Different response from WAN and LAN

[KartoniarzEssa]

Is it possible to configure AdGuard DNS so that from the local network it gives different response than from public network? For example if I ping example.com from LAN I will get response with local IP of my website, but if I ping it from public IP, I will get public IP of my website

[ppfeufer]

Yep, it is, it's called DNS rewrite

You find it under Filters » DNS Rewrites in the UI or you can write your own filter lists for it. Read more about it here » https://github.com/AdguardTeam/AdGuardHome/wiki/Hosts-Blocklists#dnsrewrite

[KartoniarzEssa]

I want to use my adguard dns server in local network and outside of it. Is it possible to rewrite private addresses to local address of server, and public addresses to public?

[ppfeufer]

It depends on where your AGH instance is located.

If it is in your private home network, you can absolutely add rewrites for public addresses pointing to a machine in your own network. If your AGH instance is on a VPS somewhere on the internet, I would advise against using DNS rewrites as they can have unforeseen side effects. In this case, I would also ensure that only your devices can interact with your AGH instance and it is not a public one.

I did that once and my VPS hoster got contacted by these guys » https://www.bsi.bund.de/EN/Home/home_node.html « essentially asking my hoster to let me know that what I'm doing might be a very bad idea.

[KartoniarzEssa]

So whats im trying to do its not possible and i have to do second dns server for public?

[ppfeufer]

I'm not even sure I understand what you are trying to achieve here.

You shouldn't have to meddle with public DNS at all.

[KartoniarzEssa]

I want to have dns for public so I can have it on my phone or any device in public, but I would like my domain to work inside amd outside my network

[ppfeufer]

Ah, now we're getting closer ...

This is doable but somewhat tricky.

You need three things to accomplish this:

• A dynamic DNS service which binds your IP to a DDNS name (dyndns.org, duckdns.org or whatever provider you chose)
• An officially registered domain with a domain registrar which also lets you access the domains zone file
• A router capable of port forwarding (Pretty much every router should be able to do so)

Now, you add a CNAME to your domain's zone file, like this

@		IN	CNAME	your.dyndns.org.

Make sure the . at the end is present and accounted for, it's important.

This will point your domain to your DDNS name and, by extension, to your IP (the one your router gets from your ISP).

I would suggest doing this only with subdomains though, this way you can have your domain pointing to your public website. For a subdomain, this would look like this:

nextcloud		IN	CNAME	your.dyndns.org.

If it would be for your Nextcloud instance running under nextcloud.your-domain.net for example.

Now your forward port 80 and 443 in your router to the machine inside your local network that services as your webserver/proxy. Important, you can only forward a port to one machine, so if you are running multiple web services in your local network, you either have them all on the same machine or that machine is a proxy server (But that's a different story and out of the scope of this discussion).

Now in your AGH instance, you can add a DNS rewrite for the (sub)domain pointing it to the web server or target machine in your private network.

This will redirect all devices, which are using AGH as their DNS server, in your internal network to the internal web server when they query your domain. All external devices which are not using your internal AGH instance as their DNS server will be pointed to your router, which then directs the request to the right internal machine.

One caveat though:
External devices that are using your AGH instance as their DNS server will receive the internal IP and won't be able to connect. If you want to protect your external devices, like smartphones and tablets as well through AGH, you might have to set up a second instance on a VPS, accessible via VPN for these devices. Important, no DNS rewriting on this instance! (That's how I do it anyways)

[KartoniarzEssa]

So this is my solution, just add this to custom filtering rules

||example.com^$dnsrewrite=NOERROR;A;web host local address,client=192.168.0.0/24

||example.com^$dnsrewrite=NOERROR;A;web host public address

[KartoniarzEssa]

So this is my solution, just add this to custom filtering rules

||example.com^$dnsrewrite=NOERROR;A;[host local address],client=[network address/subnet]

||example.com^$dnsrewrite=NOERROR;A;[host public address]

[pupboss]

Thanks for the solution 👍 . I just tested that the second line is optional if you have resolved the domain in public net.

AdguardHome rules only applies to client subnet.

[LukePWilkins]

Worked for me as well. External client, but using AGH server DOH, the domain resolves to external address.
Internal client on LAN subnet resolves to the server hosting services. Brilliant!