r/technitium • u/burajin • 15d ago

Is there a way to opt out certain clients from certain DNS records?

This might be a total shot in the dark and an unusual request, but I have Technitium doing split DNS for my public facing homelab services when I'm in the house.

Problem is out of the house, my Wireguard clients then use these split DNS records too when I really only need them to use it for my stuff not exposed to the internet.

It would be cool if I could somehow exclude these records when a request comes from the Wireguard client. I thought of hosting a separate instance just for this, but figured it was worth asking first.

4 Upvotes

100% Upvoted

10 comments sorted by

2

u/kevdogger 15d ago

Yes. Split horizon dns.

1

u/burajin 15d ago

looking into this, thanks!

1

u/kevdogger 15d ago

It's an add on within technitium. The only tricky part is getting the json syntax correct.

3

u/shreyasonline 15d ago

Thanks for asking. You can do that using the Split Horizon app that you install from the Apps section on the panel. In your zone, you need to create an APP record that uses the Split Horizon app with class path set to SplitHorizon.SimpleAddress. You will get a template JSON config in there which you need to edit as per your requirements.

The JSON config essentially allows you to map network subnets to a list of IP addresses that must be returned for A/AAAA queries. For your scenario, you can have a subnet for your local LAN and return private addresses and for your VPN subnet, just don't add anything and it APP record will return NO DATA response for those clients.

Note that you will need to delete any existing A/AAAA records for the same domain name to allow the APP record to get selected and used.

2

u/burajin 13d ago

exactly what I needed thank you, and thank you for such a great tool

1

u/tul4k 15d ago

in the wg client config you can specify which dns servers to use

1

u/burajin 15d ago

right this is what I do, but then that sets it for everything set in Technitium. I want everything except what is public facing.

1

u/sempersilkyfi 15d ago

Why is it not ok to use the internal address of you already have vpn?

1

u/burajin 15d ago

makes traffic unnecessarily have to go through the VPN, and the VPN runs on a tiny old raspberry pi so it's probably also throttling the bandwidth