← Back to context

Comment by raffraffraff

2 days ago

Hmm. I don't really care enough about leaking home network host names because they are all super generic names like 'router', 'laptop', 'tv', 'nas'. So I use my public zone on cloudflare. I just use internal ip addresses (eg: nas.example.com = 10.1.2.3) on the public zone and DNS01 challenge for let's encrypt. Anyone can resolve the ip for any of my hosts, but obviously you'd need to be on the wireguard vpn to hit them.

This means that I can always use public DNS servers like 1.1.1.1, 8.8.8.8, nextDNS etc

This is not "done right" by any stretch but it's extremely low effort to set up and has never once failed me, unlike countless complex meshy things.

28 comments

raffraffraff

Reply
graton  2 days ago

I do the same thing. I'm not worried about them seeing my FQDNs.

I use the form of hostname.int.example.com for everything inside my home network. None of which is accessible to the outside world. I use LetsEncrypt with DNS validation to get the certificates.

  • tzs  2 days ago

    If you are going to have all the home stuff on a subdomain (int.example.com) would it work to delegate int.example.com to a DNS server running at home what has internet access, and could handle the ACME DNS challenges for machines on int.example.com?

    If it does then you don't have to mess with your public DNS whenever you want to add or renew certificates for home machines.

    I'm using the free DNS my registrar provides, which doesn't provide API access unless you upgrade to their paid DNS service and so if I could use a local DNS server for the ACME challenges for the home network I could pick one that is friendly to automation.

luckman212  2 days ago

Fair, but what about names that are specific enough to give an attacker a clue to a potential attack surface, like "authelia.example.com" - now they know you've likely got an Authelia setup, and can start digging for exploitable CVEs etc. I'm in the process of removing all my individual certs and replacing with a wildcard cert served by Traefik. Is that a bad idea?

  • bbkane  2 days ago

    Can they dig for exploitable CVEs if they're not on the Wireguard network? It is a clue to your infrastructure, but I personally think the simplicity is worth it.

  • nijave  2 days ago

    My IaC is on public GitHub. They could do a network scan to find software then fingerprint to find version anyway.

    Removing attack surface is better than trying to hide it.

  • icedchai  2 days ago

    Do the names resolve to publicly routeable IPs? If not, I wouldn't worry about it.

  • akerl_  2 days ago

    How many people out there have attackers doing individualized research to identify services on their home LAN so they can chain a network attack with CVEs in their self-hosted service?

dizhn  21 hours ago

Subdomains with wildcard dns along with wildcard certificates solves that issue. You only expose a wildcard domain with no subdomains.

thayne  2 days ago

I don't think this is any less right than using split horizon. IMHO, there is no "right" way to do it. Every approach has downsides and tradeoffs.

icedchai  2 days ago

This is similar to what I do, except I have my own authoritative DNS servers instead of Cloudflare.

I'd prefer this over split DNS, any day.