51–60 of 174 posts
This is a complete tangent, but does anyone else really hate white text on black background? After reading only a few lines my eyes hurt and I have ghosting where the lines were when I look away. Websites like this one are basically unusable for me
I just use a real domain name, so I can easily obtain LE certs. Only the internal DNS server will actually return internal addresses.
A real domain name is the way to go. The convenience of using LE wildcard certificates is huge. However, running split-horizon DNS is not straightforward, at least in a home setting. I don't see a huge problem with putting a couple of internal addresses in external DNS servers. lexicon cloudflare --auth-token $(gopass cloudflare) create my-real-domain.xyz A --name my-rpi --content 192.168.1.201
I 100% agree that the whole reason for this setup is my LE cert. For whatever reason, some of my internal services with self-signed certs are not usable with Chrome, and some are. I don't know what pushes Chrome over the edge so it won't let you override. So I set up an internal reverse proxy with nginx to front-end all my internal services, then I only have to worry about keeping the LE cert installed in one spot.
Honestly, just spend the five bucks a year and reserve a real domain name with auto renew. You don't need to make it publicly resolvable, but you'll be 100% sure all of your internal service names won't ever conflict with anything used in the real world. If you pick the right registrar, you can easily get your hands on a wildcard DNS cert as well through Let's Encrypt, so you can protect your internal services with H…
https://tools.ietf.org/id/draft-chapin-rfc2606bis-00.html#rf...
Honestly, just spend the five bucks a year and reserve a real domain name with auto renew. You don't need to make it publicly resolvable, but you'll be 100% sure all of your internal service names won't ever conflict with anything used in the real world. If you pick the right registrar, you can easily get your hands on a wildcard DNS cert as well through Let's Encrypt, so you can protect your internal services with H…
Mixing LAN and Internet scopes makes me uneasy. In my LANs the local domain is .local, because .local is one of the reserved top domain names, and it shouldn't be resolvable outside the LAN. https://tools.ietf.org/id/draft-chapin-rfc2606bis-00.html#rf...
What's wrong with .localdomain? Or is that for something else??
Some Linux distributions erroneously resolve it to 127.0.0.1, but there’s no RFC or consensus around this TLD.
> Do not use undelegated domain names like .lan, .home, .homenet, .network, nor should you make up your own domain name. ...why? My DNS server, my rules, no? Why should I feel obligated to follow ICANN? Obviously, I'll need to make changes if someone ever registers the domain with ICANN (and I want to access the ICANN version), but other than that...
Earlier quoted context omitted.
The issue here being: what happens when you have your proxy configured as "proxy.lan" but you make a typo when entering it in local DNS or in your browser settings? That DNS request for "proxy.lan" will now go all the way out to the root servers for every page load, multiple times. Not so important for you with your 200 tabs open, but quite important to the people maintaining the root servers who see a significant pe…
What if you make a typo on .home.arpa? e.g., .home.arps? How is that any different?
Earlier quoted context omitted.
The issue here being: what happens when you have your proxy configured as "proxy.lan" but you make a typo when entering it in local DNS or in your browser settings? That DNS request for "proxy.lan" will now go all the way out to the root servers for every page load, multiple times. Not so important for you with your 200 tabs open, but quite important to the people maintaining the root servers who see a significant pe…
Does this happen often? How do they mitigate this?
Weird, my Linksys WRT1900AC applies `.home` to its local DNS, but this article says not to?
(RFCs are published by the IETF who manages the .arpa TLD. That’s one of the few TLDs not managed by ICANN for historical reasons. The .home TLD falls under ICANN’s root domain, so the RFC shouldn’t have assigned it.)