you NEED to setup Split DNS for your Home Server!

There is something that I should have set up a very long time ago. Something that would have improved the performance of my home lab services and would have made the publicly accessible services just so much easier to access and maintain. And that is split DNS because it's always DNS. When you set up domains, they have records. You could set an A record and point a domain to a specific IP address. For anything I want to give external access to, I use Netbird's reverse proxy. And it is an amazing product. I'm biased. But a problem with it is if I want to use let's say my public domain internally whenever I do anything let's say with Nexcloud opencloud something like that if I drag and drop a file into my drive it will first upload through the proxy and back down to the home lab doing a huge jump that it doesn't need to do. And for somebody like me who has absolute garbage internet in my location, it's something that I really don't want to do. Split DNS lets the same host name resolve at two completely different addresses depending on which DNS resolver answers. If you've watched this channel, we've set up a couple DNS servers. Now, primary reason for setting these up, whether it be Pi Hole, Adguard, and so on, is for the ad blocking capabilities. But for me, it basically stopped there and giving things some pretty internal domain names. Essentially, if I'm on my local network using my local DNS server, I can

have it resolve to my local proxy, giving me direct access to my home lab. But if I'm away, it will use the public DNS resolver and actually resolve to my Netbird proxy. So, in this video, what we're going to be doing is setting this up. It's a pretty straightforward process. But before we get too far, I do want to thank Sendio for sponsoring today's video, primarily taking a look at Thin Link. A lot of you have probably heard of Tiger VNC or no VNC at some point. What you may not know is Sendio is actually maintainer of both of those projects and it's those open source projects that are the base of Thin Link. Thin link is a Linux desktop server. So it's a VDI or terminal server for real Linux desktops. Also with Thin Link multi-users, this can scale to hundreds or thousands of users. You can connect with their client or straight from a browser since there's a web client built into NVNC. It's easy to install which makes it a great fit for a home lab and it's free up to 10 concurrent users. And this is the exact same software as the paid version. On the other end, it does scale with enterprise with installs running more than 5,000 Linux desktops.

The latest release even added open ID connect for the web client so you can log in with something like keycloak. And if you want to learn more, I'll have a link down below. So again, the installation process is very simple. You walk through a couple steps and you are installed. I'm personally using it to access my Linux mint machine on Proxmox. Give it a try and start using Thin Link today. Now, for this setup, there's going to be three situations. When I am on my home network and I'm not connected to Netird at all, it will be able to resolve my local DNS server, which will point to its own a record. Scenario two is I will be away but connected with Netbird. In that case, Netbird's DNS will actually forward me to the proper local proxy and I will be able to access the service with a actual peer-to-peer connection. So, I don't have to do that extra hop even while I'm away. And then scenario three, public DNS, no NetBird, no local network. You're still going to be able to access these external services, but I will use some path-based authentication features within Netbird to lock down the login screen, for example. So, just a quick look at my setup. I am going to be running OpenCloud at this address. I technically already am. This is my backend here. I am using engineext proxy manager as my local proxy. This will work for other proxies whether if you're using uh caddy traffic even bunker web something like that. It's essentially the same process.

We will be using DNS01 certificates to be able to accomplish this. So whoever your registar is such as Cloudflare needs to be able to support this. And this is nice because you won't need to forward ports to engineer proxy manager to get this certificate. And it will keep the credentials valid. Essentially, we're going to have two different certificates. One for the public facing proxy and one for the internal proxy. If you've never set up EngineX proxy manager, I have a whole guide on how to do that and how to do like the local top level domain stuff. But if you go ahead and do that actual guide, you'll have everything that you need. This OpenCloud instance is right here. OpenCloud.hopkins.sh. Right now I have no authentication on it at all but that we'll go ahead and change that later. Essentially since I have a netird pier on my network I am able just to set this as a network resource. You can see OpenCloud is right here at this local address and this right here is the OpenCloud port. So I set that as the target. Give it my domain and it will automatically generate those certificates. And you can see if I go over here to network routing networks, jump into my home network, you can see OpenCloud right here is added as a individual resource. I could install NetBird directly on OpenCloud. I could put it in the actual Docker compose stack and create a Docker network that way. For example, here docker. This is like an internal Docker network range, but I'm able to expose and access services that way. But once you have this set up, your domain will be publicly accessible. But we still have the problem. and we have no split DNS

setup. And that is where our local proxy comes in. Uh before anything, you're going to want to go ahead and get the certificate. So, you're going to come over to certificates. You can see I already have certificates for my two domains, but what you're going to want to do is add certificate and you're going to want to do let's encrypt via DNS. And then right here, you're going to want to put your domain. For example, I could do a wildcard such as star whatever your domain is. Let's do fleetfold. That's a domain I have. And then you could also add the root domain. So fleet fold if you want to manage both here. So you'd add the domains and then you'd go to your DNS provider. Now uh EngineX proxy manager here supports a whole heck of a lot. I just have my domains on Cloudflare at the moment. If you do use Cloudflare in your dashboard, you just click on your little profile here. You go over to profile here. You go to API tokens and then it's right here. You'd want to create a token. This would be a edit zone DNS. So, we'd use that template. You could give it a good name for the actual zone. You'd want to specify the actual domain there. And then from there, you could continue to summary and then create the token. Then all you do is grab this token, go over to the proxy manager, and drop this on in. So, if this does expire and you don't rotate the actual API token, you may lose your certificate, at least temporarily. And you can see there is a warning. This is plain text in a database file. So there are some minor security concerns. And then what you do

is you just go and you add the domain like you normally would. So you'd add a proxy host. Type in the domain that you want to add. Pop in the host name and the port for open for for OpenCloud specifically. If it's something you're setting up, you'd want to go ahead and enable websocket support as you would with probably most things now. And then you'd go to SSL s select the actual proxy that you added. Usually, these first two options are needed for most things. And for uh OpenCloud specifically and many other things that involve like file transfers, you're going to want to add some custom engineext variables, which are right here. If this is the particular service that you're setting up now, from here, having two separate proxies, even if they both have certificates and all that, isn't going to do much because our local resolver isn't set up and pointing at our local reverse proxy. For my DNS, I've been trying out and experimenting with Technidium. And at least in this platform, all you would do is head over here to zones. You can see I've created a new zone with opencloud.hopkins.sh.

All you do is add zone. Pump that in there. Close it out or save it. And then if I open this up, you can see I have an A record that points directly to the internal IP address for my local proxy. I have my DNS server for my actual router pointing to this instance right here. And then this will tell my computer or whatever I'm trying to connect to where the actual proxy for this domain is. And if I bring in a terminal here, we can actually look at this in action. If I run the dig command and point it to this domain, opencloud.opkins.sh. And you can see here it's pointing at my local proxy. And that's because I'm connected to a local network. Now, if I do the same thing from an external tool, type in the domain, look up the DNS, we can see it's using a CNAME here, pointing at netbird.hopkins.sh. So, if I dropped that in, you could see it's running on a HNER VPS. If you go over to the guide on tech.tv, there's a bunch of different examples on if you're running Pihole, Adguard, and so on. Some services might not really like the IP switching thing too much, especially if they have their own like bakedin authentication server similar to OpenCloud. So, there are ways to get around it, such as adding your actual proxy and the port to an allow list rule, which if you run into that, you will be able to see how to do it here.

Now, for external connections, if I still want to use my local DNS server, you can use the Netbird internal DNS. Now, I'm very biased towards Netbird. You could still use like Tail Scale. I think Twate might have this functionality, but I'm not sure. Essentially, what you'd want to do is head over here to DNS, go down to name servers. You can see I already have this one enabled here, but basically you just go to add name server custom DNS. You'd put in the info here with the distribution groups or the devices that you want to use this as their DNS server when connected to Netbird. I could go ahead and enable this if I'd like to. If I click on it, I could go in here and add match domains. So if I added a domain, I would just do opencloud.hopkins.sh. And then from there, I would save those changes. Now we have that match domain. So when that domain is entered, it will know that it wants to pull the records from this specific DNS server, no matter where I'm at in the world, and it will connect with the routing pier or the uh direct pier installed on the machine, however you have it set up. Now, for my actual OpenCloud instance here, what I want to do is actually block signins for external users. The only people that should ever need to sign into my instance either have access to the network or are in my actual home network. That's actually pretty simple.

What we'd want to do is head over here to our reverse proxy services and go to our OpenCloud one. What I could do in here is actually add a new target and I'm going to point it to the same resource that I have for OpenCloud. I would add the proper port. So this is 9200. But for this I would go under optional settings and for access I would simply block access to this. So then if I add that target we can see we have two targets. One at root which allows and then one at signin which will block access. So if I save those changes and I can just test this real quick. I'm going to go to my phone here. I am on a public network. Netbird is disconnected. And if I go to that domain, hit enter. You can see I'm getting forbidden. But if I go ahead and connect to NetBird, you can see I logged in there. We're connecting. And then let's refresh this page. You can see I now have access and that is of course still on a public network there. Now, the reason I really like this is if I go back, let's uh disconnect from NetBird here. If I give this a refresh, you can see it's going to be forbidden.

If I actually log in here and share something such as this right here, I got an aircraft bill of sale. Am I ever going to use this document? Probably not. But if I right click on it, I share it, I go ahead and add a public link, copy that link, you can see the link is in fact not at signin. So I got the link on my phone here. Again, if I refresh, signin is blocked. But if I drop in this domain here, you could see it works. Beautiful. And that is just one way to one get the best performance out of some of your self-hosted services and two lock down access to those services while still making certain aspects of the actual application publicly available. So with that, I do hope that this video has helped you out in some sort of way. I hope you have a beautiful day. Do check out that first link down below. That link is a great service and they are goated in some of the contributions that they do to open source. again. Have a beautiful day and goodbye.