-16 14:20 Ah that’s pretty cool. does it have any practical uses for general networks in the background such as IOT devices? ---------------------------------------------------------------------- prone-to-drift · 2023-11-16 14:20 Hmm, fair. I mean, I use a backup pi but I figured most people prolly don't have two devices capable of running a dms server always online..? Didn't know it wasn't a clean priority system. It's definitely named like it is, haha. TIL. ---------------------------------------------------------------------- Woke_killa · 2023-11-16 14:23 LOL XD ---------------------------------------------------------------------- AmIBeingObtuse- · 2023-11-16 14:33 I utilize my domain from DYNU, Nginx Proxy Manager, and Adguard DNS rewrites to manage my network topdomain. I configure all devices to utilize my Adguard server via my Firewalla Gold SE. If your router lacks this capability, you can manually configure devices to connect to your DNS server. Subsequently, on Adguard, I implement DNS rewrites for my domain to direct traffic to my Nginx Proxy Manager. The Nginx Proxy Manager then proxies subdomains to the corresponding servers or Docker containers. Nginx employs a DNS challenge mechanism to communicate with DYNU via API, eliminating the need for port forwarding. As a result, all resources are solely accessible within the local network. Additionally, I utilize DNS rewrites for my Nord Meshnet IP, enabling access to my internal domains via the subdomain.topdomain.dynu.com address across all Nord Meshnet-connected devices. The reason I use .dynu.com is that I get 500 free domains with my membership with them. I also use my primary domain.com for services I publicly expose. ---------------------------------------------------------------------- ithilelda · 2023-11-16 14:36 local is reserved for mDNS. I use the recommended home.arpa ---------------------------------------------------------------------- ElEd0 · 2023-11-16 14:44 Seems a lot of you have a similar setup but that seems to long to type imo ---------------------------------------------------------------------- Asyx · 2023-11-16 14:44 I own lastname.me and lastname.dev and everything public is lastname.me and everything local ist lastname.dev. I don't have a VPS anymore so the .me domain is a bit useless and only relevant for emails these days but I'd have something like nc.lastname.me for my public next cloud instance and docs.lastname.dev for my paperless instance that I don't want to have on somebody else's machine. ---------------------------------------------------------------------- secopsx · 2023-11-16 14:47 I use a custom domain for everything....email, internal dns, external (cf tunnels), and my public websites. For local I use \*.local.domaingoeshere.com (wildcart cert), issued by cloudlfare. ---------------------------------------------------------------------- Spare_Vermicelli · 2023-11-16 14:51 maybe not directly answer for you, but I just literally bought 4 domains for 3 euro per year (renews at the same price!) 5 minutes ago :D. The catch - it has to be 9 numbers.xyz (see [https://gen.xyz/1111b](https://gen.xyz/1111b) for details). ---------------------------------------------------------------------- ohuf · 2023-11-16 14:53 That's not true. The decision which DNS server to use is being done by the local resolver, either on your client or -in this case - your router's resolver. There are two cases when the second (or third ....) DNS entry is being chosen/queried: 1. The first DNS Server ist down 2. The timeout is reached. This is how DNS works. It is a strict failover from the first to the second and then any other configured DNS server on your client or router. ---------------------------------------------------------------------- ohuf · 2023-11-16 14:54 No, you're right. It is. See my answer above. ---------------------------------------------------------------------- ElEd0 · 2023-11-16 14:55 Seems perfect for creating scammy websites xD ---------------------------------------------------------------------- ohuf · 2023-11-16 14:56 But now that you have registered MyLastName-WifeLastName.com, nobody else can register it. What a pity. /s ---------------------------------------------------------------------- wageof · 2023-11-16 14:56 GDI, I have been using internal.registereddomain.com which is 5 wasted characters... ---------------------------------------------------------------------- ohuf · 2023-11-16 15:03 RFC 6762 defines the TLDs you can use safely in a local-only context: *.intranet *.internal *.private *.corp *.home *.lan Be a selfhosting rebel, but stick to the RFCs! ---------------------------------------------------------------------- Delyzr · 2023-11-16 15:06 Just have your dhcp set int.yourdomain.com as the dns suffix. Then you can omit that part. Eg: ha.int.yourdomain.com becomes "ha". Your pc will automatically add the suffix when trying to resolve the host "ha". ---------------------------------------------------------------------- HR_Paperstacks_402 · 2023-11-16 15:07 I have an io domain - mylastname.io AD domain is home.mylastname.io A place I put most apps running on my Kubernetes cluster is *.apps.mylastname.io ---------------------------------------------------------------------- JivanP · 2023-11-16 15:10 mDNS is generally used in conjunction with a protocol called DNS-SD (service discovery) to autodiscover network resources such as printers, Chromecasts, and other IoT stuff. DNS-SD is essentially a reverse-engineered standard that is compatible with Apple's Bonjour. It's also quite handy to connect to devices on your network that have dynamically assigned IP addresses, which is especially useful in IPv6+SLAAC environments. For example, my MacBook's name is set to `ocarina` in System Preferences > Sharing, and I have Remote Login (SSH server) enabled there, so from other devices on my network I just have to do `ssh ocarina.local` to access it, rather than needing to first look up its IP address manually. ---------------------------------------------------------------------- krimsonstudios · 2023-11-16 15:13 This is true on paper, but in practice not all clients will necessarily follow these rules. Or possibly the issue is that "2. The timeout is reached." is given a very low threshold in order to keep DNS resolutions as fast as possible. In practice, my secondary DNS is receiving ~5-10% of all DNS traffic, despite 100% uptime on my Primary. So if you set your secondary DNS to Google DNS, that is a decent chunk of DNS requests leaving the network. ---------------------------------------------------------------------- eco9898 · 2023-11-16 15:18 How would I go about setting up an internal hosts on my network to redirect dev.int.mydomain to an internal device? ---------------------------------------------------------------------- waka324 · 2023-11-16 15:24 Add a slash th the end to avoid this. Eg. Myhost.home/ ---------------------------------------------------------------------- sweedishfishoreo · 2023-11-16 15:26 In chrome you can just add a slash after the domain. If I type my home.lan, it searches on Google If I type home.lan/ it goes to the URL ---------------------------------------------------------------------- vim_jong_un · 2023-11-16 15:28 I own both \`mydomain.com\` and \`mydomain.net\`, and the \`.net\` is all my internal services (eg \`homeassistant.mydomain.net\`). The public \`.com\` domain I use exclusively for email and a static site. I had some old employer with a similar segmentation so it just made sense to me ¯\\\_(ツ)\_/¯ ---------------------------------------------------------------------- aarnavtale · 2023-11-16 15:29 I do something similar, but I just publicly point the DNS records to the internal IP. So even though you can publicly look it up and see the internal IP it would never resolve anyways unless you’re on the LAN ---------------------------------------------------------------------- nimajneb · 2023-11-16 15:30 .com lol. I got a 6 letter domain that makes for me. I should check out .local though. I could .com for my website and .local for my home network using the same domain name. ---------------------------------------------------------------------- ellipsoidalellipsoid · 2023-11-16 15:31 .home.arpa for A records. I run my own CA and DNS, and can create vanity TLDs like: a.git, a.webmail, b.sync, etc for internal services. ---------------------------------------------------------------------- 404invalid-user · 2023-11-16 15:33 Ahh makes sense I’ll have to do that on my MacBook don’t need to set a static ip then ---------------------------------------------------------------------- HTTP_404_NotFound · 2023-11-16 15:34 I mean.... I use [xtremeownage.com](https://xtremeownage.com) But, ya know... I own it. Although, I use a few subdomains for my home-network, with a split-horizon DNS setup. ---------------------------------------------------------------------- rsachoc · 2023-11-16 15:35 Could you provide high-level instructions on how to achieve this? I am using NPM at the moment pointing to internal docker containers and also 2 pi-holes (primary and secondary). ---------------------------------------------------------------------- Nuuki9 · 2023-11-16 15:40 I can certainly provide some high level info. Which element(s) did you want more info on and what do you have right now? ---------------------------------------------------------------------- tech_medic_five · 2023-11-16 15:41 lastname. systems I used to own lastname.cloud and foolishly let that expire. Its one of my biggest regrets. ---------------------------------------------------------------------- sequentious · 2023-11-16 15:42 For those using a pihole for .internal.example.com, how do you deal with DNSSEC on example.com? Or do you just not? ---------------------------------------------------------------------- SamanthaSass · 2023-11-16 15:45 "customer is always right in matters of taste", is the full quote, in other matters, not so much. But you're right, if they want to pay the price, they can have what they want. ---------------------------------------------------------------------- HearthCore · 2023-11-16 15:53 .loc for Internal DNS Records .ovh for public DNS Records .one for publicly accessible systems, i.E. Websites, E-Mail, SSO / LDAP ends with CN=one This is accompanied by my Router which DHCP sets static adresses through MAC Adresses, sets hostnames for .loc at the DNS The public DNS Domain is to reach services through VPN without the local DNS resolver, if needed, through the VPN specific adresses (i.e. Tailscale Network with Routes exposed) and the separation of .ovh and .one is basically, because I want these types of things separated for research purposes. ---------------------------------------------------------------------- VirtualP1rate · 2023-11-16 15:54 My tld is a 4 digit number. Makes my life easier. ---------------------------------------------------------------------- mrcaptncrunch · 2023-11-16 15:59 Lol _MINE!_ ---------------------------------------------------------------------- Mint_Fury · 2023-11-16 16:03 I use .lan for anything local and my public domain is .net for anything publicly hosted. ---------------------------------------------------------------------- jerwong · 2023-11-16 16:07 I use >!.cunt!< for my local TLD. Stands for Can't Use New Technologies from IT Crowd. It makes it comnical when I let friends onto my wifi. ---------------------------------------------------------------------- genitalgore · 2023-11-16 16:09 you would just set your piholes to resolve your internal domain to your reverse proxy and set up all of your sites on that domain. npm has support for DNS challenge via let's encrypt out of the box, but you'll have to consult the manual on how to do that for your specific domain registrar/nameservers ---------------------------------------------------------------------- stoneobscurity · 2023-11-16 16:11 i have owned a .com since 1997. i use that. ---------------------------------------------------------------------- phin586 · 2023-11-16 16:27 If your dhcp server sets int.yourdomain.com in your resolv search ---------------------------------------------------------------------- ohuf · 2023-11-16 16:29 Hey, it just came to my mind that, in fact we CAN use it safely, because you only use it internally, right? 🤣🤣🤣 ---------------------------------------------------------------------- Ironicbadger · 2023-11-16 16:30 > Full disclosure: I did not work for Tailscale at the time of recording this video, but now I do. The short answer here is to use SplitDNS. In this fashion I can use the following naming convention `service.host.site.realdomain.com` and use the split function in Tailscales magicDNS to route traffic where it needs to go including a local DNS server for each site. I made a video about it in the spring if you're curious for more details than this comment can provide. https://youtu.be/Uzcs97XcxiE?si=nHcjpcKhiQINknYR ---------------------------------------------------------------------- [deleted] · 2023-11-16 16:42 [deleted] ---------------------------------------------------------------------- technologiq · 2023-11-16 16:49 weird flex but OK. ---------------------------------------------------------------------- KD_done · 2023-11-16 16:54 Yeah, you're right.. I applied some Dunglish here. In Dutch the expression is "Klant is koning." Customer is King, at least it translates well enough.. But yes, the monkey has come out of the the sleeve, I'm Dutch ;) ---------------------------------------------------------------------- coldblade2000 · 2023-11-16 17:00 Just a question, in case anyone knows. I have an Octopi, and from any computer in my network without any configuration I can access it from http://octopi.local. I wish to do that with other services, how can such a thing be achieved? ---------------------------------------------------------------------- UnfetteredThoughts · 2023-11-16 17:00 Then you're back to 4 characters and might as well use .home ---------------------------------------------------------------------- davepage_mcr · 2023-11-16 17:02 I just use mdns so hostname.local resolves on the LAN. ---------------------------------------------------------------------- trararawe · 2023-11-16 17:03 It's surely practical, but I don't like the idea that all my subdomains are publicly viewable. That's the only reason I use .lan/.home, which of course requires me to setup my own CA, but to me that's a better compromise as my subdomains can't be seen in crt.sh or the like. ---------------------------------------------------------------------- Wixely · 2023-11-16 17:06 Being a bit of a rebel myself. I use ONLY a tld, and where subdomains would be used, I use domain.tld This has lead me to discover quite a few projects out there that don't parse domain names correctly, especially when you want to use an email like admin@tld and it cries because you have no dot. ---------------------------------------------------------------------- Delyzr · 2023-11-16 17:09 The entries in my int subdomain are not visible publicly as they only exist on my local dns server. The int subdomain is only available for a few moments during the dns challenge for letsencrypt every few months. I have it setup for a wildcard domain so i don't need to do this for every host. Everything is behind an internal reverse npm proxy though. ---------------------------------------------------------------------- TheSecondist · 2023-11-16 17:14 I bought a .casa domain Using it internally, but also routing one service to the outside with that domain ---------------------------------------------------------------------- jacaug · 2023-11-16 17:19 Same, last year had .xyz, this year its .lol. I bought from namecheap, were some deals bring the cost down to a buck. ---------------------------------------------------------------------- lutiana · 2023-11-16 17:20 I just use my public domain (eg [domain.com](https://domain.com)) and have split DNS setup. ---------------------------------------------------------------------- highedutechsup · 2023-11-16 17:20 https://datatracker.ietf.org/doc/html/draft-chapin-rfc2606bis-00 I use .host because .internal is too long to type and .local is a pita, but mostly because the browser actually tries to go there instead of some stupid webpage and I don't have to remember to put a slash at the end. ---------------------------------------------------------------------- ypoora1 · 2023-11-16 17:27 I use .lan as it's shorter and IMO nicer looking than .local ---------------------------------------------------------------------- bigpowerass · 2023-11-16 17:45 home.arpa. is the only correct answer. Everything else is out of spec. ---------------------------------------------------------------------- alekslyse · 2023-11-16 17:48 I use home.arpa as the base dns as that play very well and are the official standard, then I have a domain for my reverse proxy. Of course I can use that domain for the whole network, but I like to split it up ---------------------------------------------------------------------- xxreddragonxx1 · 2023-11-16 17:49 I have one .com and one .cc I wanted one of my domains to have a classic tld and I’ve had it for a few years. The .cc domain is my second one and pricing is decent on it too. I’ve learned that some tld are expensive as hell to keep and not worth it. ---------------------------------------------------------------------- atheken · 2023-11-16 17:50 run pihole/unbound/dnsmasq on your local network and configure it to resolve anything you want for `*.internal.example.com` On your public DNS provider, add an NS record for `internal.example.com` that points to your dns server’s IP(s). Profit. ---------------------------------------------------------------------- More_Leadership_4095 · 2023-11-16 17:53 Noice. We should get an RFC bot to inject more standards in here in case this guy is AFK. Good to know the rules before you break em. ---------------------------------------------------------------------- mhbnorthuk · 2023-11-16 18:00 Same, .lol is great haha ---------------------------------------------------------------------- yodahuang · 2023-11-16 18:01 I recently wrote a blog on this topic: https://blog.yanda.rocks/posts/home-intranet-with-https/ ---------------------------------------------------------------------- dinosaurdynasty · 2023-11-16 18:02 Just get a shorter domain name lol Also browser autocomplete works wonders, I basically type one or two letters and then go ---------------------------------------------------------------------- tech2but1 · 2023-11-16 18:13 And bookmarks! ---------------------------------------------------------------------- Catsrules · 2023-11-16 18:16 >Oh I thought they meant using a registered domain to map your entire local network by pointjng subdomains at internal ip addresses. That is exactly what you would do but you would do the pointing using your internal DNS server not an external DNS server. For example Internally DNS would resolve server1.mydomain.com to 192.168.1.5 Externally it depends. If I want to make it publicly available I would point it to the external IP address that goes to server1. If I don't want it publicly available I don't do anything and server1.mydomain.com would just resolve to the wildcard IP that *.mydomain.com is pointing to. ---------------------------------------------------------------------- tech2but1 · 2023-11-16 18:17 If DNS is a burden to support you're doing it wrong. I set it up once and haven't touched it since. Everything new that gets added "just works". ---------------------------------------------------------------------- Aurailious · 2023-11-16 18:18 I have 2 registered tlds in .dev and .net. I split their use using .net for personal/selfhosted sites and .dev for public facing. ---------------------------------------------------------------------- Darkextratoasty · 2023-11-16 18:25 And a dashboard, Heimdall is probably the most often used service in my entire system. ---------------------------------------------------------------------- KlausBertKlausewitz · 2023-11-16 18:30 .local ---------------------------------------------------------------------- KlausBertKlausewitz · 2023-11-16 18:31 Nice. Will think about that. I have my own domain. So that might be worth a try. ---------------------------------------------------------------------- Johannesboy1 · 2023-11-16 18:35 .space is the only answer, have to buy that though ---------------------------------------------------------------------- tiberiusgv · 2023-11-16 18:41 Everything at my house has a TLD named after the road I live on (a founding father last name). Everything at my offsite at my dads house uses TLD named after the road he lives on (a woman's first name). It's both arbitrary and practical. A number systems exist at both such as proxmox. truenas. pihole. plex. So it's a good way to tell them appart without having to differentiate them in the domain name. ---------------------------------------------------------------------- celestrion · 2023-11-16 18:48 `.net` I run a split-horizon DNS with a real domain name so that certificates are less of a pain in the neck. ---------------------------------------------------------------------- tomwebrr · 2023-11-16 19:13 I have a registered domain and using it like this: [*service.machine.l ocatio*n.myregistereddomain.cz](https://service.machine.location.myreg istereddomain.cz) You can use a Let's Encrypt certs inside lan if you use a real purchased domain. ---------------------------------------------------------------------- DotDamo · 2023-11-16 19:16 And I’ve been waiting years for somebody to ask that question! ---------------------------------------------------------------------- uapyro · 2023-11-16 19:17 Basically the whole thing. I've got a unifi setup with usg and cloud key 2 so that's interesting to me ---------------------------------------------------------------------- mmguero · 2023-11-16 19:24 That is a good point. It's not too hard to do that, though. I use .lan in my local network and have [step- ca](https://github.com/mmguero/docker/tree/master/step-ca) set up for internal certificates and SSH keys. ---------------------------------------------------------------------- Daniel15 · 2023-11-16 19:26 Get a short domain :) There's still plenty of two- and three-letter domains available at various ccTLDs. ---------------------------------------------------------------------- thekrautboy · 2023-11-16 19:27 Or course it wont work. ---------------------------------------------------------------------- Daniel15 · 2023-11-16 19:28 > you'll have to setup your own CA and install a root certificate on all your devices, which might not even be possible on some devices. Not worth the hassle IMO. Just get a short domain and use Let's Encrypt via DNS challenge. ---------------------------------------------------------------------- Nuuki9 · 2023-11-16 19:30 Fair enough. Here you go: **Ad-blocking (NextDNS)** Using NextDNS as the upstream DNS provider gives you ad blocking, basic parental controls and some other goodies. Using their UniFi integration means you can map VLANs to different policies, which is handy. * Install NextDNS CLI on UniFiOS. Instructions [here](https://github.com/nextdns/nextdns/wiki/UnifiOS). **Split Horizon DNS** You can run local DNS to resolve hosts for both the internal and external domains. To do this, you'll need to run some sort of DNS service. I use dnsmasq, running in a docker container. Assuming you get something running, its then easy to [configure NextDNS CLI](https://github.com/nextdns/nextdns/wiki/Split-Horizon) to forward your domains to it. **Reverse Proxy** Running web facing services is a bit of a separate topic, and there's already tons of good content in this sub about that. I run Caddy as my reverse proxy, and have simply configured dnsmasq with a wildcard, to resolve everything for both my internal (\*.internal..com) and external (\*..com) domains, to Caddy. If you want further details on any of this just ask, as there's plenty of good guides and vidoes to guide through any of this. ---------------------------------------------------------------------- Daniel15 · 2023-11-16 19:30 I use *.home.mydomain for publicly-accessible IPs (IPv6 addresses plus anything that I've port forwarded so it's accessible externally) and *.int.mydomain for internal IPv4 addresses. ---------------------------------------------------------------------- Im1Random · 2023-11-16 19:39 .box since it's recognized as valid TLD by many devices. Never use .local it's reserved for multicast DNS. ---------------------------------------------------------------------- fractalfocuser · 2023-11-16 19:45 Oh hey it's the the real deal! I love your podcast. Thanks for being great. You really are a massive blessing to this community. ---------------------------------------------------------------------- GrilledGuru · 2023-11-16 19:53 I read the answers and I am wondering if I should change what I do. I use the exact same domains and sundomains internally and externally. I simply have a DNS internally that will answer requests with local IP. So I don't have to address my machines with a different name when I am outside or inside. Can someone explain to me what I missed ? ---------------------------------------------------------------------- mrcaptncrunch · 2023-11-16 20:04 if you don't use the home subreddit, `*.home.reddit.com` 🤣 could be interesting... _What's the worst that can happen?_ ---------------------------------------------------------------------- FamousSuccess · 2023-11-16 20:09 I own a domain I purchased thru cloudflare. public facing services are say [xyz.mydomain.com](https://xyz.mydomain.com) internal facing is [xyz.local.mydomain.com](https://xyz.local.mydomain.com) This was internal access pipes into pihole, DNS directs it to Traefik on my server, then to the internal service. Not internet dependent. ---------------------------------------------------------------------- SomeGirlIMetOnTheNet · 2023-11-16 20:14 I use .home and it has the same problem (you need to type domain.home/ for browsers to treat it as an address) so .lan would still save you a character ---------------------------------------------------------------------- 7repid · 2023-11-16 20:27 I loaded everything I use regularly into links in home assistant and now I find I stopped using Heimdall... ---------------------------------------------------------------------- fuuman1 · 2023-11-16 20:30 Exactly the way I do it. Works perfect! ---------------------------------------------------------------------- Darkextratoasty · 2023-11-16 20:33 I tried to get into homeassistant, but I just don't get why people like it so much. I know it's got a lot of community addons, but it seemed like they made breaking changes all the time and 90% of the tutorials/instructions out there were obsolete. I found it to be really cumbersome and just a pain to work with. That was a few years ago though, maybe I should check back and see if it's any better nowadays. ---------------------------------------------------------------------- Ironicbadger · 2023-11-16 20:43 Naww. You're too kind! Thanks for listening :) ---------------------------------------------------------------------- 7repid · 2023-11-16 20:47 I'd say it definitely better suits users who have complex smart home needs, but also people who want to tinker. Agreed to your points that it also has a variety of downsides. For someone who is more focused on a homelab and less hardware... definitely overkill and something like Heimdall is better suited! ---------------------------------------------------------------------- markhaines · 2023-11-16 20:49 Congrats on the job! Big fan of Tailscale. ---------------------------------------------------------------------- JackDostoevsky · 2023-11-16 21:06 i made up a not real, non-standard TLD that i use lol (.null) I have a self signed CA that all my devices trust. Getting a real domain and just using that, with LetsEncrypt, would not have required me to explicitly trust my own CA, but hey, my system works. and i know i know, RFCs, but it works, and doesn't break anything. ---------------------------------------------------------------------- AnomalyNexus · 2023-11-16 21:12 Managed to buy a really sweet domain so using that for both mail and local domain >currently I have names for my machines in my /etc/hosts files across some of my machines A better way is to set the DHCP server to resolve local too via DNS. So in my case proxmox.mydomain.com and proxmox both resolve to a local IP...without any need to configure IPs manually anywhere. ---------------------------------------------------------------------- OttFreeballer · 2023-11-16 21:23 I also use home.arpa ---------------------------------------------------------------------- Sir-Kerwin · 2023-11-16 21:31 Can I ask why this is done over something like hosting your own certificate authority? I’m quite new to all this DNS stuff ---------------------------------------------------------------------- uapyro · 2023-11-16 21:55 Thanks! That'll give me a basic start to get going ---------------------------------------------------------------------- maevian · 2023-11-16 22:03 Why use a different domain for local as external? ---------------------------------------------------------------------- Tripanafenix · 2023-11-16 22:04 .lab ---------------------------------------------------------------------- maevian · 2023-11-16 22:04 Why not use *.domain.com ? If you own the domain you’ll never have a conflict that way ---------------------------------------------------------------------- Tripanafenix · 2023-11-16 22:07 In ff just add a slash at the end I. e. dashboard.lan/ ---------------------------------------------------------------------- Tripanafenix · 2023-11-16 22:12 Hmm I thought when I add tls internal to my reverse proxy rule for local domains, it does not get letsencrypt certs. But when I leave it out of the Caddyfile rule, it gets reachable from outside of the local network. How do I use your recommondation? Using a .home.lab domain locally with a DNS name resolve for every single local subdomain (dashboard.home.lab, grafana.home.lab, etc) right now with a caddy managing the outside and the inside reverse proxy work ---------------------------------------------------------------------- jjcf89 · 2023-11-16 22:19 Won't your letsenceypt cert break if your loading https://ha instead of https://ha.my.domain.com? ---------------------------------------------------------------------- zeta_cartel_CFO · 2023-11-16 22:24 Does pihole now support wildcard for the internal DNS? I haven't checked in awhile. So I've been just adding it as .example.com in pihole. ---------------------------------------------------------------------- youainti · 2023-11-16 22:24 I use \`.home.arpa\` as that is the "official" use of that domain. ---------------------------------------------------------------------- murdaBot · 2023-11-16 22:40 My TLDs are: .lan = management vlan .mobile = primary wifi .iot = locked down iot .guest = guest wifi The domain for each is my public .io domain. ---------------------------------------------------------------------- NeedANewerName · 2023-11-16 22:57 This is technically correct, which is the best kind of correct. ---------------------------------------------------------------------- gramkrakerj · 2023-11-16 22:58 How do you get https on those though? A lot of random stuff requires https these days. ---------------------------------------------------------------------- 546875674c6966650d0a · 2023-11-16 23:21 Get a real domain. Then you can use external stuff tonight you want. ---------------------------------------------------------------------- secopsx · 2023-11-16 23:22 true...not sure why I didn't. I guess my thought process was that if I ever desire to use \*. I wouldn't want to run into conflicts, by adding a sub subdomain then I never risk that. ---------------------------------------------------------------------- Asyx · 2023-11-16 23:32 I liked the idea of separating work and private emails and since domains are pretty cheap I just got .me for private emails and .dev for work (I work as a software developer). That's why I own both domains. I don't think there's a good reason to do it like this though. I could technically mess around with DNS records on the .dev domain and not worry about emails getting lost or whatever but I don't feel like this is a good reason to pay for the domain. Honestly if my wife wouldn't use the emails as well I'd probably get rid of the .me domain. Although I think if I'd use .dev I'd have a bunch of people mess up my email address over the phone. I'm German so chances are high they'd spell it def or just think I have a speech impediment and write down de. ---------------------------------------------------------------------- m4nf47 · 2023-11-17 00:12 Same here, I've got surname.com registered and use static DHCP with entries on Cloudflare for router.surname.com and fileserver.surname.com and grafana.surname.com etc. all with valid certs via letsencrypt. ---------------------------------------------------------------------- gameguyalien · 2023-11-17 00:33 I use .test a lot in my sandbox environments ---------------------------------------------------------------------- Heas_Heartfire · 2023-11-17 00:33 I use *.mydomain.dev cos I'm a dev... Got it for public access but ended up using locally as well because it's more convenient. ---------------------------------------------------------------------- DirectReflection3106 · 2023-11-17 00:37 In home decided to use .dot because for some reason chrome and chromium based do not automatically redirect it to https ,(at least for now) when you just type in the address in address bar, and do not redirect to search. So much more comfortable... why?.... ok, it maybe break access to all .dot sites but I never see something for me in that zone so so don't care ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-17 01:24 https is not a problem. But you'll need an internal CA and distributed its certificate to your hosts' trust store. ---------------------------------------------------------------------- coffee_n_tea_for_me · 2023-11-17 01:26 Yeah, it def does. That's what I've got my AD environment using. ---------------------------------------------------------------------- signed- · 2023-11-17 01:56 `.arpa` is a reserved name for Windows and Windows will only create reverse DNS records and no forwards Tested myself by 2-3 times on 2022 ---------------------------------------------------------------------- Mailstorm · 2023-11-17 02:27 Why do you need a subdomain? Just the top and have an internal DNS server. If a hosts matches your request never leaves the lan. If it does...who cares in the context of a home network. You can also just configure your DNS server to not forward request for a specific domain (yours) ---------------------------------------------------------------------- Mailstorm · 2023-11-17 02:28 Yes. ---------------------------------------------------------------------- Volitank · 2023-11-17 02:57 I do this too. I don't think it's bad. Sometimes you can have weird issues. Only time I remember weirdness is I had wildcard enabled on public DNS. So if a local DNS wasn't available it would always resolve to the public IP. Can be confusing. ---------------------------------------------------------------------- mtucker502 · 2023-11-17 03:05 You have to add it to the dnsmasq conf file. It’s crazy pihole doesn’t support this. ---------------------------------------------------------------------- McMaster-Bate · 2023-11-17 04:31 There are other scenarios where it will be picked, for example, some clients will send a query to all known DNS servers and take the first answer. Some clients will also "stick" to DNS servers, whichever responds to the very first query will be always be the first to be queried until DHCP renews/failure. In general, clients do not use DNS servers as primary/secondary. Anyone who has tried using a DNS server that is not domain controlled as a "backup" can probably tell you about it. ---------------------------------------------------------------------- NewDad907 · 2023-11-17 06:34 I want to do this, but I have no clue how to set it up on Asustor AS6706T. I’ve got a bunch of docker apps up and running and I’d like to simplify stuff with subdomains and better ssl. The whole self signed stuff is just a whole project in itself to work right. ---------------------------------------------------------------------- iavael · 2023-11-17 06:47 It's not like DNS is a huge burden by itself, it's just approach of avoiding creation of critical services unless they become necessary. Because infrastructure around them is a burden: they needs additional firewall rules on middleboxes, monitoring, redundancy, IaC, backups etc. ---------------------------------------------------------------------- Fortera · 2023-11-17 06:52 home.(real domain name) I can use LetsEncrypt via DNS-01 challenge, if I want to have anything accessible externally but be able to resolve to an internal IP internally then that's a piece of cake to do too as a result. ---------------------------------------------------------------------- liquoredonlife · 2023-11-17 06:52 I did something similar, though I've done a slight bifurcation- *.i.domain.tld -> the actual internal host/IP (internal dns is adguard) *.domain.tld all resolve internally using a DNS rewrite to a keepalived VIP that's shared between a few hosts serving caddy that handle automatic wildcard cert renewals / SSL / reverse proxy. While I talk to things via *.domain.tld, a lot of my other services also talk to each other through this method - having some degree of reverse proxy HA was kinda necessary after introducing this sort of dependency. ---------------------------------------------------------------------- liquoredonlife · 2023-11-17 07:06 If you own your own domain, the lifecycle toolchain to request, renew, deliver certs around a variety of cert authorities (letsencrypt is a popular one) makes it really easy, along with not having to worry about hosting an internal CA but more importantly dealing with distributing root certs to client devices that would need to trust it. I've used https://github.com/acmesh-official/acme.sh as a one-off for updating my Synology's https certificate (two lines - one fetch, one deploy - finishes in 20 seconds and can be cron'd to run monthly) and Caddy natively handles the entire lifecycle for me (i use cloudflare for my domain registrar which makes it both free and a snap to handle TXT challenge requests). Certbot is another popular one. ---------------------------------------------------------------------- Squanchy2112 · 2023-11-17 07:07 I still don't follow and I understand DNS pretty well when talking WAN it's this local stuff that I don't get. I have a FQDN as well I'd love to use that internally. I am seeing some people say you can use the subdomain you have for example if on my lan I go to plex.mydomain.com it would resolve locally but when outside my lan the same address could hit nginx proxy manager as normal. ---------------------------------------------------------------------- Sir-Kerwin · 2023-11-17 07:14 Thanks, that makes a lot more sense. I didn’t realize you’d need to make clients trust the CA. Which would actually be impossible for locked down devices like a Roku stick ---------------------------------------------------------------------- mr_whats_it_to_you · 2023-11-17 07:26 It depends. - Do you want to have access from outside of your network or do you want to host several services to the public (in the future)? Then I would recommend buying **your own public domain**. It doesn’t need to be a TLD. - Do you only want to use your services privately? Then use `home.arpa` as explained in the [rfc 8375](https://www.rfc- editor.org/rfc/rfc8375.html). I would discourage you from using popular but misleading „local“ domains like `.lan`, `.local`, `.home` etc. That is because those domains might already be available in public. So when you use `.lan` for example your dns-queries might be forwarded to the public never resolving your privately hosted services name. It could also „leak“ private network information like on what port you try to access a service and how that services name is. Also you should highly bot use `.local` which was also my mistake. Some services like MulticastDNS i.e. apple bonjour service rely on this domain. If you would use it unknown problems might be frustrating you. So if you host everything private, go for `.home.arpa`. ---------------------------------------------------------------------- VirtualDenzel · 2023-11-17 07:30 It.cave :p ---------------------------------------------------------------------- qfla · 2023-11-17 07:32 s-s-s-s-step-ca what are you doing? ---------------------------------------------------------------------- zanfar · 2023-11-17 07:44 Use the one you own. ---------------------------------------------------------------------- unixuser011 · 2023-11-17 08:43 I don't think Mac likes it ether, tends to mess with their ZeroConf/Bonjour setup ---------------------------------------------------------------------- r3Fuze · 2023-11-17 09:41 In Firefox you can go to `about:config` and add a new property named `browser.fixup.domainsuffixwhitelist.lan` with a value of `true`. Repeat for any other TLDs you need. ---------------------------------------------------------------------- heehoX · 2023-11-17 10:32 One of the few reasons I use AdguardHome ove PiHole ---------------------------------------------------------------------- GolemancerVekk · 2023-11-17 11:01 > On your public DNS provider, add an NS record for internal.example.com that points to your dns server’s IP(s). What is this for? I have this exact setup and I don't remember ever having to add this. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-17 11:13 In public DNS: * An `A` record pointing example.com to your public IP. * Explicit `CNAME` records, only if you need to expose services publicly. Example: `jellyfin.example.com -> example.com`. These will pick up changes in the public IP automatically. They can't be detected without DNS zone transfer, but can be confirmed if you know them (so maybe pick something less obvious than "jellyfin"). In NPM: * Obtain Let's Encrypt wildcard certificates for `*.example.com` and `*.internal.example.com` (or whatever you want instead of "internal"). These will become public in the LE registry but example.com is public anyway and internal.example.com will only be used on your LAN. * Use the `*.example.com` cert to set up mandatory TLS for public domains (jellyfin.example.com) and the `*.internal.example.com` cert to set up TLS for LAN services (nextcloud.internal.example.com). On your router: * Port-forward 443 to the reverse proxy port of NPM (not the admin port), on the LAN IP of the server running NPM. On your LAN DNS: * Set up an alias to resolve anything ending in `.internal.example.com` to the LAN IP of the NPM server. Post-setup: * Get rid of anything that's 80 (non-TLS) on NPM. You can pass the admin interface for NPM through NPM too and TLS-encrypt it. * Do not port-forward 80 on your router, ever. Flog yourself whenever you catch yourself even thinking about exposing or routing anything that's not TLS/VPN/SSH encrypted over the Internet (and it's a very good rule of thumb to do it on your LAN too). ---------------------------------------------------------------------- atheken · 2023-11-17 11:22 It’s called domain delegation. By adding an NS record to your public dns, you are making the pihole the authoritative server for that subdomain (and all subordinate domains). If you use the CNAME method I talk about, you don’t need to do this part. ---------------------------------------------------------------------- tech2but1 · 2023-11-17 11:22 I don't fully follow that but like I said, sounds like you're doing it wrong if you have to alter firewall rules every time you add a host because of DNS issues. ---------------------------------------------------------------------- atheken · 2023-11-17 11:38 The purpose of the FQDN is that your devices are always pointed at a DNS server that knows how to resolve for `.com`, but may not be able to resolve for one you made up, like `.foobaz` On the internal network, this doesn’t matter if you’re using a self- hosted DNS server, as queries will be routed to it, and you can put whatever domains/records you want into it. The benefit is that if you have public records pointed at your public IP, when you are not on your home network, they will still resolve using normal public DNS. When you _are_ on your local network, the queries end up going to your own DNS server, which can respond with internal IPs (this is _exactly_ why pihole works for blocking ads). The other important reason for using public DNS is that you need it in order to issue ACME-based certificates. You could bypass this and install a CA cert on each of your devices and then issue your own certificates, but if you can use the ACME-issued certificates, you can take advantage of the CAs that are already trusted on all your devices. Note that doing domain delegation (by adding an NS record), this effectively means anything under that domain will only resolve if the server is reachable. So it’s useful for keeping all the domain traffic internal locally, but not useful if you want to be able to access stuff remotely or get certs issued. In that case, public DNS A/CNAME records that point to your public IP will be more appropriate. ---------------------------------------------------------------------- katrinatransfem · 2023-11-17 11:53 The way I do is, on my public DNS provider (OVH), it points to the IP address issued by my ISP. They provide the ability to update dynamic IPs, though I don't need that feature as I have a static IP. On my local DNS, they point to the local IP addresses of the individual virtual machines that provide the services. ---------------------------------------------------------------------- ikbosh · 2023-11-17 12:43 You can use redirects on your proxy/web server to solve that problem. However this won't work for all scenarios admittedly, ---------------------------------------------------------------------- denverpilot · 2023-11-17 12:48 I just run (shall we add the word) “proper” split DNS with the same names for anything publicly exposed, internal. And not everything is publicly exposed. It’s just a standard registered TLD. It’s interesting how few responses here mention this. Why memorize two or more names for the same box/service when DNS easily handles it? DHCP clients set their own internal DNS names internally or are forced at the DHCP server. Static addresses via MAC as desired. They also get handed all the usual SRV records and special record types to find services, like the time server and such. Truly interesting that split DNS isn’t popular amongst the self hosting crowd. Type the name of the “thing” after setting it up correctly and you’ll be handed an appropriate address to reach it, no matter which of my networks you’re on. If you’re a dhcp client you’ll have the proper search domain handed right to you too, no need to even type the domain.tld at all. Just the hostname. ---------------------------------------------------------------------- jjcf89 · 2023-11-17 13:07 How? In my experience the browser won't handle the redirect until the invalid ssl cert is accepted. ---------------------------------------------------------------------- Squanchy2112 · 2023-11-17 13:38 Would you have a layman's guide to setting this up in pihole, I actually tried issuing lets encrypt certs through nginx proxy manager the other day and it did not work. Not having those splash pages would be great, maybe I need to have a dedicated letsencrypt container for handling the local DNS? I have two copies of pihole on two different machines for high availability l, but right now any local DNS entries I have are saved in the main instance. ---------------------------------------------------------------------- Am0din · 2023-11-17 14:39 I use .home as my internal network DNS name. I tend to name my servers and network based off movie-AI stuff; i.e., VIKI, Jarvis, Skynet, Mother, etc. I have registered domains as well, I am just waiting on my fiber to finally get installed before I start messing wtih DNS records and certs. ---------------------------------------------------------------------- iavael · 2023-11-17 16:01 I am not speaking about maintainance of DNS zones (that's easy), but about maintanance of authoritative DNS servers. ---------------------------------------------------------------------- phantom_eight · 2023-11-17 16:12 I use .home for the Windows domain/internal hosts and .online for my external domain as it was cheap, and the name I wanted was available. To access self hosted stuff with working SSL certs,.I set up split DNS. On the internal DNS sever, I have a forward lookup zone for the .online domain with static A records for .online and all the subdomains pointing at the internal address of a caddy reverse proxy. ---------------------------------------------------------------------- tech2but1 · 2023-11-17 16:49 I'm going to sound like a broken record here but, still sounds like you're doing it wrong! I set up DNS for my local domain some years ago and haven't touched it since! ---------------------------------------------------------------------- Numerous_Platypus · 2023-11-17 16:52 This is great. How are you dealing with SSL certs for internal sites? - if that's something that you're doing, not that it's needed. ---------------------------------------------------------------------- iavael · 2023-11-17 17:00 I just prefer to do things properly. Making “apt install bind9; nano /etc/named/home.arpa.zone /etc/named/named.conf; systemctl reload bind9” is indeed easy. But if you want to actually rely on that service, you have to setup it properly with IaC, monitoring, backups, redundancy etc. For me personally it isn’t worth it and it’s easier to remember dozen of IPs. ---------------------------------------------------------------------- tech2but1 · 2023-11-17 17:03 That's fair enough, but just because you like to do things properly that doesn't mean DNS is hard to manage. ---------------------------------------------------------------------- iavael · 2023-11-17 17:06 I didn’t say that. I said that additional critical services are burden to properly support them. ---------------------------------------------------------------------- realbosselarsson · 2023-11-17 18:19 Not sure this is what you want but I have a .one domain setup with local IPs. So if one server is on [192.168.1.8](https://192.168.1.8) I point the domain to that and by visiting [https://myserver.whatever.one](https://myserver.whatever.one) I get to that server. ---------------------------------------------------------------------- atheken · 2023-11-17 20:09 So, to make Let's Encrypt work, you need to do one of two things: 1. Point the domain to your public IP on port 80 and have that server the certbot files. 2. Have the certbot update the DNS and add a TXT record for the domain name you want to issue. (does not require anything on your server to be publicly exposed). Pihole is _only_ for making the network routing work internally without putting anything on public DNS. Let's Encrypt can't access your pihole, so the only thing it's going to rely on is whatever the public DNS provides, and the endpoint responding on port 80, if you used method 1 from above. ---------------------------------------------------------------------- EternityForest · 2023-11-17 21:58 I don't self host much of anything in everyday life, but when I'm working on a LAN related project I always use .local. Android now supports MDNS, so I use it pretty much everywhere. ---------------------------------------------------------------------- Ironicbadger · 2023-11-18 07:57 Cloudflare dns-challenge using caddy for some and traefik for others. ---------------------------------------------------------------------- ikbosh · 2023-11-18 09:12 You are right and I am sadly wrong, I'm thinking of the scenarios where you are redirected from :80 to :443 and this figure surely could just do different domain, but if using https only browser which most are, you're bang on the money. ---------------------------------------------------------------------- Big_Volume · 2023-11-18 20:06 NS records can't contain an IP address, and even if they could it's generally regarded as not good practice to put private IP addresses in DNS records. Even worse if you're saying your pihole responds to a public IP address at all. ---------------------------------------------------------------------- atheken · 2023-11-18 23:18 Sorry, I sorta skipped a step, but the point was that if you wanted to delegate a public domain to resolve (only) internally via pihole, it would need to eventually point to a private IP. I think it’s pretty clear from the context of this thread, what I said about acme (and the need to do this differently), and my other comments in this thread that I’m not advocating exposing the pihole to the public internet. For this use case. I understand it is some information that _could_ be leaked, but realistically it’s pretty negligible. If you’re on my network, you can scan port 53 for the entire subnet in like a second and know it’s running. Of course, if you start dumping all the hostnames and private IPs into public DNS, that dumps a lot more data out into the world, but in either case, the argument for having/not having private IPs in public dns is primarily a security through obscurity argument. ---------------------------------------------------------------------- Big_Volume · 2023-11-19 00:22 Maybe I'm just missing it then but I really don't understand what you gain from this set up. If you have an internal DNS server that you have set to resolve \*.internal.example.com, why have an NS record externally at all? Especially in the case of pihole, typically the point of having an internal DNS server is for all DNS requests to go through it, so it will already be answering all of your internal devices and their requests will never go to the authoritative server for your domain in the first place. If your internal DNS is not internet facing, for any external request to succeed you'd need to be on a VPN which could just be configured to use that internal DNS server from the get go. I agree that any private IP info "leaked" through DNS records like this is essentially negligible. But with seemingly no benefit either it's not really a matter of evaluating trade offs. ---------------------------------------------------------------------- Squanchy2112 · 2023-11-19 04:50 Yea I'm not sure how this will work, right now my domain has Ddns through cloudflare attached back to my home ip, this is serving out different services via nginx proxy manager. Currently my domains top level doesn't actually point to anything. My main subdomain is pointing back to my home ips reverse proxy though so I don't think I can point the top level to my IP address as it already is at a subdomain. So if I setup letsencrypt could I point it at that subdomain directly to get that public IP? And use this strictly for issueing lan based certs? ---------------------------------------------------------------------- atheken · 2023-11-19 11:30 You’re more or less correct. However, in my specific case, my router will allow me to set the pihole for DNS, but it _also_ adds the gateway IP and forwards stuff to public DNS, so I guess it’s a little bit of a belt-and-suspenders approach to make sure those queries land on my pihole no matter what. In my case, I actually _don’t_ delegate the subdomain, I have a wildcard CNAME that points to my proxy externally and A for those hostnames internally. This ensures they always resolve regardless of inside or outside of the network (or the pihole being down temporarily.) and the majority of the time the pihole is and things route internally. ---------------------------------------------------------------------- atheken · 2023-11-19 11:34 Let’s encrypt needs to be able to read _public_ information about your domain in order to issue a certificate. The “easy” way is to just serve the challenge files on port 80 and make sure public DNS points to your public IP (or a CNAME to your cloudflare hostname). The slightly less easy way is to put the challenge TXT record they provide into public DNS and then get the cert issued and installed. What you do with your pihole internally is irrelevant. ---------------------------------------------------------------------- Big_Volume · 2023-11-19 18:02 Ah got it. That's actually a pretty clever fix for a frustrating manufacturer choice. ---------------------------------------------------------------------- thetredev · 2023-11-20 04:13 dot lan. I don't need let'sencrypt. I just ceeate my own CA, my own (wildcard) certificates, and install the CA into all my boxes that I want or need to have certificate verification succeeding. ---------------------------------------------------------------------- [deleted] · 2023-11-20 10:58 [deleted] ---------------------------------------------------------------------- techmattr · 2023-12-01 03:18 Why use "int.registereddomain.com" and not just "registereddomain.com"? Any advantages or is it just an organizational thing? I just use "registereddomain.com" and we do the same at work. Never caused any issues.