My domain is accessible from external networks but not from my internal network. Might anyone know why?

Submitted ⁨⁨8⁩ ⁨hours⁩ ago⁩ by ⁨ampersandrew@lemmy.world⁩ to ⁨selfhosted@lemmy.world⁩

Hi, folks! I was happy to finally get my domain set up and directing traffic to a couple of hosted services. Unfortunately, my domain only works from external networks and not my own. I can ping my domain from my internal network just fine, and I can see a response time of 0.12ms against my public facing IP address, but putting the URL into my web browser to hit my web apps just times out. If I run the test on my phone, same thing; however, if I disconnect from wi-fi and do the same thing over cell network, the page works as I’d expect. My friends are able to access my hosted services via URL as I’d expect.

Given that I can ping the address and it resolves to an IP, I’m guessing this isn’t a DNS issue. My OPNsense setup is that I’ve got my 192.168.1.X VLAN and my hosted services are isolated on the 192.168.10.X VLAN. The 1 VLAN can reach 10, but 10 can’t reach 1. I can still use my hosted services via IP address and port, but I’d rather just use the URL and hit my reverse proxy so that I don’t have to change the server address while navigating in and out of my apartment on my phone.

I’ve got two goals here in resolving this problem.

I’d like to understand why it won’t resolve my URL on my local network and fix it. This is mostly just a learning experience thing given goal #2.
After that’s working, I’d like to set up local DNS so that calls to reach my reverse proxy will never leave my home network, because I want to have access to my full bandwidth without running into my ISP’s bandwidth limits. After this is setup, I’m curious how I would verify that my call to the server is not leaving my apartment.

I’d appreciate any help you folks can offer!

original

Comments

Sort:hotnew top

redlemace@lemmy.world ⁨8⁩ ⁨hours⁩ ago
Sounds like hairpin nat issue.

docs.opnsense.org/manual/…/nat_reflection.html

original
- ampersandrew@lemmy.world ⁨7⁩ ⁨hours⁩ ago
  It does sound exactly like this. However, I’m concerned about following these instructions when my external IP isn’t static. I still have yet to set up DDNS (I believe is the term, for automatically updating my domain’s DNS servers with whatever new IP address my ISP gave me), but this looks like it’s entirely IP driven.
  
  original
  - Bakkoda@lemmy.world ⁨3⁩ ⁨hours⁩ ago
    I’ve had a cron job updating my IP every night at midnight for a decade plus. Never once had an issue.
    
    original
    -> View More Comments
  - thurstylark@lemmy.today ⁨7⁩ ⁨hours⁩ ago
    DNS is just gonna be like that, I’m afraid. Unless there’s some other mechanism I’m not aware of, either updating your IP in your records or having a Dynnamic DNS setup is gonna be necessary.
    
    I’m lucky enough that my ISP has a relatively long lease time and doesn’t care to change my IP a lot, so I don’t really mind updating mine manually the few times a year that becomes necessary.
    
    original
  - plateee@piefed.social ⁨3⁩ ⁨hours⁩ ago
    You could either set up DNS overrides on your inwards facing DNS server, leaving external resolution to something like cloudflare (with DDNS), or you have a second internal domain for internal resolution.
    
    I chose the latter for my homelab - it’s service.lan.fqdn inside and service.fqdn on the outside. Since I use a wildcard cert, it’s still protected with TLS if I access it internally or externally.
    
    original
curbstickle@anarchist.nexus ⁨7⁩ ⁨hours⁩ ago
If you have internal DNS (technitium, pihole, bind, whatever), split DNS is easier (and, imo, better for long-term use). Your local DNS serves local IPs, public DNS serves public IPs.

original
- JasonDJ@lemmy.zip ⁨7⁩ ⁨hours⁩ ago
  This is one of the right answers, and probably the easiest.
  
  But…who is your domain registered with? A lot of the big registrars (I.e. CF) can easily integrate into several opnsense plugins…namely ACME/HAProxy, and Dynamic DNS.
  
  Dynamic DNS would make sure that “pubip.mydomain.com”, from the outside, always pointed to your Internet connection, even if your IP changes.
  
  Then just register CNAMEs for your external services to point to your pubip.mydomain.com.
  
  HAProxy reads the CNAME and directs it to the right service.
  
  You can either use split DNS and have HAProxy listen on both the internal and external, and map DNS around that way…or you can just listen on your external interface and connect that way and only update one end.
  
  Imo this is the more comprehensive solution, because this also easily solves certificates (via ACME). The last leg (from HAProxy to backend) and be unencrypted or just use long-life self-signed certs if you really care…but I wouldn’t worry about certs on the inside of a homelab.
  
  original
- Luckyfriend222@lemmy.world ⁨7⁩ ⁨hours⁩ ago
  So much this. And if OP uses only OpnSense it can be done in there directly. Just so much easier than hairpin NAT and all the other stuff.
  
  original
- Onomatopoeia@lemmy.cafe ⁨6⁩ ⁨hours⁩ ago
  I can’t imagine not using a proper internal DNS with split anymore.
  
  I’m a big fan of Pihole (currently running it on a DietPi VM).
  
  Being able to manage DHCP and DNS in a single place makes for much better control than the crappy DHCP from consumer routers. And almost any real DNS/DHCP server combo is better than those things.
  
  Just rebuilt my PiHole over the last couple days, and it’s currently blocking 45% of DNS requests with no ill effects on any system - it’s a lot of Android app nonsense and a smart TV.
  
  I’ve lost the Samsung TV on the TV, but I never used it anyway, and the TV is so much more responsive now.
  
  Yea, smart TV… Bad news. It’s next on the list to get a Kodi box on it.
  
  original
InEnduringGrowStrong@sh.itjust.works ⁨7⁩ ⁨hours⁩ ago
All good answers so far.
Basically your internet gateway doesn’t support what’s called NAT hairpin, also called NAT loopback.

The DNS solution is better anyway, and that particular setup is called split-horizon DNS, which basically just means your internal DNS requests get different results than ones from outside your network.

original
- cyberpunk007@lemmy.ca ⁨3⁩ ⁨hours⁩ ago
  And to solve this problem, if you host your own internal DNS also you can just add entries there. Pihole is a nice cheap option and runs on a raspberry pi.
  
  original
  - cyberpunk007@lemmy.ca ⁨3⁩ ⁨hours⁩ ago
    Yup, sucks if you have more than one device though 💀
    
    original
  - abcdqfr@lemmy.world ⁨3⁩ ⁨hours⁩ ago
    You can also busy edit local records on the devices you intend to access the service from. Flakier, but requires no extra hardware/services
    
    original
GreatBlue@infosec.pub ⁨7⁩ ⁨hours⁩ ago
My guess for the ping is, that the domain resolves to the IP of your OPNsense-router, hence it’s not your server responding, but the router.

I haven’t set up port forwarding for OPNsense, but my guess would be it’s only working for connections from the wan interface or some local rebind protection. You could set up a DNS-override in the unbound settings for your domain and redirect to the internal IP-address, no need to set up an additional DNS-server.

original
- GreatBlue@infosec.pub ⁨7⁩ ⁨hours⁩ ago
  Just looked it up.
  
  Under Services > Unbound DNS > Overrides you can add an entry for your server as an DNS A record and be done with
  
  original
danielquinn@lemmy.ca ⁨7⁩ ⁨hours⁩ ago
Given that sort of description I’d bet that it is DNS actually. If you run a DNS lookup from your LAN for your domain, do you get the external IP or the internal one? You can try this with dig in Linux or host in Windows (I think).

If I’m right and you’re getting the external IP even when querying from your LAN, then what you need is either a separate DNS for your LAN or what they call a “split DNS” whe are a your domain server returns a different value depending on the originating IP.

You can check for this by editing your hosts file. If you add your domain and local IP there and then try to ping that domain on that machine, it should work. If you’ve got a small network, you might even just copy the hosts lines between machines (this is what I do for example).

original
hubertmanne@piefed.social@piefed.social ⁨7⁩ ⁨hours⁩ ago
I feel bad because I know I have encountered this a few times and can’t for the life of me remember the specific instances or how they were rectified.

original
illusionist@lemmy.zip ⁨6⁩ ⁨hours⁩ ago
I use a vpn. It sounds stupid but it works. I’m always away from home

original
Brkdncr@lemmy.world ⁨7⁩ ⁨hours⁩ ago
Another option is to use a proxy service like cloudfare. You end up with internet speed when accessing internal resources though, even if your client is internal.

original