Comment by jchw | Hacker News Reader

Comment by jchw | Hacker News Reader

No actual comments about the software, but related to its goals I have been trying to figure out how to best handle a split horizon home lab type setup. I’m halfway in on using Tailscale and halfway in on using DNS.

Makes me sorta wonder if it would be a good idea to try to split the horizon 3 ways, by responding to DNS requests differently based on whether the DNS server is contacted via a local IP, a tailscale CG NAT IP, or another IP from the internet. I guess that implies your system DNS server would go over Tailscale in the happy case—maybe not a great idea?—but it would be useful in some situations, like ensuring my local Jellyfin server is efficient when used by even other people’s devices when they are on my WiFi network, but still allowing me to tunnel to everything in a uniform way, not needing to go through the gate that clients from the internet must.

I wonder… does anyone have thoughts on that?

BIND out of the box supports split horizon DNS as many ways as you want, I do 3 way split horizon with BIND.

I've never tried pairing it with Tailscale(I don't use it), but I pair it with Consul.

The config and docs aren't the prettiest, but it works fine. Most DNS software can't handle this use-case well.

What condition do you use for determine split horizon? Client IP?

I suppose this is something you could do if you are in a local network and configuring all clients to use the DNS directly. In any other scenario, this will fail.

Right, for internal networks, we use source IP(well network, but same diff).

For instance, we might have diff. source networks based on their department or building or whatever. We can then give them DNS information based on where they are coming from. It's not foolproof obviously, even if we control the internal network, it doesn't mean a bad actor isn't around wreaking havoc, so it's defence in depth, not the sole line of defence.

But it allows us to control DNS from 1 spot, and give this group of servers names for themselves, and that group of servers and this group of clients access to this group of servers, etc.

Using pivpn with Wireguard instead of Tailscale and pihole. With on-demand split VPN on the phone with DNS pointed to pihole it resolve the remote IP set in /etc/pivpn/hosts.wireguard while on VPN otherwise just the local IP while on the home network.

Reply on news.ycombinator.com