These kinds of split DNS routing issues are something I’ve struggled with for a while. From my experience, you have basically two options, and depending on your specific situation only one might be viable.
The first option, which may or may not be available to you, entirely relies on what your router can do. Bluntly, if you use the ISP provided router, you’re probably SOL, if not, you have a chance. Higher end (and/or enterprise class) routers and firewalls generally have sufficient features with a few exceptions. The feature you need to use is called hairpin NAT, though, it will pretty much never be called that in your NAT settings, so you’ll need to Google your router and the term “hairpin NAT” to figure out if it can be done and how to do it. To describe what it is, let’s start with basic port forwarding and adapt from there. I think most people know how port forwarding works: a connection to the external (or WAN) connection on a port is forwarded to an internal IP and port. Hairpin NAT is the same but from inside (the LAN port) basically if a connection from the LAN is destined for the WAN interface IP address, it will forward the connection to an internal (LAN) IP and port. This works alongside regular port forwarding, not instead of it.
If your router/firewall doesn’t support hairpin NAT, you’re going to be limited to plan B, DNS.
With bifurcated DNS, you’re going to have some frustrations if anything changes, so like with all of your port forwards, you’ll want to lock down the IP of your target system. With port forwards, it’s bothersome to update, but not unreasonable. With DNS, it’s really not fun. It’s just that much more inconvenient, since you now need to update port forwards for external connections you need to update DNS too. Not great.
So how do you do this? It’s actually not super hard. As far as I know, you can use pihole (which does not require a raspberry Pi, by the way), or any other DNS server system that tickles your fancy. I use bind, but the actual DNS software isn’t super important, it just needs to support forwarders, and custom entries in the config, which I believe both do. Pihole or similar options can do DNS based ad blocking, I’m not a fan of that, but do what you want.
So the next step is to set up DNS internally. Get your DNS software of choice, and either buy a raspberry Pi to run it (bind is also compatible with the pi), or run virtual machines, or stand up an old PC for it. Install whatever os you feel comfortable running the software on, I always use Linux, but as long as your chosen software runs on the OS, it doesn’t matter much. Give the system a static IP and install everything.
Once setup, if you own a domain, you can set an A-record for your service (in your case jellyfin), say “media.domain.com” pointing to your server for that service internally. Update your global DNS to point media.domain.com to your WAN IP.
For me, I use bind on a raspberry Pi. To make management easier, I also installed webmin, which allows management of the bind configuration on a web interface.
For bonus points, do it all over again and build a second one.
And don’t forget to set up forwarders on your internal DNS so they can resolve internet addresses. Pro tip, use the DNS benchmark tool from GRC.com to find the fastest DNS servers for you.
If you want to go crazy, like me, build a third DNS server for all your internal lab stuff on a different domain, like “homelab.local” (it can be anything), and create a stub zone for it on your primary DNS that points to the lab DNS. That way, any “homelab.local” names, like, media.homelab.local or something, can be setup once on your dedicated homelab DNS server, and the other two will simply point to it via the stub zone.
I always recommend finding fast DNS servers to use internally, and I always recommend that if you’re using internal DNS, you have at least two of them.
Last, but not least, after all of that effort, confirm that your fancy new DNS works (good luck with any troubleshooting you might need to do), and update DHCP to point clients at the internal systems for DNS resolving.
I use a Mikrotik router, so it probably does. I’ll have to check it out. I assume it can do SNI-based routing just like haproxy, but if not, I’ll have to move haproxy to my LAN and just do a TCP tunnel in my VPS.
But yeah, doing this and internal DNS should make for a more robust system, thanks for the breakdown.
I work with this stuff professionally. I personally enjoy mikrotik. Not sure how to hairpin NAT on it off the top of my head, though I’m sure it can be done.
I usually use a business firewall as my gateway. Nothing wrong with mikrotik at all, it’s all personal preference. I think this is the first time I’ve heard of someone using a tik in the wild who isn’t running an ISP.
Yup, I was looking for an inexpensive, enterprise grade router, and 5 port Mikrotik was just the right size and price. I like playing with networking stuff.
The next project is getting a WiFi network with a VPN configured at the router level, as well as a WiFi network with no access to the rest of the network. I use a Ubiquiti AP, so it should be feasible.
I used to manage the network at my last job, a startup, but I’m not in IT, I’m a software engineer who gets into a lot of adjacent stuff.
That sounds familiar. My official job is more system administration, but networking is my one true love… At least in terms of work and interests.
Ubiquiti makes pretty good wifi gear. If I’m not mistaken you’ll need a controller running 24/7 to ensure that roaming and stuff works, but IMO, that should always be the case. When I’m doubt, there’s always the cloud key.
Ubiquiti wireless supports VLANs, so you should be good there, if it’s just going to be another SSID on your WiFi. I help run an ubiquiti network at home, we have two main LANs. My network is comprised mainly of Cisco stuff, but I’m using a sonicwall for my gateway, the other network here is entirely ubiquiti, UDM Pro, unifi PoE switches, unifi access points (about 4 right now, mostly for speed/density, though that network only has about 30 devices on it at any given time). The UDM acts as the network controller/manager. I don’t love it because the routing is not where I’d like it to be (in terms of features and capability). Prime example is that I’ve been pushing into L3 switching and for that net we got an enterprise 48 PoE, which can do 2.5G with PoE+ on all ports, and has a slew of additional features including L3 switching. On my side I have a Cisco catalyst 4948, which is connected to the enterprise 48 on a 10G link, I wanted to use the 10G link for device to device routing. On the Cisco, everything worked like clockwork. On the ubiquiti side, you can define routes, but they’re only added to the controller, which only adds them to the gateway. So traffic from my net to the ubiquiti net goes from station to switch to switch to station, and return traffic from the ubiquiti side goes from station to switch to the UDM, then to my switch, to the target station.
You can manually add the routes to the enterprise 48 by cli/SSH, but as soon as the unit restarts, the config is replaced with the current config on the controller (which doesn’t include the routing information).
I did it this way because my homelab, which everyone uses in some way or another, is hanging off my 4948 on a VLAN with L3 switching. I want to avoid the overhead of having it go through the extra devices and the bandwidth limits of going straight from my gateway to the ubiquiti gateway, and the enterprise 48 just won’t do it. On the control panel there’s no way to set what routes should be installed on which devices, so you’re kind of up a creek without a paddle.
I like ubiquiti, but for anything more advanced than all VLANs being handled by the gateway directly, I wouldn’t recommend it. Since most home users only need VLANs to go to the gateway at most, it’s my go to recommendation for home users. It’s inexpensive (relatively speaking) and it’s fairly easy to manage, all while being quite good at what most users need.
If I were to do it again, I’d skip the enterprise 48. It was much more expensive than the “pro” line, which would have been adequate (no 2.5G on the pro), or even the basic 48 PoE, which only has layer 2 (VLANs). I specifically bought the enterprise so it could do this and simply put, it doesn’t. I can force it to work, but I have to do the routes every time the unit restarts. It’s a huge pain.
If you’re only going to use ubiquiti for wifi though, have at it. It’s quite good. A bit basic IMO, but I’m used to Cisco aeronet, which is above most people’s heads with the options you can set. Ubiquiti is a good balance.
Yeah, I’m planning on three VLANs, each based on a WiFi SSID, but also with Ethernet plugs as well:
IOT - no access to anything outside the VLAN
VPN - my state has stupid laws, so this will just VPN to the next state over
Everything else - guests, etc
My home lab/NAS (same box for now) would be on 1 & 3, personal devices on 2. Then everything is assigned a VLAN based on SSID or physical network port. I’ve considered a fourth as a guest network (so internet only, no other devices), but that’s not common enough yet to worry about.
And yeah, the Ubiquiti controller software is annoying, and there’s no way I’m signing up for their cloud nonsense. But it works.
Sounds like a solid plan. If you want to discuss any particulars, I’m happy to discuss more, however, since it seems like you have a good grasp on what you’re after, I don’t really have a lot to add here.
These kinds of split DNS routing issues are something I’ve struggled with for a while. From my experience, you have basically two options, and depending on your specific situation only one might be viable.
The first option, which may or may not be available to you, entirely relies on what your router can do. Bluntly, if you use the ISP provided router, you’re probably SOL, if not, you have a chance. Higher end (and/or enterprise class) routers and firewalls generally have sufficient features with a few exceptions. The feature you need to use is called hairpin NAT, though, it will pretty much never be called that in your NAT settings, so you’ll need to Google your router and the term “hairpin NAT” to figure out if it can be done and how to do it. To describe what it is, let’s start with basic port forwarding and adapt from there. I think most people know how port forwarding works: a connection to the external (or WAN) connection on a port is forwarded to an internal IP and port. Hairpin NAT is the same but from inside (the LAN port) basically if a connection from the LAN is destined for the WAN interface IP address, it will forward the connection to an internal (LAN) IP and port. This works alongside regular port forwarding, not instead of it.
If your router/firewall doesn’t support hairpin NAT, you’re going to be limited to plan B, DNS.
With bifurcated DNS, you’re going to have some frustrations if anything changes, so like with all of your port forwards, you’ll want to lock down the IP of your target system. With port forwards, it’s bothersome to update, but not unreasonable. With DNS, it’s really not fun. It’s just that much more inconvenient, since you now need to update port forwards for external connections you need to update DNS too. Not great.
So how do you do this? It’s actually not super hard. As far as I know, you can use pihole (which does not require a raspberry Pi, by the way), or any other DNS server system that tickles your fancy. I use bind, but the actual DNS software isn’t super important, it just needs to support forwarders, and custom entries in the config, which I believe both do. Pihole or similar options can do DNS based ad blocking, I’m not a fan of that, but do what you want.
So the next step is to set up DNS internally. Get your DNS software of choice, and either buy a raspberry Pi to run it (bind is also compatible with the pi), or run virtual machines, or stand up an old PC for it. Install whatever os you feel comfortable running the software on, I always use Linux, but as long as your chosen software runs on the OS, it doesn’t matter much. Give the system a static IP and install everything.
Once setup, if you own a domain, you can set an A-record for your service (in your case jellyfin), say “media.domain.com” pointing to your server for that service internally. Update your global DNS to point media.domain.com to your WAN IP.
For me, I use bind on a raspberry Pi. To make management easier, I also installed webmin, which allows management of the bind configuration on a web interface.
For bonus points, do it all over again and build a second one.
And don’t forget to set up forwarders on your internal DNS so they can resolve internet addresses. Pro tip, use the DNS benchmark tool from GRC.com to find the fastest DNS servers for you.
If you want to go crazy, like me, build a third DNS server for all your internal lab stuff on a different domain, like “homelab.local” (it can be anything), and create a stub zone for it on your primary DNS that points to the lab DNS. That way, any “homelab.local” names, like, media.homelab.local or something, can be setup once on your dedicated homelab DNS server, and the other two will simply point to it via the stub zone.
I always recommend finding fast DNS servers to use internally, and I always recommend that if you’re using internal DNS, you have at least two of them.
Last, but not least, after all of that effort, confirm that your fancy new DNS works (good luck with any troubleshooting you might need to do), and update DHCP to point clients at the internal systems for DNS resolving.
Easy, simple, barely an inconvenience, right?
I use a Mikrotik router, so it probably does. I’ll have to check it out. I assume it can do SNI-based routing just like haproxy, but if not, I’ll have to move haproxy to my LAN and just do a TCP tunnel in my VPS.
But yeah, doing this and internal DNS should make for a more robust system, thanks for the breakdown.
I work with this stuff professionally. I personally enjoy mikrotik. Not sure how to hairpin NAT on it off the top of my head, though I’m sure it can be done.
I usually use a business firewall as my gateway. Nothing wrong with mikrotik at all, it’s all personal preference. I think this is the first time I’ve heard of someone using a tik in the wild who isn’t running an ISP.
Yup, I was looking for an inexpensive, enterprise grade router, and 5 port Mikrotik was just the right size and price. I like playing with networking stuff.
The next project is getting a WiFi network with a VPN configured at the router level, as well as a WiFi network with no access to the rest of the network. I use a Ubiquiti AP, so it should be feasible.
I used to manage the network at my last job, a startup, but I’m not in IT, I’m a software engineer who gets into a lot of adjacent stuff.
That sounds familiar. My official job is more system administration, but networking is my one true love… At least in terms of work and interests.
Ubiquiti makes pretty good wifi gear. If I’m not mistaken you’ll need a controller running 24/7 to ensure that roaming and stuff works, but IMO, that should always be the case. When I’m doubt, there’s always the cloud key.
Ubiquiti wireless supports VLANs, so you should be good there, if it’s just going to be another SSID on your WiFi. I help run an ubiquiti network at home, we have two main LANs. My network is comprised mainly of Cisco stuff, but I’m using a sonicwall for my gateway, the other network here is entirely ubiquiti, UDM Pro, unifi PoE switches, unifi access points (about 4 right now, mostly for speed/density, though that network only has about 30 devices on it at any given time). The UDM acts as the network controller/manager. I don’t love it because the routing is not where I’d like it to be (in terms of features and capability). Prime example is that I’ve been pushing into L3 switching and for that net we got an enterprise 48 PoE, which can do 2.5G with PoE+ on all ports, and has a slew of additional features including L3 switching. On my side I have a Cisco catalyst 4948, which is connected to the enterprise 48 on a 10G link, I wanted to use the 10G link for device to device routing. On the Cisco, everything worked like clockwork. On the ubiquiti side, you can define routes, but they’re only added to the controller, which only adds them to the gateway. So traffic from my net to the ubiquiti net goes from station to switch to switch to station, and return traffic from the ubiquiti side goes from station to switch to the UDM, then to my switch, to the target station. You can manually add the routes to the enterprise 48 by cli/SSH, but as soon as the unit restarts, the config is replaced with the current config on the controller (which doesn’t include the routing information).
I did it this way because my homelab, which everyone uses in some way or another, is hanging off my 4948 on a VLAN with L3 switching. I want to avoid the overhead of having it go through the extra devices and the bandwidth limits of going straight from my gateway to the ubiquiti gateway, and the enterprise 48 just won’t do it. On the control panel there’s no way to set what routes should be installed on which devices, so you’re kind of up a creek without a paddle.
I like ubiquiti, but for anything more advanced than all VLANs being handled by the gateway directly, I wouldn’t recommend it. Since most home users only need VLANs to go to the gateway at most, it’s my go to recommendation for home users. It’s inexpensive (relatively speaking) and it’s fairly easy to manage, all while being quite good at what most users need.
If I were to do it again, I’d skip the enterprise 48. It was much more expensive than the “pro” line, which would have been adequate (no 2.5G on the pro), or even the basic 48 PoE, which only has layer 2 (VLANs). I specifically bought the enterprise so it could do this and simply put, it doesn’t. I can force it to work, but I have to do the routes every time the unit restarts. It’s a huge pain.
If you’re only going to use ubiquiti for wifi though, have at it. It’s quite good. A bit basic IMO, but I’m used to Cisco aeronet, which is above most people’s heads with the options you can set. Ubiquiti is a good balance.
Yeah, I’m planning on three VLANs, each based on a WiFi SSID, but also with Ethernet plugs as well:
My home lab/NAS (same box for now) would be on 1 & 3, personal devices on 2. Then everything is assigned a VLAN based on SSID or physical network port. I’ve considered a fourth as a guest network (so internet only, no other devices), but that’s not common enough yet to worry about.
And yeah, the Ubiquiti controller software is annoying, and there’s no way I’m signing up for their cloud nonsense. But it works.
Sounds like a solid plan. If you want to discuss any particulars, I’m happy to discuss more, however, since it seems like you have a good grasp on what you’re after, I don’t really have a lot to add here.
So with that, I’ll bid you a good day.
Good luck, and I wish all the best for you.
Just hearing that someone who does this professionally thinks it’s reasonable is good enough. :)
Thanks for the discussion and the wealth of information you shared.