0

I got a fairly simple setup which consists of 2 servers and couple of users.

server #1, int -> server in my home LAN where my application lives, in this case it's nextcloud (with nginx web server, accesible by HTTPS) and some other stuff. This one has no accessible external IP address no way to connect to it from outside of my network, except by...

server #2, ext -> server outside my LAN that has an ip addr accessible from the world. Both servers are 'linked' with each other using a wireguard connection over not that great link (which is crucial here, as I need to avoid data transfer through it as much as possible) I think it is also worth to mention that connections from my LAN are not routed through ext server. (Wireguard is NOT the default gateway)

In my home network I have a PiHole DNS service which has an override for cloud.myplace.com so that is points to my local network ip (cloud.myplace.com is also a normal domain name that I bought so it is possible to use it from outside my network, currently it is pointing to ext server)

To access the server from outside my LAN I planed to use nginx proxy that will only pass the data between user and my server. So when connected to LAN I got a direct https connection, and when I am on the internet, the connection should be proxied through external server, through a wg vpn, to my int server. The most important factor for me is how quickly my local apps are working in my local network, and that they work at all from WAN, without AND changes in clients applications (this transfer from LAN to WAN should be transparent for them)

But this is a place where I am a little bit confused... the whole plan of using a local DNS service to point to a local IP is little bit smelly for me, it feels like it should be possible to let nginx decide how to route the connections depending on where the connection is coming from.

Is creating own DNS entries a good idea? Is there a possibility that it will someday bite me? (IDK because some systems/apps overwrites DNS or don't trust some, some apps can cache the IP? or some similar situation) Or this is a perfectly healthy situation and I don't have to worry about anything?

If not, what is the correct way of routing to single instance in LAN? It would be perfect for example if I could cache some NC data on remote server in order to not have to send everything through VPN

Hope that this is "bread and butter" for most of you guys and the solution is obvious and simple I just don't know how to find it :) Br, Bartoszek

1 Answer 1

2

This is a valid solution.

There are a few reasons why you would want to override a public DNS with a local one.

1. The server is in house and accessible by a public IP, but not accessible internally by the public IP due to NAT hairpinning, but the server is accessible by the internal IP.

In this case, you setup a DNS entry locally such that the url remains the same everywhere, but it works both inside and outside of the place (for example, someone has a laptop and wants to access it both internally and externally.)

2. The server is in house but not accessible to the public.

In this case, you setup a local DNS to point to the internal IP address, and it doesn't matter whether there is a public DNS entry or not. In addition, a public DNS entry can be made to point to a webpage that would give a short and non-descriptive message to alert people that they are not able to access it unless they are internal. (to help troubleshoot for IT Staff)

3. There is a public route, but internal users should connect to a different server.

In this case, you setup the local DNS to point to a different server. For example, for a terminal server cluster, the external would point to the gateway server, but internally you may want to connect to a different cluster or management server instead.

Just keep in mind with troubleshooting to always ping the FQDN and see if it replies internally or externally to find out its problems. Eg. you expect the ip address to be internally, but ping reveals the external ip.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .