Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What domain name to use for your home network

ctrl.blog

Post reply on HN
Print view View original

121–130 of 174 posts

Re: What domain name to use for your home network

#121

Post by Annatar »

"Do not use undelegated domain names like .lan, .home, .homenet, .network, nor should you make up your own domain name."

But it doesn't explain why, and what the mechanism behind that statement is. I configured my internal DNS servers on my home network to be root top level domain servers for a made-up .tld. Why wouldn't that work? Don't know, because the author does not explain the mechanism in detail.

As far as I can see for the past 15 years, having configured the internal DNS servers to be root top level domain name servers works like a charm, with no observed ill- or side-effects.

Re: What domain name to use for your home network

#122

Post by mattowen_uk »

d2wa wrote: post #55
ASalazarMX wrote: post #53

Earlier quoted context omitted.

Mixing LAN and Internet scopes makes me uneasy. In my LANs the local domain is .local, because .local is one of the reserved top domain names, and it shouldn't be resolvable outside the LAN. https://tools.ietf.org/id/draft-chapin-rfc2606bis-00.html#rf...

Read the article. Don’t use .local (except for mDNS.)

> Don’t use .local (except for mDNS.)

Going forward, I agree. However for many years, the recommendation from large providers (including Microsoft) WAS to use .local

I've got .local as my internal network. For some people, it's not a trivial job to re-domain everything.

Re: What domain name to use for your home network

#123

Post by tedk-42 »

charles_f wrote: post #99
jeroenhd wrote: post #44

Honestly, just spend the five bucks a year and reserve a real domain name with auto renew. You don't need to make it publicly resolvable, but you'll be 100% sure all of your internal service names won't ever conflict with anything used in the real world. If you pick the right registrar, you can easily get your hands on a wildcard DNS cert as well through Let's Encrypt, so you can protect your internal services with H…

This would still forward your unresolved to public DNS, exposing your internal infra, which as I understand it is one of the things this article is looking at preventing

'exposing your internal infra'

I've worked in gov places where they care about this detail. It's quite a sad 'security by hiding' mentality.

Oh no someone knows my current IP is 192.168.0.100

Re: What domain name to use for your home network

#124

Post by jannes »

tedk-42 wrote: post #123
charles_f wrote: post #99

Earlier quoted context omitted.

This would still forward your unresolved to public DNS, exposing your internal infra, which as I understand it is one of the things this article is looking at preventing

'exposing your internal infra' I've worked in gov places where they care about this detail. It's quite a sad 'security by hiding' mentality. Oh no someone knows my current IP is 192.168.0.100

It is part of a bigger strategy called 'security in depth'. At least that is how I understand it.

Re: What domain name to use for your home network

#125

Post by jannes »

livinginfear wrote: post #78

What method are people using to configure this oin their own network? The router supplied by my ISP doesn't support using a custom DNS server like a pihole, unfortunately. I don't consider using /etc/hosts a longterm worthwhile solution. I'd love to find another useful way of setting this up.

Does your router support disabling DHCP? You can just run your own DHCP server in that case.

Re: What domain name to use for your home network

#127

Post by k4rli »

minimaul wrote: post #35
minimaul wrote: post #21

Earlier quoted context omitted.

For what it's worth, this does work. For now. The main issue is if it gets sold later, or assigned by RFC. As an example, more than one company I've worked for used .dev as a TLD for their dev environments, with local DNS to override it. Once google bought .dev, this meant that: - we couldn't access anything Google put on .dev - suddenly, all of our test sites had HTTPS forced, because .dev was HSTS preloaded by Goog…

And as an extra point - can you actually guarantee that all your DNS lookups hit your DNS server first? That's harder than it sounds, with more and more apps implementing their own DNS over HTTPS clients - Firefox does it for instance, so does Chrome.

How come DNS requests initiated from Chrome/FF still reach my pi-hole and get blocked just fine? I would think this browsers' solution would have prevented that.

Re: What domain name to use for your home network

#128

Post by pbhjpbhj »

thundermuffin wrote: post #34
inetknght wrote: post #31

Earlier quoted context omitted.

I hope you never forget to renew that registration...

I agree! It always boggles my mind how people and companies can forget to renew their domain names when you receive so many email reminders now a days.

My card expired, plenty of renewal reminders but I knew it was on auto-renew so ignored them as usual. Domain stopped resolving. Thankfully nowadays you can recover, in the past it meant you'd lost the domain for good.

This is one of those situations where too many warnings just causes users to ignore things. The only warning I needed - your card expired - was either missing or hidden in the morass of "ordinary" warnings.

It happens.

Re: What domain name to use for your home network

#129

Post by willis936 »

mattowen_uk wrote: post #122
d2wa wrote: post #55

Earlier quoted context omitted.

Read the article. Don’t use .local (except for mDNS.)

> Don’t use .local (except for mDNS.) Going forward, I agree. However for many years, the recommendation from large providers (including Microsoft) WAS to use .local I've got .local as my internal network. For some people, it's not a trivial job to re-domain everything.

If your L2 DNS (hostnames, typically auto-generated) doesn't match your L3 DNS (handpicked) you're going to eventually have a Bad Time.

Re: What domain name to use for your home network

#130

Post by willis936 »

minimaul wrote: post #35
minimaul wrote: post #21

Earlier quoted context omitted.

For what it's worth, this does work. For now. The main issue is if it gets sold later, or assigned by RFC. As an example, more than one company I've worked for used .dev as a TLD for their dev environments, with local DNS to override it. Once google bought .dev, this meant that: - we couldn't access anything Google put on .dev - suddenly, all of our test sites had HTTPS forced, because .dev was HSTS preloaded by Goog…

And as an extra point - can you actually guarantee that all your DNS lookups hit your DNS server first? That's harder than it sounds, with more and more apps implementing their own DNS over HTTPS clients - Firefox does it for instance, so does Chrome.

If you run your own router: yes up to a certain point.

https://www.myhelpfulguides.com/2018/07/30/redirect-hard-cod...

Afaik nobody has a fix for the client hostility that DoH brings to the table.

Post reply on HN