Hi, what is the point of buying a domain to access devices in LAN via Wireguard? reddit / selfhosted ---------------------------------------------------------------------- mrRNobodY1 · 2023-11-26 20:59 I have read many posts in this subreddit and so many recommend using a domain (buying it) and then registering DNS. Maybe I misunderstood because I'm new, but in theory isn't it enough to use a DNS in lan like pihole, and then from the client browser using Wireguard simply write the domain defined on pihole? (Maybe even configuring nginx to have all the ports pointing to the correct services) Am I wrong? ---------------------------------------------------------------------- LastTreestar · 2023-11-26 21:03 Sheepism. Correct, you don't need a domain name. ---------------------------------------------------------------------- assclownsix9 · 2023-11-26 21:10 NEED is one thing. Making sure somebody else doesn't register that domain and start doing malicious things with it is another. ---------------------------------------------------------------------- ervwalter · 2023-11-26 21:17 The point of purchasing a registered domain name and connecting it to a public DNS server is to make it findable from any Internet location. If you only ever want to use the domain name internally, you don't need to have a public domain name and you can make up your own internal domain name that is served by your local DNS. To avoid future conflicts with public domains, I'd probably use a TLD that doesn't exist (e.g. not .com or the like). ---------------------------------------------------------------------- lesigh · 2023-11-26 21:32 A lot of people self host for themselves, family, friends, clients. It's easier to say "hey, login to x service at homelab.com" ---------------------------------------------------------------------- katenesana · 2023-11-26 21:42 A lot of mobile browsers won’t resolve local-only domains or even IP addresses unless you explicitly put https:// in front of it, every time. Instead they treat them as a search and you end up searching for your local domain in a search engine. It’s a pain in the ass and having a public, registered domain gets them to properly resolve even when you’re local services live on a non-public subdomain. ---------------------------------------------------------------------- 83736294827 · 2023-11-26 22:06 Being able to get ssl certs without loading self signed crap into every user/browser. ---------------------------------------------------------------------- EndlessHiway · 2023-11-26 22:22 Yes ---------------------------------------------------------------------- DarkKnyt · 2023-11-26 22:23 To build on this, if you self sign you have to distribute the root certificates to every system that will be accessing your services. ---------------------------------------------------------------------- BrenekH · 2023-11-26 22:41 Need? You don't need a domain, but many find it convenient to own one. In order to not use IP addresses without a registered domain, you need to do as you suggest and make custom entries in Pi-Hole or other local DNS server. However, with this approach TLS/SSL is not that easy to do (lots of managing self-signed certs) and any device that you want to connect from will need the DNS server set either through DHCP or manually, and even then some devices and applications use hardcoded DNS, especially "embedded" devices like smart TVs/speakers. My approach to all this is as follows. I have a domain that I pay for which contains both public and private services in the A records. Everything that's private just points to the internal IP address of the reverse proxy which then proxies the correct pages based on the domain name. By using Traefik's DNS verification for Let's Encrypt, all of my sites have SSL even if they're internal only. All of this means I can use any device on my network and get access to private services without needing to set DNS servers or trust self-signed certificates. It all just works. The only downside of my approach is that the SSL verifications get posted to the [Certificate Transparency logs](https://crt.sh/) which airs the subdomains that get verified. Technically you can use wildcard certs to get around this but if I really cared about the sub domains being secret, I wouldn't put them in public DNS in the first place. ---------------------------------------------------------------------- user3872465 · 2023-11-26 22:58 Yes, because how will you acces wireguard? Whats your endpoint? I mean its all fine if you have a static IP which never changes but that usually is not the case anymore. So you need a domainname to update. Also vpn.youlab.tld is esier to remember than 131.234.142.83 ---------------------------------------------------------------------- DesolateWolf · 2023-11-26 23:13 Can't get SSL certificates for an unregistered domain, my bitwarden instance is purely local (+VPN) but I still need SSL for it to work properly and I'm really not interested in managing my own CA and installing certificates on all my devices. ---------------------------------------------------------------------- asap_spergie · 2023-11-26 23:18 Isn’t .local reserved specifically for this? ---------------------------------------------------------------------- ervwalter · 2023-11-26 23:34 Yes and No. .local will never be used for Internet DNS, but locally it is used for [mDNS](https://en.wikipedia.org/wiki/Multicast_DNS) (called Bonjour by Apple) and uses a different protocol than DNS. If you use it for normal DNS, you may run into conflicts. ---------------------------------------------------------------------- BinaryRockStar · 2023-11-27 00:25 You don't strictly have to distribute the root certs. In Firefox at least you can click through the self-signed cert warning to access the site. ---------------------------------------------------------------------- cakee_ru · 2023-11-27 01:34 Oh boy by far not all software supports this, or at least in a consumer-friendly (read family) way. ---------------------------------------------------------------------- DarkKnyt · 2023-11-27 01:55 That's true but the whole reason why I did self-sign shirts in the first place was so I could store my passwords and have them automatically fill in. I switch between edge and Chrome and it was just the easiest thing to do. ---------------------------------------------------------------------- EDACerton · 2023-11-27 02:03 Cheap domain + Cloudflare DNS + ACME w/ DNS Challenge, signed certificates for internal services for dollars per year 👍 ---------------------------------------------------------------------- JoeB- · 2023-11-27 02:04 I'm confused. What are you trying to do? 1. Create an encrypted VPN (Wireguard) tunnel within your LAN, ie. to access a device on your LAN from another device on your LAN? 2. Create an encrypted VPN (Wireguard) tunnel from outside your LAN to a device in your LAN? If **#1**, then no. You do not need to register a public domain name. You can make up a domain name, or use [.home.arpa (RFC 8375)](https://www.rfc-editor.org/rfc/rfc8375.html), which is designated for non-unique use in residential home networks. For this, all you need is a private DNS server, eg. Unbound in pfSense or dnsmasq in Pi-hole, and a certificate manager. If **#2**, then yes, a public domain name is needed for two reasons: 1) for acquiring a certificate, and 2) unless you have a static public IP address, using Dynamic DNS (DDNS) for managing the public DNS record for your dynamic public IP address. If your public IP address is dynamic, you still don't need to register your own domain. There a plenty of services that offer DDNS and certs, [The 6 Best Free Dynamic DNS Providers](https://www.makeuseof.com/tag/5-best-dynamic-dns- providers-can-lookup-free-today/). ---------------------------------------------------------------------- BinaryRockStar · 2023-11-27 02:30 For sure, just letting people know self-signed certs aren't quite as cumbersome as was described as long as you have a simple setup like a handful of self-hosted websites or webapps. Getting free certs with LetsEncrypt is so painless now I can't really think of a reason to go with self-signed any more, other than of course the nominal cost of a domain registration. ---------------------------------------------------------------------- spanky_rockets · 2023-11-27 06:23 ddns also works and it’s free ---------------------------------------------------------------------- root_switch · 2023-11-27 06:32 Yup, the special use domain for home use is `.home.arpa` [RFC8375](https://www.rfc-editor.org/rfc/rfc8375.html) ---------------------------------------------------------------------- SillyLilBear · 2023-11-27 07:37 SSL is the main reason, this way your traffic is encrypted from snoopers on your land, and you don't get the warning messages about it not being secure. You can use a sub domain from desec for free to do this. ---------------------------------------------------------------------- Fishamatician · 2023-11-27 08:21 I spent yesterday trying to do this and ended up frustrated to point of wanting to pitch the server out the window. There are loads of guides for various parts but all seem to assume a certain amount of prior knowledge, I could really use some comprehensive tutorials that assume you're a dumbass that digs in the dirt for a living. If anyone sees this I have a domain name from porkbun, no-ip ddns on the router, a pihole with unbound, a server with proxmox freshly installed. I want to run jellyfin and amp game server as a start. I want to use my domain name example.Co.UK from the Internet all the way down to each service eg jellyfin.example.co.uk. Yesterday I installed nginx proxy manager on docker and then nginx web server on docker to server a static Web page to see if my domain connected but it said 0.0.0.0:8080 was already in use. Sorry to ramble but I have an OK surface level understanding of windows and Linux but networking is making me feel really dumb. ---------------------------------------------------------------------- WorthyFroglet · 2023-11-27 10:47 Registering a domain that somebody thought about buying but didn't isn't a hack. What are you even saying? ---------------------------------------------------------------------- fuken33 · 2023-11-27 12:16 Depends on what you want to do with your setup. In my case I have a domain for accessing my self hosted collection when I'm far from home but having a domain can also be useful for getting a ssl certificate for https, for increased security ---------------------------------------------------------------------- To-Ga · 2023-11-27 12:31 Noob question, but for #2, what is the point of having ssl for webservices? Aren't Wireshark tunnel supposed to offer the privacy level required? ---------------------------------------------------------------------- Viktor_654 · 2023-11-27 14:44 Have you tried taking the Pihole/Unbound out of the equation? Use a public DNS Pihole doesn’t support wildcard dns which was the issue I was having. Adguard does. Spin up an Adguard container and try it out. I really like Adguard compared to Pihole. ---------------------------------------------------------------------- Fishamatician · 2023-11-27 15:34 I hadn't thought of that as it's on a pi of its own, cheers I'll try that tonight. There are so many things to mesh together that I think I understand one thing enough to make it work only to find that conflicts elsewhere or needs something else set up first. It's great when something does work though so I'll keep at it. ---------------------------------------------------------------------- JoeB- · 2023-11-27 17:23 >...but for #2, what is the point of having ssl for webservices? Aren't Wireshark tunnel supposed to offer the privacy level required? SSL encrypts communication between an application (ie. web browser) and a server service (i.e. web server), which is important for privacy and security. Is SSL necessary when accessing services hosted on your LAN from across the Internet through an encrypted VPN tunnel? Probably not. Wireguard should provide the privacy needed. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-27 17:24 Lack of time or interest (or both) in: managing local DNS, using `.home.arpa` and running own CA. It's tricky (especially running your own CA *in a proper way*), and not everyone wants to do it. Also, it requires knowledge, and some people don't have it. Distribution of your root CA certificate is not *that* difficult. *NOTE: this addresses strictly OP's question about LAN-only access. External access or varying devices used to access is a completely different story.* ---------------------------------------------------------------------- horus-heresy · 2023-11-27 18:16 I just let my nginx proxy manager do that all for my subdomains ---------------------------------------------------------------------- haulan · 2023-11-27 19:06 Do you expose your public services through the same proxy? It sounds a bit like one could hit that proxy from the internet (if that path exists) with a manipulated host header and reach your private services. ---------------------------------------------------------------------- user3872465 · 2023-11-27 20:19 Well ddns is just dns which get auto updated via helper script which you can do yourself on your own domain aswell. So yes Point still stands. And a domain which is yours might still be nicer than a bottom of the barrle subdomain. Of which you often also don't get unlimited ---------------------------------------------------------------------- Fishamatician · 2023-11-29 07:47 Days just trying to get a ststic Web page connected to my domain name as a fist step lead to frustration and thinking I'm just too dumb for this and it turns out my isp uses cgnat so port 80 can never be seen even with a ddns service. I want to scream. ---------------------------------------------------------------------- electromage · 2023-12-02 20:59 Also you may still get warnings if it's not trusted by a "global root", unless you make additional changes in your browser.