Hi, folks! I was happy to finally get my domain set up and directing traffic to a couple of hosted services. Unfortunately, my domain only works from external networks and not my own. I can ping my domain from my internal network just fine, and I can see a response time of 0.12ms against my public facing IP address, but putting the URL into my web browser to hit my web apps just times out. If I run the test on my phone, same thing; however, if I disconnect from wi-fi and do the same thing over cell network, the page works as I’d expect. My friends are able to access my hosted services via URL as I’d expect.
Given that I can ping the address and it resolves to an IP, I’m guessing this isn’t a DNS issue. My OPNsense setup is that I’ve got my 192.168.1.X VLAN and my hosted services are isolated on the 192.168.10.X VLAN. The 1 VLAN can reach 10, but 10 can’t reach 1. I can still use my hosted services via IP address and port, but I’d rather just use the URL and hit my reverse proxy so that I don’t have to change the server address while navigating in and out of my apartment on my phone.
I’ve got two goals here in resolving this problem.
- I’d like to understand why it won’t resolve my URL on my local network and fix it. This is mostly just a learning experience thing given goal #2.
- After that’s working, I’d like to set up local DNS so that calls to reach my reverse proxy will never leave my home network, because I want to have access to my full bandwidth without running into my ISP’s bandwidth limits. After this is setup, I’m curious how I would verify that my call to the server is not leaving my apartment.
I’d appreciate any help you folks can offer!
EDIT: I believe this is solved? @[email protected] correctly identified this as a NAT issue. The same solution appears to resolve goal #1 and #2 at the same time. This is the part where “solved” has a question mark after it. I basically just went to the traffic graph in OPNsense and compared it before and after streaming a video. The VLAN 10 traffic matched the LAN traffic, and the WAN traffic appears unmoved. Because my new NAT rules (which I picked up from redlemace’s link to OPNsense documentation) are applying the port forwarding to the WAN, VL10, and LAN interfaces, I don’t believe the traffic ever leaves my home network when the destination is my external IP address. Of course, if you have reason to believe I didn’t actually solve my issue, feel free to quote some part of this paragraph and point it out to me. Always good to learn!
It does sound exactly like this. However, I’m concerned about following these instructions when my external IP isn’t static. I still have yet to set up DDNS (I believe is the term, for automatically updating my domain’s DNS servers with whatever new IP address my ISP gave me), but this looks like it’s entirely IP driven.
EDIT: Actually, I just realized OPNsense has an alias for that, so I’m not sure why their own manual didn’t recommend it. I can just set the value to “WAN address”. It works! That’s step #1 down, and now I’m curious about step #2.
My local DNS only seems to set up IP address routing, so I’m not sure how to hit my reverse proxy with the subdomain I’m interested in and have it route accordingly; or even just skip the reverse proxy by having that URL internally route to an IP address and port, because there’s nowhere to put in a port.
You could either set up DNS overrides on your inwards facing DNS server, leaving external resolution to something like cloudflare (with DDNS), or you have a second internal domain for internal resolution.
I chose the latter for my homelab - it’s
service.lan.fqdninside andservice.fqdnon the outside. Since I use a wildcard cert, it’s still protected with TLS if I access it internally or externally.Edit: this also solves hair pinning as your internal resolution will go to your LAN network, not your public IP
DNS is just gonna be like that, I’m afraid. Unless there’s some other mechanism I’m not aware of, either updating your IP in your records or having a Dynnamic DNS setup is gonna be necessary.
I’m lucky enough that my ISP has a relatively long lease time and doesn’t care to change my IP a lot, so I don’t really mind updating mine manually the few times a year that becomes necessary.