Hi, folks! I was happy to finally get my domain set up and directing traffic to a couple of hosted services. Unfortunately, my domain only works from external networks and not my own. I can ping my domain from my internal network just fine, and I can see a response time of 0.12ms against my public facing IP address, but putting the URL into my web browser to hit my web apps just times out. If I run the test on my phone, same thing; however, if I disconnect from wi-fi and do the same thing over cell network, the page works as I’d expect. My friends are able to access my hosted services via URL as I’d expect.
Given that I can ping the address and it resolves to an IP, I’m guessing this isn’t a DNS issue. My OPNsense setup is that I’ve got my 192.168.1.X VLAN and my hosted services are isolated on the 192.168.10.X VLAN. The 1 VLAN can reach 10, but 10 can’t reach 1. I can still use my hosted services via IP address and port, but I’d rather just use the URL and hit my reverse proxy so that I don’t have to change the server address while navigating in and out of my apartment on my phone.
I’ve got two goals here in resolving this problem.
- I’d like to understand why it won’t resolve my URL on my local network and fix it. This is mostly just a learning experience thing given goal #2.
- After that’s working, I’d like to set up local DNS so that calls to reach my reverse proxy will never leave my home network, because I want to have access to my full bandwidth without running into my ISP’s bandwidth limits. After this is setup, I’m curious how I would verify that my call to the server is not leaving my apartment.
I’d appreciate any help you folks can offer!
EDIT: I believe this is solved? @[email protected] correctly identified this as a NAT issue. The same solution appears to resolve goal #1 and #2 at the same time. This is the part where “solved” has a question mark after it. I basically just went to the traffic graph in OPNsense and compared it before and after streaming a video. The VLAN 10 traffic matched the LAN traffic, and the WAN traffic appears unmoved. Because my new NAT rules (which I picked up from redlemace’s link to OPNsense documentation) are applying the port forwarding to the WAN, VL10, and LAN interfaces, I don’t believe the traffic ever leaves my home network when the destination is my external IP address. Of course, if you have reason to believe I didn’t actually solve my issue, feel free to quote some part of this paragraph and point it out to me. Always good to learn!
Sounds like hairpin nat issue.
https://docs.opnsense.org/manual/how-tos/nat_reflection.html
It does sound exactly like this. However, I’m concerned about following these instructions when my external IP isn’t static. I still have yet to set up DDNS (I believe is the term, for automatically updating my domain’s DNS servers with whatever new IP address my ISP gave me), but this looks like it’s entirely IP driven.
EDIT: Actually, I just realized OPNsense has an alias for that, so I’m not sure why their own manual didn’t recommend it. I can just set the value to “WAN address”. It works! That’s step #1 down, and now I’m curious about step #2.
My local DNS only seems to set up IP address routing, so I’m not sure how to hit my reverse proxy with the subdomain I’m interested in and have it route accordingly; or even just skip the reverse proxy by having that URL internally route to an IP address and port, because there’s nowhere to put in a port.
You could either set up DNS overrides on your inwards facing DNS server, leaving external resolution to something like cloudflare (with DDNS), or you have a second internal domain for internal resolution.
I chose the latter for my homelab - it’s
service.lan.fqdninside andservice.fqdnon the outside. Since I use a wildcard cert, it’s still protected with TLS if I access it internally or externally.Edit: this also solves hair pinning as your internal resolution will go to your LAN network, not your public IP
DNS is just gonna be like that, I’m afraid. Unless there’s some other mechanism I’m not aware of, either updating your IP in your records or having a Dynnamic DNS setup is gonna be necessary.
I’m lucky enough that my ISP has a relatively long lease time and doesn’t care to change my IP a lot, so I don’t really mind updating mine manually the few times a year that becomes necessary.
If you have internal DNS (technitium, pihole, bind, whatever), split DNS is easier (and, imo, better for long-term use). Your local DNS serves local IPs, public DNS serves public IPs.
I can’t imagine not using a proper internal DNS with split anymore.
I’m a big fan of Pihole (currently running it on a DietPi VM).
Being able to manage DHCP and DNS in a single place makes for much better control than the crappy DHCP from consumer routers. And almost any real DNS/DHCP server combo is better than those things.
Just rebuilt my PiHole over the last couple days, and it’s currently blocking 45% of DNS requests with no ill effects on any system - it’s a lot of Android app nonsense and a smart TV.
I’ve lost the Samsung TV service on the TV, but I never used it anyway, and the TV is so much more responsive now.
Yea, smart TV… Bad news. It’s next on the list to get a Kodi box on it.
So much this. And if OP uses only OpnSense it can be done in there directly. Just so much easier than hairpin NAT and all the other stuff.
This is one of the right answers, and probably the easiest.
But…who is your domain registered with? A lot of the big registrars (I.e. CF) can easily integrate into several opnsense plugins…namely ACME/HAProxy, and Dynamic DNS.
Dynamic DNS would make sure that “pubip.mydomain.com”, from the outside, always pointed to your Internet connection, even if your IP changes.
Then just register CNAMEs for your external services to point to your pubip.mydomain.com.
HAProxy reads the CNAME and directs it to the right service.
You can either use split DNS and have HAProxy listen on both the internal and external, and map DNS around that way…or you can just listen on your external interface and connect that way and only update one end.
Imo this is the more comprehensive solution, because this also easily solves certificates (via ACME). The last leg (from HAProxy to backend) and be unencrypted or just use long-life self-signed certs if you really care…but I wouldn’t worry about encryptipn on the inside of a homelab.
All good answers so far.
Basically your internet gateway doesn’t support what’s called NAT hairpin, also called NAT loopback.The DNS solution is better anyway, and that particular setup is called split-horizon DNS, which basically just means your internal DNS requests get different results than ones from outside your network.
And to solve this problem, if you host your own internal DNS also you can just add entries there. Pihole is a nice cheap option and runs on a raspberry pi.
Yup, sucks if you have more than one device though 💀
You can also just edit local DNS records on the devices you intend to access the service from. Flakier, but requires no extra hardware/services
My guess for the ping is, that the domain resolves to the IP of your OPNsense-router, hence it’s not your server responding, but the router.
I haven’t set up port forwarding for OPNsense, but my guess would be it’s only working for connections from the wan interface or some local rebind protection. You could set up a DNS-override in the unbound settings for your domain and redirect to the internal IP-address, no need to set up an additional DNS-server.
Just looked it up.
Under Services > Unbound DNS > Overrides you can add an entry for your server as an DNS A record and be done with
I use a vpn. It sounds stupid but it works. I’m always away from home
Given that sort of description I’d bet that it is DNS actually. If you run a DNS lookup from your LAN for your domain, do you get the external IP or the internal one? You can try this with
digin Linux ornslookupin Windows (I think).If I’m right and you’re getting the external IP even when querying from your LAN, then what you need is either a separate DNS for your LAN or what they call a “split DNS” whe are a your domain server returns a different value depending on the originating IP.
You can check for this by editing your
hostsfile. If you add your domain and local IP there and then try to ping that domain on that machine, it should work. If you’ve got a small network, you might even just copy the hosts lines between machines (this is what I do for example).Another option is to use a proxy service like cloudfare. You end up with internet speed when accessing internal resources though, even if your client is internal.
I feel bad because I know I have encountered this a few times and can’t for the life of me remember the specific instances or how they were rectified.
You know what, my Android phone has started doing the same thing as of a month ago. I didn’t change anything, it just suddenly can’t load internal IPs through the domains. It works fine on my computer, though.
I use split-horizon DNS.
I had this happen too recently and only for certain apps. Turned out Android has a new permission that was being enforced: “Nearby devices”. Once I granted that to my browser, it could access my LAN again.
