I need help with my local Technitium DNS server reddit / selfhosted ---------------------------------------------------------------------- Anejey · 2023-12-16 17:43 Hello. Up until now I've been using Pi-hole's local DNS to forward my domain to local services (through NPM, domain, and certificates). Then I'd use cloudflare tunnels for my public services. Today I made the switch to a new domain and with that I wanted to use a different DNS server. After not being able to get PowerDNS installed I settled on Technitium, but I can't seem to make it work. I created a zone with "[example.cz](https://example.cz)" and made an A record for "\*.int.example.com" pointing to my reverse proxy (for internal services). This at first seemed to work just fine -> I could access all my services, with LE certificates and all that. First problem was in Uptime Kuma... for some reason some services kept being down with SSL error. It was all the \*arrs and Transmission. It felt somewhat random, as all the other services were up. The same error also appeared for all my Cloudflare Tunnels. I could access the sites just fine, and made sure all certificates were valid, it was just Kuma that kept saying they are down. The error: write EPROTO C0D7276C2D7F0000:error:0A000458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1586:SSL alert number 112 I was pretty much lost at this point. 2 hours of troubleshooting leading to nowhere. Later on I went to make a backup of some configs to my Gitea, where I noticed that it just wouldn't connect. Got this error: fatal: unable to access 'https://gitea.example.com/Anejey/Homepage.git/': gnutls_handshake() failed: The server name sent was not recognized Also found out that pings didn't lead to the URL, but instead to [`git ea.example.com.int.example.com`](https://gitea.example.com.int.example .com) At this point it became pretty obvious the problem is with DNS, as all pings were coming from the reverse proxy. Weirdest part is, I still could access the sites through the browser, I just couldn't ping them or use them in local apps (for example, the Home Assistant mobile app wouldn't connect to my public HS instance). If I disable the zone in Technitium, all works well, just the local services obviously don't resolve. Am I misunderstanding how DNS works? I know Technitium is more of a robust solution for authoritative/recursive DNS and domain management, where it works as primary DNS server, but I thought I could make it work just locally too. I'd really welcome any help. Been at this the entire day, and it feels like I'm losing my sanity. Also, assuming I get the DNS server working, I still really don't understand whats with that SSL error. It only appears for select few internal apps and the Cloudflare Tunnels (these I assume are just because of the DNS zone). ---------------------------------------------------------------------- Anejey · 2023-12-16 18:36 I quite possibly have fixed the problem. Instead of creating DNS zone with "[example.com](https://example.com)" and then making a wildcard "\*.int" DNS entry, I instead made a zone with "[int.example.com](https://int.example.com)" and then a simple "\*" entry. SSL errors are gone too. This feels like a really simple fix that should've occured to me, I dunno, five damn hours earlier. I'm still not confident I'm out of the woods yet, so I'd still appreaciate if someone took a look at the post to see if there is anything else that's baloney. ---------------------------------------------------------------------- NikStalwart · 2023-12-17 00:10 Two things: > Also found out that pings didn't lead to the URL, but instead to gitea.example.com.int.example.com Firstly, this is a good example of why I tell people to not use web UIs like NPM and Technitium. You don't understand what the underlying program is doing so you have this dumb issue. What *probably* happened is you entered 'gitea.example.com' into the 'host' field under the '*.int.example.com' zone instead of 'gitea' under the 'example.com' zone. I *highly* recommend looking up some documentation on DNS zones and using something like BIND9, Unbound, coreDNS or PowerDNS instead off a web UI like pihole or Technitium. Side note: what 'issues' did you encounter installing powerDNS? Never had any myself. Secondly, it looks like you have FUBARed up your TLS protocols: > write EPROTO C0D7276C2D7F0000:error:0A000458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1586:SSL alert number 112 What does this error tell you? >!It *should* tell you that, for some ungodly reason, you are still using SSLv3. SSLv3 has long since been deprecated and many tools no longer even support it. Uninstall Nginx Proxy Manager, read the documentation on nginx.org and configure TLS protocols and ciphers properly.!< ---------------------------------------------------------------------- OpenMall · 2023-12-17 07:11 I can't answer your question directly, sorry, but there is an active group on r/technitium https://old.reddit.com/r/technitium/ The author is very responsive as well. Also you can use the 'DNS Client' tab in the Technitium GUI to see exactly what the server is seeing on recursive lookups. HTH ---------------------------------------------------------------------- Anejey · 2023-12-17 07:44 Fair point. I'm usually comfortable using the cli, but when it comes to stuff like this I just need a web-ui. Too little time to RTFM. I also like seeing the graphs and whatnot. I made the DNS entry a wildcard, as I didn't want to input all 60-ish services separately like I did with Pi-Hole. This probably was the cause of the botched DNS. Once I specified the whole zone to "int.example.com" instead of just "example.com" I don't seem to be running into any issues. Also, I didn't really have issues installing PowerDNS... in fact I installed it like 6 times before I gave up on getting the Admin web-ui working as a systemd service with ngnix. I really like having a web- ui. As for the SSL, I have no idea. I'm just using Let's Encrypt certificates that are either given right through Cloudflare via tunnels, or via NPM through Cloudflare DNS. It's been a set-up and forget kind of thing, never really researched it more. The errors are gone now though.