Local names — host names and records#

You will end up with the router answering for names of your own — nas.example.com resolving to an inside address for every client on the LAN, without touching a public DNS zone. This is also the better answer to "it works from outside but not from my desk": give the service a name that resolves to its inside address, and the LAN never goes through NAT at all.

Before you start#

• The operator role and a licence.
• The resolver turned on, and the LAN using it.
• A domain. Use one you own, or a name that cannot collide — not .local, which belongs to mDNS.

One name: a host name#

Services → DNS, Local names tab, Add host name. Enter nas.example.com, add its address, and optionally short aliases such as nas. Save and apply.

A host name answers for that one name and nothing else, and the router uses it itself. It is what the OPNsense importer writes for the old router's host entries.

A whole zone: records#

When the router should answer for a whole domain, add records to a zone. Local names → Add record:

1. Zone example.com, Type A, Name nas, Addresses 192.0.2.10. Save.
2. Add record for each other name: a CNAME www pointing at nas.example.com, a TXT at @ for the domain itself, an MX with its mail servers and priorities.
3. Apply the changes.

The name @ is the domain itself. A record takes a TTL, 300 seconds unless you set one.

Every name at once: a wildcard#

A record named * answers for every name in the zone that has no record of its own. With an A record * and an A record @, both pointing at the server that publishes your services, every name under the domain resolves to it from inside — the reference workload's split-horizon:

1. Add record: zone example.com, type A, name *, address 192.0.2.10. Save.
2. Add record: the same, name @. Save.
3. Apply. The table reads *.example.com and example.com.

Only A and AAAA records can be wildcards. A name with a record of its own — nas above — is answered from that record, not the wildcard.

Split-horizon, and the cost#

A zone here overrides the public answer for anyone using this resolver. That is how a published service is reached from the LAN without hairpinning.

The cost is that the two answers can drift. The day the public address changes, the stale answer is here.

A domain served elsewhere: forwarding#

When another server already answers for a domain — an office network, a lab — send its questions there instead: Forwarding tab, Add domain, the domain and the server's address. Turn on Recursive servers when that server is a resolver rather than the domain's own name server, and turn off Validate DNSSEC when it does not sign its answers and the resolver validates every answer.

Check it worked#

From a client, through the router:

dig @192.0.2.1 nas.example.com
dig @192.0.2.1 anything.example.com

And from outside, to confirm the split is where you think it is:

dig @9.9.9.9 nas.example.com

Undoing it#

Click a record and Delete record, or open the zone under Zones and Delete zone to remove every record in it. A host name has its own Delete. Clients cache: a record you delete keeps answering until its TTL expires.

See also#

• Point the LAN at the router's resolver
• Publish a service — split-horizon DNS is the better half of that guide
• Per-host DHCP options and a PXE architecture matrix
• DNS