Remote access through NPM with Pihole local DNS
reddit / selfhosted

----------------------------------------------------------------------
Unhappy-Manner1945 · 2023-12-20 15:14

I’m trying to set up my home services so that I can remote access them
through a VPN (Tailscale) so I can avoid exposing them to the
internet. For some reason, when out of my home network, the Proxy
Hosts don’t want to resolve while at home they work fine.

I’ve got several services set up in 2 different RPi’s (example
Paperless-ngx on 192.168.4.x) and NPM/Pihole on my main RPi
(192.168.4.y). I set up Tailscale and connected my main RPi and my
phone to it so it gives me a Tailscale IP (100.79.44.z). I set up my
Pihole DNS as my DNS server on my router and port-forwarded to the NPM
as well. I created a local DNS record with the Tailscale IP of the NPM
and CNAMES to the different services. Works like a charm at home since
I can open Paperless with paperless.home.

Out of my network though, it doesn’t work. I thought I only needed to
have my NPM server on Tailscale (since the proxy is an intermediary
and it’s always at home), but maybe this is wrong and I need all of
them?

Proxy hosts on NPM are configured with the services’ local static IP.
Do I need to configure proxy hosts with Tailscale IP’s? Do I need a
not-local DNS like DuckDNS? (This is the equivalent of exposing my
services to the internet which I’d rather not do).

----------------------------------------------------------------------
GSpanFan · 2023-12-20 16:39

My setup is different than yours, but I remember having similar issues
with locally hosted VPNs (e.g. OpenVPN and Wireguard).  I share a
couple of thoughts and maybe they'll help in the event that the
underlying problem is not tied to the reverse proxy

I wasn't using a reverse proxy in my setup, but also initially had
some connectivity issues.  With OpenVPN, which was built into my
router there was an option that the client would use the connection
for the local network only or the local connection plus Internet.  I
can't recall if there was a similar selection in Wireguard.  But maybe
consider whether there's some toggle in Tailscale for this.

Second thought is that I seem to recall there was a separate DNS
setting under my DHCP settings and that at some point I needed to
update that to point at one of the Piholes.

Hope some of this helps!

----------------------------------------------------------------------
Unhappy-Manner1945 · 2023-12-21 14:39

Found the solution. I had to configure my NPM server as an exit node
which effectively does what you suggested. Thanks!