Hi, folks! I was happy to finally get my domain set up and directing traffic to a couple of hosted services. Unfortunately, my domain only works from external networks and not my own. I can ping my domain from my internal network just fine, and I can see a response time of 0.12ms against my public facing IP address, but putting the URL into my web browser to hit my web apps just times out. If I run the test on my phone, same thing; however, if I disconnect from wi-fi and do the same thing over cell network, the page works as I’d expect. My friends are able to access my hosted services via URL as I’d expect.
Given that I can ping the address and it resolves to an IP, I’m guessing this isn’t a DNS issue. My OPNsense setup is that I’ve got my 192.168.1.X VLAN and my hosted services are isolated on the 192.168.10.X VLAN. The 1 VLAN can reach 10, but 10 can’t reach 1. I can still use my hosted services via IP address and port, but I’d rather just use the URL and hit my reverse proxy so that I don’t have to change the server address while navigating in and out of my apartment on my phone.
I’ve got two goals here in resolving this problem.
- I’d like to understand why it won’t resolve my URL on my local network and fix it. This is mostly just a learning experience thing given goal #2.
- After that’s working, I’d like to set up local DNS so that calls to reach my reverse proxy will never leave my home network, because I want to have access to my full bandwidth without running into my ISP’s bandwidth limits. After this is setup, I’m curious how I would verify that my call to the server is not leaving my apartment.
I’d appreciate any help you folks can offer!
EDIT: I believe this is solved? @[email protected] correctly identified this as a NAT issue. The same solution appears to resolve goal #1 and #2 at the same time. This is the part where “solved” has a question mark after it. I basically just went to the traffic graph in OPNsense and compared it before and after streaming a video. The VLAN 10 traffic matched the LAN traffic, and the WAN traffic appears unmoved. Because my new NAT rules (which I picked up from redlemace’s link to OPNsense documentation) are applying the port forwarding to the WAN, VL10, and LAN interfaces, I don’t believe the traffic ever leaves my home network when the destination is my external IP address. Of course, if you have reason to believe I didn’t actually solve my issue, feel free to quote some part of this paragraph and point it out to me. Always good to learn!
If you have internal DNS (technitium, pihole, bind, whatever), split DNS is easier (and, imo, better for long-term use). Your local DNS serves local IPs, public DNS serves public IPs.
I can’t imagine not using a proper internal DNS with split anymore.
I’m a big fan of Pihole (currently running it on a DietPi VM).
Being able to manage DHCP and DNS in a single place makes for much better control than the crappy DHCP from consumer routers. And almost any real DNS/DHCP server combo is better than those things.
Just rebuilt my PiHole over the last couple days, and it’s currently blocking 45% of DNS requests with no ill effects on any system - it’s a lot of Android app nonsense and a smart TV.
I’ve lost the Samsung TV service on the TV, but I never used it anyway, and the TV is so much more responsive now.
Yea, smart TV… Bad news. It’s next on the list to get a Kodi box on it.
So much this. And if OP uses only OpnSense it can be done in there directly. Just so much easier than hairpin NAT and all the other stuff.
This is one of the right answers, and probably the easiest.
But…who is your domain registered with? A lot of the big registrars (I.e. CF) can easily integrate into several opnsense plugins…namely ACME/HAProxy, and Dynamic DNS.
Dynamic DNS would make sure that “pubip.mydomain.com”, from the outside, always pointed to your Internet connection, even if your IP changes.
Then just register CNAMEs for your external services to point to your pubip.mydomain.com.
HAProxy reads the CNAME and directs it to the right service.
You can either use split DNS and have HAProxy listen on both the internal and external, and map DNS around that way…or you can just listen on your external interface and connect that way and only update one end.
Imo this is the more comprehensive solution, because this also easily solves certificates (via ACME). The last leg (from HAProxy to backend) and be unencrypted or just use long-life self-signed certs if you really care…but I wouldn’t worry about encryptipn on the inside of a homelab.