Guide: Setting up Local DNS WITH PORTS
reddit / selfhosted

----------------------------------------------------------------------
bwfiq · 2023-12-08 03:18

Setting up wildcard DNS and routing subdomains to specific services
can streamline access to various applications in your homelab. This
guide will walk you through configuring Pi-hole and a reverse proxy
server to achieve this.

# Homelab Context (skip if uninterested)
I have a NAS on .0.181 and a
[swag](https://github.com/linuxserver/docker-swag) container (on a
different port than nginx) on .0.180 that points to my public facing
services. For obvious reasons, I don't want my public domain to point
to any other ports/addresses on my home network. Additionally, as
elegant as swag is, it requires authentication and so won't work for
simple local DNS. I now have one local domain for each server and an
nginx instance on each that resolves to my different services on each.

---

# Requirements
* Pi-hole set up as a DNS server for your home network (I use the
[docker container](https://github.com/pi-hole/docker-pi-hole/)
implementation of Pi-hole)
* A reverse proxy server (I use [Nginx](https://www.nginx.com/) as a
[docker container](https://github.com/linuxserver/docker-nginx))

# Wildcard DNS with Pi-hole (source:
[hetzbiz.cloud](https://hetzbiz.cloud/2022/03/04/wildcard-dns-in-
pihole/))
As mentioned, the GUI only allows A records to the domain without any
subdomains. You can also use CNAME records in the Pi-hole admin panel
to set up specific subdomains for each service and a reverse proxy to
route to them. I chose the below method because it allows for what are
*functionally* wildcard records, so all I have to do when adding new
services is to set up a nginx config (or your preferred reverse proxy)
to point to the required port.

1. Navigate to `/etc/dnsmasq.d` on your Pi-hole machine
2. Create a new file, e.g., `02-my-wildcard-dns.conf`
3. Add lines for each local domain and local IP you want:
`address=/domain1.local/192.168.0.100` **(Replace the domain/ip
address as needed.)**

What this will achieve is all local devices will be routed to
192.168.0.1 when accessing domain1.local or xyz.domain1.local or any
other subdomain of domain1.local, or what is *functionally* a wildcard
record, though not exactly as described [here](https://discourse.pi-
hole.net/t/support-wildcards-in-local-dns-records/32098/12).

# Reverse Proxy Configuration
The below steps are for nginx. Adapt them for your own reverse proxy
solution.
Add a configuration file (e.g., in `/site-confs/`) with the following
content:

    server {
        listen 80;  # listen for incoming connections on port 80 or
http traffic
        server_name subdomain1.domain1.local;   # the full URL you
want to access this service with

        location / {
            proxy_pass http://192.168.0.100:8080;   # the IP address
and port of your service
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

The above is based on routing domain1.local to 192.168.0.180, and will
route subdomain.domain1.local to 192.168.0.180:8080. To add this to
your own configuration, replace subdomain.domain1.local with your
needed subdomain and 192.168.0.180:8080 with your server's ip and
port.

# Warning for Beginners
The reverse proxy configuration above should only be used for local
access. When using a reverse proxy to expose your server to the
internet, use a more secure configuration, or use a more secure all in
one reverse proxy solution like
[swag](https://github.com/linuxserver/docker-swag) or
[traefik](https://traefik.io/traefik/).

# Example Config
File paths below are because I run them in docker containers; YMMV

*/pihole/etc-dnsmasq.d/02-my-wildcard-dns.conf:*

    address=/janus.local/192.168.0.180
    address=/apollo.local/192.168.0.181

*/nginx/config/nginx/site-confs/omv.conf:*

    server {
        listen 80;
        server_name omv.apollo.local;

        location / {
            proxy_pass http://192.168.0.181:16543;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

*/nginx/config/nginx/site-confs/transmission.conf:*

    server {
        listen 80;
        server_name transmission.apollo.local;

        location / {
            proxy_pass http://192.168.0.181:9091;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

----------------------------------------------------------------------
thekrautboy · 2023-12-08 03:57

Thanks for sharing.

But please dont recommend to use `.local` for private networks like
this, its designated to and used by mDNS already. Instead use private
TLDs that are designated for this purpose like `arpa.home` or `.home`
or `.private` or `.lan` as examples.

----------------------------------------------------------------------
bwfiq · 2023-12-08 05:26

Thank you for letting me know about the .local! I am still a relative
beginner so I appreciate that. Will include this information in the
post.

I didn't mention bridge networking because (as a beginner) it was a
struggle getting it working compared to the relative ease of just
pointing it to the exposed (on the local network) port. If you could
share any guides for openmediavault that would be amazing

----------------------------------------------------------------------
lytn1ng · 2023-12-08 23:41

/u/thekrautboy seems to have meant
[home.arpa](https://datatracker.ietf.org/doc/html/rfc8375).

It's certainly what the IETF seems to have set aside for residential
use.

But you can only use self-signed SSL certificates.

If you want to use certificates from a CA (e.g. Letsencrypt), use a
"real" domain name.