How to Use Local IP for Services when at Home?
from mrh@mander.xyz to selfhosted@lemmy.world on 09 Feb 13:46
https://mander.xyz/post/47170056

So I have some services and wireguard running locally on a “home” network. I also have wireguard, a DNS resolver, and a reverse proxy set up on a remote server. Since I don’t want to expose the home IP to the public, to access my services I connect to the VPN on the remote, which then forwards my request home. But this means that when I’m at home, connecting to my local services requires going out to the remote. Is there some way to have the traffic go over the switch when at home, but go over wireguard when away, without having to manually switch the VPN on/off?

I could move the DNS resolver (which handles the internal names for the services) from the remote to the home server. But then similarly every DNS request will need to go through both the remote and home servers, doubling the hops. I’d like to use my own DNS server at all times though, both at and away from home. Which tradeoff seems better?

edit: thanks for all the suggestions, I’ll look into some of these solutions and see what works best

#selfhosted

threaded - newest

slazer2au@lemmy.world on 09 Feb 13:57 next collapse

Adguard home has a DNS rewrite function that you can use to rewrite local DNS queries.

I use it to rewrite my queries at home to point to the LAN IP. When I am out I get my public IP from normal resolvers.

mrh@mander.xyz on 09 Feb 14:19 collapse

So you have a public DNS record pointing to your home IP?

Shimitar@downonthestreet.eu on 09 Feb 14:12 next collapse

Going the split DNS way is doable but had other issues (android devices bypassing local DNS for example or DNS over HTTPS issues)

I set up my opnSense to redorect all internal traffic to the external IP on port 443 to my internal server ip.

Works fine, it’s transparent, and doesn’t mess with DNS.

mrh@mander.xyz on 09 Feb 14:23 collapse

And so when away do you just directly connect to the external IP and do port forwarding?

ppb1701@ppb.social on 09 Feb 13:55 next collapse

@mrh
I did similar thing for my selfhosted vaulwarden with tailscale and their funnel. give the client apps my tailscale address and i can hit on lan or off as long as the device is in the tailnet....and well the server is up 😎

mrh@mander.xyz on 09 Feb 14:18 collapse

I think tailscale would work, though I’d ideally want to use something like headscale instead, but that’s a bit of a logistical hastle for my setup. Do you know if pangolin can handle this as well?

Decronym@lemmy.decronym.xyz on 09 Feb 14:20 next collapse

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters
DNS Domain Name Service/System
HTTP Hypertext Transfer Protocol, the Web
HTTPS HTTP over SSL
IP Internet Protocol
SSD Solid State Drive mass storage
SSL Secure Sockets Layer, for transparent encryption
VPN Virtual Private Network

5 acronyms in this thread; the most compressed thread commented on today has 15 acronyms.

[Thread #78 for this comm, first seen 9th Feb 2026, 22:20] [FAQ] [Full list] [Contact] [Source code]

tophneal@sh.itjust.works on 09 Feb 14:37 next collapse

I ran into a similar issue when visiting some family. Even though I was connected to home via VPN, my devices wouldn’t pull servers by their IPs. Our networks were setup too similarly. I was able to fix it by editing my conf for the WG connection and added my static servers as allowed IPs. While still having to self host a server for accounting at work, we did a similar split setup so they would be able to use RDP to their desktops but all other traffic was ignored and handled locally. This forum post has pretty good, short explanation with some example config scenarios forum.mikrotik.com/t/…/156426

FreedomAdvocate@lemmy.net.au on 09 Feb 14:43 collapse

Tailscale.