↓ Skip to Main Content
Shannon Wetnight

DNS Configuration

·· loading · loading · ·
Table of Contents

DNS Service
#

The Primary DNS Server is deployed via the Pi-hole service.

IP Address: 172.16.11.53/24
VLAN ID 11
Docker Container deployed via Portainer and private GitHub repository.
Pi-hole Management Dashboard

This service is solely responsible for all DNS queries on the network for all VLANs. Additionally, Pi-hole implements network-wide ad blocking with user-defined custom blocklists.

The following blocklist(s) are currently in use:

https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.plus.txt

DNS Contingency
#

Secondary Resolver: Google Public DNS (8.8.8.8) ~~ In the event of a primary DNS outage, the fallback has been configured to use Google’s Public DNS.~~

This was initially handled via UDM SE as an enabled secondary address. In practice, however, the UDM SE attempts to use the secondary address to load balance between the primary, poisoning queries and causing failed lookups and service outages.

UDM SE DNS Configuration

Dynamic DNS
#

Dynamic DNS is configured through Cloudflare.

UDM SE updates Cloudflare at a specified subdomain with the current leased WAN IP from the ISP. This minimizes downtime during ISP lease renewals by automatically updating.

Reverse Proxy
#

Reverse proxy is handled via Traefik (migrated from Nginx Proxy Manager in Q1 2025).

  • Provides TLS termination, service routing, and hostname mapping.
  • Integrated with Authentik for SSO and access control.
  • External domains proxied through Cloudflare.
  • Certificates automatically issued via Let’s Encrypt using the DNS-01 challenge through the Cloudflare API.
    • This allows wildcard certificates (*.shannonwetnight.com, *.lab.shannonwetnight.com) to be provisioned and renewed without opening ports 80/443 directly.
    • Certificates are stored and renewed automatically within Traefik.
    • Internal services are secured with the same wildcard certificates, ensuring consistent TLS coverage both inside and outside the network.
    • Backup configurations are hosted/stored on GitHub in a private repository. These are updated when significant changes are made to the Traefik static config.yml or dynamic traefik.yml files.
Public Root Domain: shannonwetnight.com
Internal Home Lab Domain: lab.shannonwetnight.com
Reply by Email