4 ms·
Hmm. I don't really care enough about leaking home network host names because they are all super generic names like 'router', 'laptop', 'tv', 'nas'. So I use m
by raffraffraff 3mo ago
Hmm. I don't really care enough about leaking home network host names because they are all super generic names like 'router', 'laptop', 'tv', 'nas'. So I use my public zone on cloudflare. I just use internal ip addresses (eg: nas.example.com = 10.1.2.3) on the public zone and DNS01 challenge for let's encrypt. Anyone can resolve the ip for any of my hosts, but obviously you'd need to be on the wireguard vpn to hit them.
This means that I can always use public DNS servers like 1.1.1.1, 8.8.8.8, nextDNS etc
This is not "done right" by any stretch but it's extremely low effort to set up and has never once failed me, unlike countless complex meshy things.
- luckman212 3mo agoFair, but what about names that are specific enough to give an attacker a clue to a potential attack surface, like "authelia.example.com" - now they know you've likely got an Authelia setup, and can start digging for exploitable CVEs etc. I'm in the process of removing all my individual certs and replacing with a wildcard cert served by Traefik. Is that a bad idea?
- bbkane 3mo agoCan they dig for exploitable CVEs if they're not on the Wireguard network? It is a clue to your infrastructure, but I personally think the simplicity is worth it.
- nijave 3mo agoMy IaC is on public GitHub. They could do a network scan to find software then fingerprint to find version anyway. Removing attack surface is better than trying to hide it.
- icedchai 3mo agoDo the names resolve to publicly routeable IPs? If not, I wouldn't worry about it.
- akerl_ 3mo agoHow many people out there have attackers doing individualized research to identify services on their home LAN so they can chain a network attack with CVEs in their self-hosted service?
- pixl97 3mo agoEveryone, now that you can just toss the work at an LLM.
- akerl_ 3mo agoWhere are you seeing this? LLMs make it easier to do bulk data analysis / scale attack patterns, but I've not seen anything to suggest they're incentivizing people to do OSINT against random individuals to fire off targeted attacks on home LANs. The juice isn't really worth the squeeze for the token spend any more than it was worth the human energy.
- icedchai 3mo agoThis is similar to what I do, except I have my own authoritative DNS servers instead of Cloudflare. I'd prefer this over split DNS, any day.
- graton 3mo agoI do the same thing. I'm not worried about them seeing my FQDNs. I use the form of hostname.int.example.com for everything inside my home network. None of which is accessible to the outside world. I use LetsEncrypt with DNS validation to get the certificates.
- tzs 3mo agoIf you are going to have all the home stuff on a subdomain (int.example.com) would it work to delegate int.example.com to a DNS server running at home what has internet access, and could handle the ACME DNS challenges for machines on int.example.com? If it does then you don't have to mess with your public DNS whenever you want to add or renew certificates for home machines. I'm using the free DNS my registrar provides, which doesn't provide API access unless you upgrade to their paid DNS service and so if I could use a local DNS server for the ACME challenges for the home network I could pick one that is friendly to automation.
- waynesonfire 3mo agoYes, you're describing a fundemental feature of DNS.
- graton 3mo ago> I'm using the free DNS my registrar provides, which doesn't provide API access unless you upgrade to their paid DNS service I use Cloudflare for DNS and it is free to use the API.
- throw0101a 3mo ago> I use the form of hostname.int.example.com […] Note that int is a valid TLD: * https://en.wikipedia.org/wiki/.int https://en.wikipedia.org/wiki/.int * https://datatracker.ietf.org/doc/html/rfc1591 https://datatracker.ietf.org/doc/html/rfc1591
- icedchai 3mo agoHe’s using it as a subdomain.
- rao-v 3mo agoAt that point why not just use the .ts.net addresses Tailscale provides for free?
- kennywinker 3mo agoBecause hostname.tail62bc83.ts.net is a mouthful.
- rao-v 3mo agoYou can change it to something a tiny bit nicer a few times!
- kennywinker 3mo agoOh! I did not know it was changeable. That’s useful!
- raffraffraff 3mo agoI get to use the same host names and IP addresses at home or on the VPN. I run a simple wireguard server on a Raspberry pi, and the whole setup has been rock solid. I did set up tailscale, way back. After using it a few times to test, it failed me when I really needed it (I was out of the country and it failed - can't remember exactly what went wrong but it wwas 100% 'in my tailscale account'). I immediately dropped it and went back to OpenVPN (shit but reliable) before building my current setup.
- thayne 3mo agoI don't think this is any less right than using split horizon. IMHO, there is no "right" way to do it. Every approach has downsides and tradeoffs.
- dizhn 3mo agoSubdomains with wildcard dns along with wildcard certificates solves that issue. You only expose a wildcard domain with no subdomains.