Split-Horizon DNS Setup

Status: ✅ Fully configured and operational as of 2026-02-03

Using shdwnet.cloud as both internal LAN domain and external domain via split-horizon (split-brain) DNS.

🧠 The Concept

Split-horizon DNS = same domain resolves to different IPs depending on where you’re asking from.

┌─────────────────────────────────────────────────────────────────┐
│                     plex.shdwnet.cloud                          │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│   INSIDE LAN (Pi-hole DNS)         OUTSIDE (Cloudflare DNS)    │
│   ────────────────────────         ────────────────────────    │
│                                                                 │
│   Query: plex.shdwnet.cloud        Query: plex.shdwnet.cloud   │
│      ↓                                ↓                         │
│   Pi-hole answers:                 Cloudflare answers:          │
│   → 192.168.1.10 (NPM local)       → 203.x.x.x (your public IP)│
│      ↓                                ↓                         │
│   Direct LAN traffic               Traffic routes through       │
│   (fast, no hairpin NAT)           Internet → Router → NPM      │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Why this is better than .local or .lan:

✅ Same URLs work everywhere (home, mobile, VPN, coffee shop)
✅ Real SSL certificates (Let’s Encrypt validates against Cloudflare)
✅ No hairpin NAT issues when inside LAN
✅ Proper domain you actually own
✅ Works with apps that validate domain names

🏗️ Architecture

                    ┌─────────────────┐
                    │   INTERNET      │
                    └────────┬────────┘
                             │
              ┌──────────────┴──────────────┐
              │                             │
              ▼                             │
    ┌──────────────────┐                    │
    │   Cloudflare     │                    │
    │   DNS Servers    │                    │
    │                  │                    │
    │ *.shdwnet.cloud  │                    │
    │ → Your Public IP │                    │
    └────────┬─────────┘                    │
             │                              │
             │ (external queries)           │
             ▼                              │
    ┌──────────────────┐           ┌────────┴───────┐
    │   Your Router    │           │   Your Router  │
    │   (Public IP)    │◄──────────┤   (Port Fwd)   │
    └────────┬─────────┘           └────────────────┘
             │
             │ Port 80/443 forwarded
             ▼
    ┌──────────────────┐
    │   NPM (.10)      │◄──────────────────────────────┐
    │   Reverse Proxy  │                               │
    └────────┬─────────┘                               │
             │                                         │
             │ Proxies to internal services            │
             ▼                                         │
    ┌──────────────────────────────────────┐          │
    │   Internal Services                   │          │
    │   • Plex (.156:32400)                │          │
    │   • Paperless (.156:8000)            │          │
    │   • Vaultwarden (docker1)            │          │
    └──────────────────────────────────────┘          │
                                                       │
    ════════════════════════════════════════          │
                                                       │
    INSIDE LAN:                                        │
                                                       │
    ┌──────────────────┐                               │
    │   Pi-hole (.50)  │                               │
    │   Local DNS      │                               │
    │                  │                               │
    │ *.shdwnet.cloud  │───────────────────────────────┘
    │ → 192.168.1.10   │   (resolves to NPM directly)
    │   (local NPM IP) │
    └──────────────────┘
             ▲
             │
    ┌────────┴─────────┐
    │   LAN Clients    │
    │   (use Pi-hole)  │
    └──────────────────┘

📝 DNS Records Needed

Layer 1: Cloudflare (External/Public DNS)

These records are set in Cloudflare dashboard for shdwnet.cloud:

Type	Name	Target	Proxy	TTL	Purpose
A	`@`	`YOUR_PUBLIC_IP`	☁️ Proxied	Auto	Root domain
A	`*`	`YOUR_PUBLIC_IP`	☁️ Proxied	Auto	Wildcard (all subdomains)

Or individual subdomains (more control):

Type	Name	Target	Proxy	TTL
A	`notes`	`YOUR_PUBLIC_IP`	☁️ Proxied	Auto
A	`plex`	`YOUR_PUBLIC_IP`	☁️ Proxied	Auto
A	`vault`	`YOUR_PUBLIC_IP`	☁️ Proxied	Auto
A	`uptime`	`YOUR_PUBLIC_IP`	☁️ Proxied	Auto
A	`paperless`	`YOUR_PUBLIC_IP`	☁️ Proxied	Auto
A	`portainer`	`YOUR_PUBLIC_IP`	☁️ Proxied	Auto

💡 Wildcard vs Individual: Wildcard (*) is easier but exposes that any subdomain exists. Individual records give you more control.

☁️ Cloudflare Proxy: “Proxied” (orange cloud) hides your real IP and adds DDoS protection. “DNS Only” (grey cloud) exposes your IP.

Layer 2: Pi-hole (Internal/LAN DNS)

These records override Cloudflare for LAN clients. Set in Pi-hole Admin → Local DNS → DNS Records:

Domain	IP Address	Purpose
`shdwnet.cloud`	`192.168.1.10`	Root → NPM
`notes.shdwnet.cloud`	`192.168.1.10`	Notes → NPM
`plex.shdwnet.cloud`	`192.168.1.10`	Plex → NPM
`vault.shdwnet.cloud`	`192.168.1.10`	Vault → NPM
`uptime.shdwnet.cloud`	`192.168.1.10`	Uptime → NPM
`paperless.shdwnet.cloud`	`192.168.1.10`	Paperless → NPM
`portainer.shdwnet.cloud`	`192.168.1.10`	Portainer → NPM
`proxmox.shdwnet.cloud`	`192.168.1.144`	Direct to Proxmox (no proxy)

Why point to NPM (192.168.1.10)?

NPM handles SSL termination
NPM routes to the correct backend service
You get HTTPS even on LAN
Same URL path works everywhere

When to point directly (skip NPM)?

Services with their own SSL (Proxmox WebUI)
Services that don’t need external access
Performance-critical internal-only services

Layer 3: NPM Proxy Hosts

For each subdomain, create a proxy host in NPM:

Domain	Forward Host	Forward Port	SSL
`notes.shdwnet.cloud`	`192.168.1.X`	`XXXX`	✅ Let’s Encrypt
`plex.shdwnet.cloud`	`192.168.1.156`	`32400`	✅ Let’s Encrypt
`vault.shdwnet.cloud`	`192.168.1.20`	`XXXX`	✅ Let’s Encrypt
`uptime.shdwnet.cloud`	`192.168.1.20`	`XXXX`	✅ Let’s Encrypt
`paperless.shdwnet.cloud`	`192.168.1.156`	`8000`	✅ Let’s Encrypt
`portainer.shdwnet.cloud`	`192.168.1.20`	`8080`	✅ Let’s Encrypt

🔧 Setup Steps

Step 1: Cloudflare DNS Records

Login to Cloudflare Dashboard
Select shdwnet.cloud domain
Go to DNS → Records
Add A records pointing to your public IP
Enable Cloudflare proxy (orange cloud) for DDoS protection

Find your public IP:

curl -s ifconfig.me

Step 2: Router Port Forwarding

Forward ports 80 and 443 to NPM:

External Port	Internal IP	Internal Port	Protocol
80	192.168.1.10	80	TCP
443	192.168.1.10	443	TCP

Step 3: NPM Proxy Hosts

Login to NPM: http://192.168.1.10:81
Proxy Hosts → Add Proxy Host
For each subdomain:
- Domain: plex.shdwnet.cloud
- Forward Hostname: 192.168.1.156
- Forward Port: 32400
- Enable: Block Common Exploits
- SSL Tab: Request new SSL certificate, Force SSL, HTTP/2

Step 4: Pi-hole Local DNS

Login to Pi-hole: http://192.168.1.50/admin
Local DNS → DNS Records
Add each subdomain pointing to 192.168.1.10 (NPM)

Or via CLI:

ssh root@192.168.1.50
 
# Add to /etc/pihole/custom.list
echo "192.168.1.10 shdwnet.cloud" >> /etc/pihole/custom.list
echo "192.168.1.10 notes.shdwnet.cloud" >> /etc/pihole/custom.list
echo "192.168.1.10 plex.shdwnet.cloud" >> /etc/pihole/custom.list
echo "192.168.1.10 vault.shdwnet.cloud" >> /etc/pihole/custom.list
echo "192.168.1.10 uptime.shdwnet.cloud" >> /etc/pihole/custom.list
echo "192.168.1.10 paperless.shdwnet.cloud" >> /etc/pihole/custom.list
echo "192.168.1.10 portainer.shdwnet.cloud" >> /etc/pihole/custom.list
echo "192.168.1.144 proxmox.shdwnet.cloud" >> /etc/pihole/custom.list
 
# Restart DNS
pihole restartdns

Step 5: Test

From inside LAN:

# Should resolve to local IP
nslookup plex.shdwnet.cloud
# Expected: 192.168.1.10
 
# Should work
curl -I https://plex.shdwnet.cloud

From outside (mobile data, VPN off):

# Should resolve to public IP (or Cloudflare proxy IP)
nslookup plex.shdwnet.cloud 1.1.1.1
 
# Should work through the internet
curl -I https://plex.shdwnet.cloud

🔒 SSL Certificates

How Let’s Encrypt works with this setup:

You request cert for plex.shdwnet.cloud in NPM
Let’s Encrypt does HTTP-01 challenge (or DNS-01)
Challenge goes to Cloudflare → your public IP → NPM
NPM responds, cert is issued
Cert is valid for both internal and external access

DNS-01 Challenge (recommended for wildcards):

Configure Cloudflare API token in NPM
NPM can request *.shdwnet.cloud wildcard cert
No port 80 needed during validation

🛡️ Security Considerations

Firewall NPM: Only expose 80/443, not the admin port (81)
Cloudflare Proxy: Hides your real IP from attackers
Access Lists: NPM can restrict access by IP for sensitive services
Internal-Only Services: Don’t add Cloudflare DNS for services that shouldn’t be external (like Proxmox)

🗺️ Final Domain Map (✅ Live 2026-02-03)

Domain	External (Cloudflare)	Internal (Pi-hole)	Service
`shdwnet.cloud`	→ Public IP	→ 192.168.1.10	Root/Landing
`notes.shdwnet.cloud`	→ Public IP	→ 192.168.1.10	Quartz Notes (PM2 :3030)
`plex.shdwnet.cloud`	→ Public IP	→ 192.168.1.10	Plex Media Server
`vault.shdwnet.cloud`	→ Public IP	→ 192.168.1.10	Vaultwarden
`uptime.shdwnet.cloud`	→ Public IP	→ 192.168.1.10	Uptime Kuma
`pulse.shdwnet.cloud`	→ Public IP	→ 192.168.1.10	Alias → Uptime Kuma
`paperless.shdwnet.cloud`	→ Public IP	→ 192.168.1.10	Paperless-ngx
`portainer.shdwnet.cloud`	→ Public IP	→ 192.168.1.10	Portainer
`netdata.shdwnet.cloud`	→ Public IP	→ 192.168.1.10	VPS Netdata (via NPM → VPS:19998)
`proxmox.shdwnet.cloud`	❌ None	→ 192.168.1.144	Proxmox (internal only)

Pi-hole v6 Configuration

Pi-hole v6 uses pihole.toml for DNS records (not custom.list):

# /etc/pihole/pihole.toml (inside Docker container)
hosts = [
    "192.168.1.10 shdwnet.cloud",
    "192.168.1.10 notes.shdwnet.cloud",
    "192.168.1.10 plex.shdwnet.cloud",
    "192.168.1.10 vault.shdwnet.cloud",
    "192.168.1.10 uptime.shdwnet.cloud",
    "192.168.1.10 pulse.shdwnet.cloud",
    "192.168.1.10 paperless.shdwnet.cloud",
    "192.168.1.10 portainer.shdwnet.cloud",
    "192.168.1.10 netdata.shdwnet.cloud",
    "192.168.1.144 proxmox.shdwnet.cloud"
]

Reload after changes: docker exec pihole pihole reloaddns

Quartz 4

Explorer

🌐 Split-Horizon DNS (shdwnet.cloud LAN Domain)

Split-Horizon DNS Setup

🧠 The Concept

🏗️ Architecture

📝 DNS Records Needed

Layer 1: Cloudflare (External/Public DNS)

Layer 2: Pi-hole (Internal/LAN DNS)

Layer 3: NPM Proxy Hosts

🔧 Setup Steps

Step 1: Cloudflare DNS Records

Step 2: Router Port Forwarding

Step 3: NPM Proxy Hosts

Step 4: Pi-hole Local DNS

Step 5: Test

🔒 SSL Certificates

🛡️ Security Considerations

🗺️ Final Domain Map (✅ Live 2026-02-03)

Pi-hole v6 Configuration

Graph View

Table of Contents

Backlinks

Quartz 4

Explorer

🌐 Split-Horizon DNS (shdwnet.cloud LAN Domain)

Split-Horizon DNS Setup

🧠 The Concept

🏗️ Architecture

📝 DNS Records Needed

Layer 1: Cloudflare (External/Public DNS)

Layer 2: Pi-hole (Internal/LAN DNS)

Layer 3: NPM Proxy Hosts

🔧 Setup Steps

Step 1: Cloudflare DNS Records

Step 2: Router Port Forwarding

Step 3: NPM Proxy Hosts

Step 4: Pi-hole Local DNS

Step 5: Test

🔒 SSL Certificates

🛡️ Security Considerations

🗺️ Final Domain Map (✅ Live 2026-02-03)

Pi-hole v6 Configuration

Related

Graph View

Table of Contents

Backlinks