17h ago

Networking Oddity

Hello Selfhosted!

So I have an interesting issue. I have a docker host, and that host i have a Caddy container. I have that setup to handle reverse proxying. I have it setup to be local only. I have a pihole and a wireguard server. And can connect to my network successfully.

The part that confuses me is that while on network everything works great. While on VPN I can connect to services by IP:Port. If I use mobile data with VPN, I can't use the site addresses. x.domain.xxx (for privacy sake I'm leaving my domain out of the post.) But when I connect to WiFi, any WiFi, and connect to VPN I can go to the address I have setup for reverse proxying.

I am unsure how to troubleshoot this. Any pointers would be appreciated.

17 comments

smells like the mobile data isnt honoring the split tunnel dns comin from the vpn. the mobile provider is doin some funny business with your dns on that device
- That's what I was thinking. Thank you

You might want to do a DNS leak test from your phone with the wireguard connection down and then with it up to make sure you're tunneling DNS. This will be clearer if you set pihole to use something upstream that an ISP is unlikely to use - quad9 for example.
- DNS leak test comes back the same mobile data with VPN as it does WiFi with VPN pointing back to DNS reflecting my upstream DNS, Quad9.

You have a DNS problem. How is that set up?
- I have DNS handled by my PiHole (using unbound as-can upstream DNS)
  On my PiHole, I have an A record for the docker box, and then CNAME records pointing to the A name record.
  It makes little sense why it works on an offsite WiFi, but not mobile data.
  
  It makes little sense why it works on an offsite WiFi, but not mobile data.
  I'd agree with unbuckled above, it's a DNS issue. If your mobile device is capable, use nslookup or dig to see what responses you are getting in different scenarios. It's possible that your VPN software is leaking DNS queries out to the mobile data provider's DNS servers while you are on mobile data and only using the correct DNS settings when you are on wifi. Possibly look for split tunnel settings in the VPN software, as this can create this type of situation.
  You can also confirm this from the pihole side. Connect to the VPN via mobile data and browse to some website you don't use often, but is not your own internal stuff. Then open the query log on your pihole and see if that domain shows up. I'd put money on that query not showing in the pihole query log.
  
  In that case, are you sure the VPN is actually on, when on cellular?

17 comments