1.4 KiB
1.4 KiB
DNS Resolution
Two flows, one resolver chain.
External resolution
Client asks for a public domain.
graph LR
CLIENT[Client<br/>most VLANs] --> PIHOLE[Pi-hole<br/>filtering + cache]
PIHOLE -->|miss| UNBOUND[Unbound on firewall<br/>recursive + DNSSEC]
UNBOUND --> UPSTREAM[Cloudflare<br/>fallback only]
PIHOLE -.->|blocked| BLOCKED[Ad/tracker<br/>domains]
classDef client fill:#1f2f3a,stroke:#3a6b8b,color:#d0e0f0
classDef resolver fill:#1f3a2f,stroke:#3a8b6b,color:#d0f0e0
classDef upstream fill:#3a2f1f,stroke:#8b6b3a,color:#f0e0d0
classDef blocked fill:#3a1f1f,stroke:#8b3a3a,color:#f0d0d0
class CLIENT client
class PIHOLE,UNBOUND resolver
class UPSTREAM upstream
class BLOCKED blocked
Local hostname resolution (split-horizon)
Client asks for an internal hostname. The query stays on the LAN. Pi-hole answers from local A records and the client connects to the internal reverse proxy.
graph LR
CLIENT[Client] -->|asks for<br/>app.lerkolabs.com| PIHOLE[Pi-hole<br/>local A records]
PIHOLE -->|returns<br/>internal IP| CLIENT
CLIENT -->|HTTPS<br/>valid public cert| CADDY[Internal Caddy<br/>reverse proxy]
CADDY --> SVC[Internal service]
classDef client fill:#1f2f3a,stroke:#3a6b8b,color:#d0e0f0
classDef resolver fill:#1f3a2f,stroke:#3a8b6b,color:#d0f0e0
classDef edge fill:#2f1f3a,stroke:#6b3a8b,color:#e0d0f0
class CLIENT client
class PIHOLE resolver
class CADDY,SVC edge