4 ms·

I have one specific problem but I'm not sure if this is connected. I have a home assistant on a raspberry pi at my parents house. From outside of the network th

by jeena 5y ago

I have one specific problem but I'm not sure if this is connected. I have a home assistant on a raspberry pi at my parents house. From outside of the network there is no problem, they have a dynamic DNS pointing to their IP address and then port forwarding so that they can access the home assistant UI from the internet. But they also need to access it from home when they're on the WiFi. Because their router doesn't do this NAT Loopback so that they need to access it via the IP address which is very cumbersome. What I did was that I set up a DNS server which would resolve the dynamic DNS domain to the raspberry pi and pointed the router to use this DNS server. This way they were able to use the same domain in and outside of the network. I understand that Firefox falls back on the old way of DNS, but I have to assume that Chromecast and Google Assistant will not and therefor it will fail to play local media or show the home assistant UI? Somehow this fucks up local networks and assumes everything is on the Internet, doesn't it?

jeroenhd 5y ago
In this case using an IPv6 address might work (if your ISPs aren't behind on rolling out IPv6). Alternatively you could tunnel the connection through something intended to break through problematic NAT setups like ngrok (or its alternatives: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling). I've run a split horizon DNS configuration for years and I've got to say that it caused more problems for me than it solves. Luckily, you can just turn off DoH if it causes problems for you. In my experience, the Chromecast and Google Assistant functionality isn't related to your DNS setup. Chromecast should work through broadcast or through an active request from HASS itself, and the Google integration has always gone through the cloud as far as I know. Perhaps your setup is different than mine, but I don't think these issues are necessarily DNS related, unless Google's servers are getting your local IP when they query for the HASS domain.
- jeena 5y ago
  Sadly Google Assistant does need to use the DNS setup because I play local media for announcements on it and every time the DNS is broken it stops working and doesn't play any local media anymore. Basically home assistant media player plays a mp3 which is stored on the raspberry pi on the Google Assistant, for example when someone opens the out door it plays a chime on all Google Assistants in the whole house so that my parents know that someone opened the door downstairs. The url will be https://myparentshouse.duckdns.org/local/open-door.mp3 https://myparentshouse.duckdns.org/local/open-door.mp3 so if the Google Assistant doesn't use the local DNS it can't resolve the domain to the local raspberry pi, and instead resolves it to the public IP address which then without the Loopback NAT doesn't go anywhere. I understand that I should then instead of using Google Assistant for that to use something else, but I haven't found any free hardware which would have the functionality of good microphones and working speech to text yet.
  - jeroenhd 5y ago
    In that case I'd find a way to put the file universally accessible on the internet somehow (the proxies I mentioned, or IPv6, through HE Tunnelbroker if necessary, or on a random HTTP host you might control?). Debugging split DNS issues can take hours and luckily there are free and cheap tools to avoid this mess! They require some setup, but in my opinion the lack of maintenance they require is much easier to live with than the split-DNS-mess. I haven't seen much evidence of Google hardware actually using DoH, but they will definitely use 8.8.8.8. If your router has the ability, you could try forcing traffic intended towards 8.8.8.8:53/udp to your router's DNS server.
josephcsible 5y ago
> their router doesn't do this NAT Loopback IMO, the best solution is to replace it with one that does. Split-horizon DNS is a horrible hack that among other things, precludes the use of DNSSEC.
- tptacek 5y ago
  Of course, split-horizon DNS is used by more organizations, by multiple orders of magnitude, than DNSSEC, so it's not that simple. :)
  - josephcsible 5y ago
    Organizations that use split-horizon DNS should just add their own domain to network.trr.excluded-domains via enterprise policies rather than disabling DoH completely.

by jeena 5y ago

jeroenhd 5y ago

In this case using an IPv6 address might work (if your ISPs aren't behind on rolling out IPv6). Alternatively you could tunnel the connection through something intended to break through problematic NAT setups like ngrok (or its alternatives: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling). I've run a split horizon DNS configuration for years and I've got to say that it caused more problems for me than it solves. Luckily, you can just turn off DoH if it causes problems for you. In my experience, the Chromecast and Google Assistant functionality isn't related to your DNS setup. Chromecast should work through broadcast or through an active request from HASS itself, and the Google integration has always gone through the cloud as far as I know. Perhaps your setup is different than mine, but I don't think these issues are necessarily DNS related, unless Google's servers are getting your local IP when they query for the HASS domain.

jeena 5y ago
Sadly Google Assistant does need to use the DNS setup because I play local media for announcements on it and every time the DNS is broken it stops working and doesn't play any local media anymore. Basically home assistant media player plays a mp3 which is stored on the raspberry pi on the Google Assistant, for example when someone opens the out door it plays a chime on all Google Assistants in the whole house so that my parents know that someone opened the door downstairs. The url will be https://myparentshouse.duckdns.org/local/open-door.mp3 https://myparentshouse.duckdns.org/local/open-door.mp3 so if the Google Assistant doesn't use the local DNS it can't resolve the domain to the local raspberry pi, and instead resolves it to the public IP address which then without the Loopback NAT doesn't go anywhere. I understand that I should then instead of using Google Assistant for that to use something else, but I haven't found any free hardware which would have the functionality of good microphones and working speech to text yet.
- jeroenhd 5y ago
  In that case I'd find a way to put the file universally accessible on the internet somehow (the proxies I mentioned, or IPv6, through HE Tunnelbroker if necessary, or on a random HTTP host you might control?). Debugging split DNS issues can take hours and luckily there are free and cheap tools to avoid this mess! They require some setup, but in my opinion the lack of maintenance they require is much easier to live with than the split-DNS-mess. I haven't seen much evidence of Google hardware actually using DoH, but they will definitely use 8.8.8.8. If your router has the ability, you could try forcing traffic intended towards 8.8.8.8:53/udp to your router's DNS server.

josephcsible 5y ago

> their router doesn't do this NAT Loopback IMO, the best solution is to replace it with one that does. Split-horizon DNS is a horrible hack that among other things, precludes the use of DNSSEC.

tptacek 5y ago
Of course, split-horizon DNS is used by more organizations, by multiple orders of magnitude, than DNSSEC, so it's not that simple. :)
- josephcsible 5y ago
  Organizations that use split-horizon DNS should just add their own domain to network.trr.excluded-domains via enterprise policies rather than disabling DoH completely.