Frank
4b82f35354
Tracked the harness artifacts accumulated on blankpad (blank@), matching the existing convention for the --home-dank-* memory stores and the 36 already-tracked managed-skills. managed-skills (9): authentik-proxy-provider-app-link, dankclaw-guard-chain-layer-diagnosis, e2e-arr-rawip-reachability-triage, halogen-kv-pool-fit, lan-client-split-dns-fix, noctalia-reference, rootless-quadlet-log-retrieval, ssh-key-bootstrap-no-sshpass, swapfile-resize-safe-ordering. memories (2 stores): --home-blank-.omp-- (dotfiles_git, handy_lifecycle, input_permissions) and --home-blank-Projects-serverAppConfig-- (frank_large_quadlet). Secret sweep before staging: no PEM blocks, no credential literals. Content is fleet topology/IPs only, same class as the tracked dank stores.
37 lines
1.9 KiB
Markdown
37 lines
1.9 KiB
Markdown
---
|
|
name: lan-client-split-dns-fix
|
|
description: Fix a LAN client timing out on *.franksdank.cloud because it resolves the public WAN IP (no 443 forward) instead of the Pi-hole LAN answer; diagnose by resolver and fix with a systemd-resolved route-only drop-in.
|
|
---
|
|
|
|
# LAN client split-DNS fix (*.franksdank.cloud)
|
|
|
|
Symptom: a LAN machine gets `connection timeout` (curl rc=28) on `https://*.franksdank.cloud`, or LAN-only names return NXDOMAIN, while the server is actually healthy.
|
|
|
|
## Root cause
|
|
Public DNS for `franksdank.cloud` = WAN IP `71.227.227.172`, which has **no 443 port-forward** (filtered). Pi-hole `192.168.0.143` returns the LAN answer `192.168.0.143` via `addn-hosts`. If the client's resolver is using an external server (1.1.1.1/quad9), it gets the WAN answer → SYN to a filtered port → timeout.
|
|
|
|
## Diagnose (fast)
|
|
```bash
|
|
dig +short www.franksdank.cloud @192.168.0.143 # expect 192.168.0.143
|
|
dig +short www.franksdank.cloud @1.1.1.1 # expect 71.227.227.172 (the trap)
|
|
resolvectl status | grep -iE 'Current DNS|DNS Server' # which server is active?
|
|
# prove the server is fine by pinning the LAN IP:
|
|
curl -sk --resolve www.franksdank.cloud:443:192.168.0.143 https://www.franksdank.cloud/ -o /dev/null -w '%{http_code}\n' # 200
|
|
```
|
|
|
|
## Fix (systemd-resolved route-only drop-in)
|
|
```bash
|
|
sudo mkdir -p /etc/systemd/resolved.conf.d
|
|
sudo tee /etc/systemd/resolved.conf.d/franksdank-lan.conf >/dev/null <<'EOF'
|
|
[Resolve]
|
|
DNS=192.168.0.143
|
|
Domains=~franksdank.cloud ~franksdank.casa
|
|
EOF
|
|
sudo systemctl restart systemd-resolved
|
|
resolvectl flush-caches
|
|
```
|
|
The `~` (route-only) prefix sends `*.franksdank.cloud` ONLY to Pi-hole and never to the default-route servers. Verify: `getent hosts www.franksdank.cloud` → 192.168.0.143.
|
|
|
|
## Note
|
|
This is a per-client fix. Every LAN client that must reach the homelab by name needs Pi-hole as its DNS (or this drop-in). The server side needs no change.
|