Self-hosting: Avoiding hairpin NAT / loopback

Ask for Help
1

Hi everyone,

My small team has been loving grist so far. I am trying to make my version of grist-omnibus accessible both over the local network and at our website.

So local network it’s at http://192.168.1.26:6060, and I’m running Caddy reverse proxy to try to make it available at grist.mywebsite.com. Caddy should handle the https so I’ve set the HTTPS=external in the env variables, and basically my server computer is port forwarded so that URL is also 192.168.1.26:6060, and caddy should handle incoming traffic and redirect it to grist.

My issue is that I can get one or the other working, but not both. If I do it as above, it tries to refer external traffic to 192.168.1.26:6060 from an external network, which obviously doesn’t work because it’s a local ip address and means nothing to the computers outside the network.

However, if I set the URL=grist.mywebsite.com, then I could access it externally, but our router doesn’t allow hairpin NAT so users can’t access grist via grist.mywebsite.com. And they also can’t access via the local IP.

I’m no networking expert though, so I’m wondering if someone has any ideas as to how to solve this? It seems my best option at this point would be to make a split-horizon DNS to allow for internal/external access. I’ve tried it once, but my DNS servers prefer IPv6 and I am a bit concerned to turn off the periodic IPv6 address shifting that windows does for my computer to make it a static IPv6.

Thanks in advance everyone,
Brennan

2

Let me guess Telekom?

I would:

setup a local dns server (you might already have one, router, pihole etc).
This dns server must be added to all clients (best done with dhcp).
Then add entrie(s) to this dns server (this depends on which dns you use).
So that

A grist.yourwebsite.com 192.168.1.26
optional:
AAAA grist.yourwebsite.com theIPv6Address of your local server if you want

Then when you local clients want to access grist locally, they lookup
grist.yourwebsite.com and get your local ip.

Then on your public dns provider, they get the public ip.

You could also add a temp entry to your local /etc/hosts to emulate a local dns, but this is not practical since you must add or remove this line when you access from outside.
Just keep this in mind for testing>

Edit: to test this you can use dig or nslookup:

This should return your public ips:
dig grist.yourwebsite.com @8.8.8.8

This should return your local ips:
dig grist.yourwebsite.com @yourLocalDns

Edit: Tbh, if grist is just accessed by your team, i would setup a vpn, and keep access private.

1 Like
3

hey, yeah we basically just decided on using chrome remote desktop and accesssing a computer on the local network when access is needed outside of the office. Seems like the easiest solution, though we were also considering using openVPN with synology since we have a Synology NAS that supports remoting into the vpn portion (however that works).

Appreciate your reply regardless.