Local Domains reddit / selfhosted ---------------------------------------------------------------------- vesuvious911 · 2023-12-12 15:43 I am trying to access my local containers by using a domain rather than typing in IP:port every time on my local network, however, I'm getting a bit confused. I have my domain through Cloudflare ([home.net](https://home.net)) and I am using NPM to access my services from outside the network. I don't know how to set everything up inside my network. I use AdGuard rewrite (container.me) for redirecting to certain IP addresses, but I cannot do that with ports. Does anyone know of any guides to follow or any tips on what to do? ---------------------------------------------------------------------- thekrautboy · 2023-12-12 15:52 You can use a reverse proxy like your NPM for internal services too. /r/NginxProxyManager ---------------------------------------------------------------------- vesuvious911 · 2023-12-12 17:09 That's what I am trying to do. I will try that sub. ---------------------------------------------------------------------- Eifellovkas · 2023-12-12 17:11 I use traefik + wireguard + pihole. Everything is accessible on my domain only on local network or with wireguard. Traefik was a bit tricky to set up, but since then it just works and adding new subdomains is easy. ---------------------------------------------------------------------- HumorConscious1336 · 2023-12-12 17:21 Cloudflare zero-trust tunnel are free and use IP:Port ---------------------------------------------------------------------- RedditSlayer2020 · 2023-12-12 17:25 That's why you use unofficial TLDs which aren't routable on the internet like .internal or .homebase ---------------------------------------------------------------------- Anejey · 2023-12-12 17:28 You want to have a local DNS server. Pi-Hole can do it, so I assume AdGuard can too, I just don't know how. When you add a proxy host in NPM (for example, service.domain.com pointing to 192.168.0.10:42069), you then need to add a corresponding DNS entry that's gonna point that very domain at NPM (not the service itself). Meaning you'd have DNS entry pointing service.domain.com to the IP of your NPM, which could for example be 192.168.0.20. (NPM doesn't have a specific port) ---------------------------------------------------------------------- vesuvious911 · 2023-12-12 17:33 In AdGuard it is called a rewrite. When I input the rewrite into AdGuard, [container.domain.com](http://container.domain.com) pointed to my unraid machine (192.168.5.5) which hosts NPM, it just brings me to my Unraid login. Do I need to host NPM on its own network with its own seperate IP address? ---------------------------------------------------------------------- Anejey · 2023-12-12 17:45 I haven't used Unraid, but it's probably since Unraid is on the same port NPM listens on. I don't really know how to fix that, but there's probably some guides on that online. If you host NPM elsewhere with its own IP (in the same LAN), then it'll work. ---------------------------------------------------------------------- thekrautboy · 2023-12-12 17:52 Adguard only does DNS nothing else. You say you also want to get rid of having to add port numbers. So you need to properly use your reverse proxy combined with DNS. As i have already told you. Plenty of guides for NPM and Youtube videos etc exist for this. ---------------------------------------------------------------------- LidgChris · 2023-12-12 18:02 Homelab.shoopitypoopdoopscoop is mine ---------------------------------------------------------------------- RedditSlayer2020 · 2023-12-12 18:03 Based! ---------------------------------------------------------------------- LidgChris · 2023-12-12 18:04 I just changed it “homelab.redditslayer2020” ---------------------------------------------------------------------- 5T3V3-0H · 2023-12-12 18:31 Use Cloudflare tunnel with a wildcard domain and keep proxy on. Domain dns setting: *.domain - point to tunnel Tunnel setting: *.domain - point to NPM Now you handle setting all the subdomains you want in NPM *If you want a subdomain to be handled outside of the the tunnel and NPM, then add it in your domain dns settings. Or *If you want a subdomain to be handled inside your tunnel, but outside of NPM, then add it in your tunnel settings (keep your wildcard at the bottom of the list here so it doesn’t take priority) With the tunnel you can turn off port forwarding if you don’t need it. Makes your network more secure The proxy setting on your domain dns being enabled will allow you to use applications in zero-trust and set access control rules for each subdomain. Also if you wanted to close the ports on containers so they can’t be accessed even from the host machines local ip you can place all your containers in the same network and “un-expose” the ports Containers in the same network do not need ports exposed to communicate with each other. They simply refer to each other by containername:port ---------------------------------------------------------------------- Ursa_Solaris · 2023-12-12 18:32 To be clear, this has nothing to do with DNS. The issue is only one program can listen on any given port for a given IP address. The port is how the computer determines what traffic goes to which program. I haven't used Unraid, but I'm assuming it listens on the default web ports of 80 and 443. These are also the same ports NPM listens on, since the goal is to direct web traffic. Since Unraid starts first, it gets control and NPM has to go pound sand. Ideally, you should be able to change change Unraid's web port to something else, and then direct a subdomain or subpath to that port inside NPM. You could also host NPM on another IP address if you just want to avoid this issue entirely. Once you set up NPM correctly, it will take a request (sub.domain.tld) and forward that to something else (hostname:1234) completely transparently, and all will be well. ---------------------------------------------------------------------- RedditSlayer2020 · 2023-12-12 18:49 ♥ ---------------------------------------------------------------------- CompetitiveYam6697 · 2023-12-12 18:51 https://youtu.be/qlcVx-k-02E?si=P4dA2TxwjBsUvsAf works great ---------------------------------------------------------------------- dknight_au · 2023-12-12 19:49 I think you would need to put the npm container on eth0 rather than bridge mode. Then point the rewrite to the npm ip address. But, I haven't tried this combo of tools, so I can't be sure. ---------------------------------------------------------------------- rantanlan · 2023-12-12 20:00 you want to use [home.arpa](https://home.arpa) https://datatracker.ietf.org/doc/html/rfc8375.html ---------------------------------------------------------------------- blackoutjr · 2023-12-12 20:02 IF you _only_ want the domain(s) to work internal you can point they DNS records at your internal NPM ip address - this is the easiest way to do what you want; no tunnels, no internal DNS server etc. The biggest issue is that this will _not_ provide access outside your network. I do this with a trash domain I had on cloudflare that I wasn't using for anything else. I have an A record of "*" pointed at 192.168.1.125 (my NPM box) work just fine. ---------------------------------------------------------------------- mrXmuzzz · 2023-12-12 20:06 Dns ---------------------------------------------------------------------- RedditSlayer2020 · 2023-12-12 20:09 RFCs are LAW. May the wizard of arpanet never be forgotten and the dialup bbs always in our memory ---------------------------------------------------------------------- deshawn_utah · 2023-12-12 20:41 Thank you for this comment! I have been stuck trying to point the subdomain record in PiHole at the IP (DNS-masked or not) of the machine the service is running on, but when I go to the proxy host HTTPS URL set up in NPM the address does not resolve. Changing all the subdomain records in PiHole to point at the same host that NPM is running on has allowed me to access services on different LAN IPs. ---------------------------------------------------------------------- vesuvious911 · 2023-12-12 21:06 So I found I had a couple problems. The template I was using for NPM from Unraid (jlesage), apparently has a known issue with proper port communication. So I firstly changed over to the official NPM template in Unraid. Second issue was that I needed to put my NPM container on a network where I can specify the IP address, so I changed the custom network to br0 which allowed me to specify the IP so I could send my AdGuard rewrites to NPM. Once I did that, added in the \*.domain.com rewrite, it has since been working. I am now able to search my domain in browser, my adguard instance sees the search, sends it to NPM and then NPM sends me to my container instance. Thanks for the help from all who chimed in! ---------------------------------------------------------------------- coffeeincardboard · 2023-12-12 21:51 I set this up last night! I set my DNS setting on my OPNSense router to point at my PiHole first, then other DNSs sequential. Then followed this guide. https://ltm56.com/how-to-create-custom-domains-with-pihole-and-nginx- proxy-manager/#port-setup ---------------------------------------------------------------------- coffeeincardboard · 2023-12-12 21:56 So I have my router pointing at my PiHole, pointing each subdomain at my npm. Are you saying I could skip the pihole and go directly to the NPM? ---------------------------------------------------------------------- Sp33dFr34k85 · 2023-12-12 22:52 You know OPNSense can do this as well right? You technically don't need PiHole for that, unless ofcourse you need an adblocker as well. ---------------------------------------------------------------------- coffeeincardboard · 2023-12-12 22:55 I asked that on a different thread. Set OPNSense to check NPM as the first DNS? ---------------------------------------------------------------------- Sp33dFr34k85 · 2023-12-12 23:04 Set up split DNS. Point to your NPM when using your domain only. Can be done via on OPNSense via Unbound DNS -> Host override. ---------------------------------------------------------------------- coffeeincardboard · 2023-12-12 23:40 Ooh slick! Thanks! ---------------------------------------------------------------------- Grand-Pudding6040 · 2023-12-13 01:17 You can either to the DDNS route or go the Zero trust route. ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-12-13 02:08 NPM has specific ports - by default 80 and 443, as well as 81 for the UI, though you can change those or forward them to different ports on a host via a container setup. It's just that you don't have to specify them just as you don't generally have to specify that you're using those ports when accessing web services - they're assumed by the browser. ---------------------------------------------------------------------- blackoutjr · 2023-12-13 02:39 Yeah, at the end of the day you're doing the same thing configuring DNS local or in cloudflare. ---------------------------------------------------------------------- kurucu83 · 2023-12-13 05:12 I thought there were questions about connecting CloudFlare tunnel to machines that were part of internal networks? Single machines on the web, fine, but not machines that may act as a gateway to e.g. your home network.