Skip to content

URL Access & Proxy Troubleshooting Guide.md

Latest commit

 

History

History
326 lines (223 loc) · 7.16 KB

URL Access & Proxy Troubleshooting Guide.md

File metadata and controls

326 lines (223 loc) · 7.16 KB
Raw

Overview

This guide covers all common issues encountered when setting up local domain access (*.home.lab) using pfSense, Pi-hole, and Nginx Proxy Manager in a VMware-based home lab.

Architecture Reference

Client VM (Kali)
     │
     ▼
pfSense (192.168.1.1)     ← Router, Firewall, DHCP
     │
     ▼
Pi-hole (192.168.1.2:8080)  ← DNS Server
     │
     ▼
Nginx Proxy Manager (192.168.1.2:80/81)  ← Reverse Proxy
     │
     ▼
Services (pihole.home.lab, pfsense.home.lab, nginx.home.lab)

Issue 1 — Client Getting Wrong DNS Server

Symptom

/etc/resolv.conf shows nameserver 192.168.1.1 (pfSense) instead of 192.168.1.2 (Pi-hole).

Cause

pfSense DHCP was not configured to hand out Pi-hole as DNS. Existing DHCP leases were not renewed.

Fix

Step 1 — Set DNS in pfSense DHCP:

  • Go to pfSense → Services → DHCP Server → LAN
  • Set DNS Server 1 → 192.168.1.2
  • Save → Apply

Step 2 — Set DNS Resolver forwarding:

  • Go to pfSense → Services → DNS Resolver
  • Add to Custom Options:
server:
forward-zone:
    name: "."
    forward-addr: 192.168.1.2
  • Save → Apply

Step 3 — Renew DHCP lease on client:

sudo dhclient -r && sudo dhclient
cat /etc/resolv.conf    # should now show 192.168.1.2

Issue 2 — DNS Records Missing in Pi-hole

Symptom

nslookup pihole.home.lab returns NXDOMAIN.

Cause

Pi-hole Local DNS records were never added or were wiped after a reset.

Fix

Go to Pi-hole dashboard → Settings → Local DNS Records → add:

Domain IP
pfsense.home.lab 192.168.1.1
pihole.home.lab 192.168.1.2
nginx.home.lab 192.168.1.2

Verify:

nslookup pfsense.home.lab 192.168.1.2
# Should return 192.168.1.1

nslookup pihole.home.lab 192.168.1.2
# Should return 192.168.1.2

Issue 3 — DNS Records Pointing to Wrong IP

Symptom

nslookup returns 172.17.0.1 instead of 192.168.1.2.

Cause

Docker gateway IP (172.17.0.1) was used instead of actual VM LAN IP when creating DNS records.

Fix

Delete all wrong DNS records in Pi-hole and re-add them with correct IPs.

  • All *.home.lab domains → 192.168.1.2 (except pfSense → 192.168.1.1)
  • 172.17.0.1 is internal Docker only — unreachable by other LAN machines

Issue 4 — Nginx Can't Proxy to Local Services (127.0.0.1 Issue)

Symptom

pihole.home.lab and nginx.home.lab don't load but pfsense.home.lab works fine.

Cause

Nginx Proxy Manager runs inside Docker. When forwarding to 127.0.0.1, it refers to the container itself — not the Debian host VM. Services like Pi-hole running on the host are unreachable this way.

pfSense works because it's on a different IP (192.168.1.1) with no Docker confusion.

Fix

Add host.docker.internal mapping to docker-compose.yml:

services:
  app:
    image: jc21/nginx-proxy-manager:latest
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"    ← add this
    ports:
      - "80:80"
      - "81:81"
      - "443:443"
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

Then in Nginx Proxy Manager, set all proxy hosts to:

Forward Hostname → host.docker.internal
Forward Port     → (service port e.g. 8080 for Pi-hole)

Issue 5 — Pi-hole Ignoring Queries From LAN

Symptom

Pi-hole logs show ignoring query from non-local network for queries from 192.168.1.x.

Cause

Pi-hole Docker container uses bridge networking by default. It sees traffic through Docker's internal network and doesn't recognise your LAN subnet as local.

Fix

Switch Pi-hole to host network mode so it shares the VM's network directly:

services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    network_mode: host           ← bypass Docker networking
    environment:
      TZ: 'Asia/Kolkata'
      DNSMASQ_LISTENING: all
      FTLCONF_LOCAL_IPV4: 192.168.1.2
      WEBPASSWORD: 'yourpassword'
      FTLCONF_webserver_port: '8080'
    volumes:
      - './etc-pihole:/etc/pihole'
    restart: unless-stopped

Note: ports: section is removed for Pi-hole when using host network mode. Docker ignores it anyway and will show a warning — this is expected, not an error.

Issue 6 — Port Conflict Between Pi-hole and Nginx

Symptom

After switching Pi-hole to host network mode, 192.168.1.2 becomes unreachable.

Cause

With host network mode, Pi-hole's web UI defaults to port 80 — same port Nginx uses. Both services clash.

Fix

Set Pi-hole web port to 8080 using the correct environment variable for Pi-hole v6:

environment:
  FTLCONF_webserver_port: '8080'

Pi-hole v6 replaced lighttpd with FTL built-in web server. Older variables like WEB_PORT or LIGHTTPD_PORT do not work. Use FTLCONF_webserver_port.

Issue 7 — Domains Work on Host VM But Not Other Machines

Symptom

pihole.home.lab opens in browser on the Debian VM but not from Kali or other VMs.

Cause

The Debian VM resolves domains using its own local DNS. Other machines on the LAN may still be pointing to pfSense (192.168.1.1) as DNS, which has no knowledge of home.lab records.

Fix

Ensure all machines get Pi-hole as DNS via pfSense DHCP (see Issue 1).

Force renew on each client:

sudo dhclient -r && sudo dhclient
nslookup pihole.home.lab    # should return 192.168.1.2

Quick Diagnostic Commands

# Check which DNS server the machine is using
cat /etc/resolv.conf

# Test if Pi-hole resolves a domain
nslookup pihole.home.lab 192.168.1.2

# Check if a service port is open
sudo ss -tlnp | grep :8080

# Check if Pi-hole container is running
docker ps

# View Pi-hole logs
docker logs pihole

# View Pi-hole errors only
docker logs pihole 2>&1 | grep -i "error\|web\|port\|ignor"

# Renew DHCP lease
sudo dhclient -r && sudo dhclient

# Test service directly by IP (bypass DNS)
curl http://192.168.1.2:8080/admin

Final Working Configuration Summary

docker-compose.yml

services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    network_mode: host
    environment:
      TZ: 'Asia/Kolkata'
      DNSMASQ_LISTENING: all
      FTLCONF_LOCAL_IPV4: 192.168.1.2
      WEBPASSWORD: 'yourpassword'
      FTLCONF_webserver_port: '8080'
    volumes:
      - './etc-pihole:/etc/pihole'
    restart: unless-stopped

  app:
    image: jc21/nginx-proxy-manager:latest
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - '80:80'
      - '443:443'
      - '81:81'
    environment:
      TZ: 'Asia/Kolkata'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

Pi-hole Local DNS Records

Domain IP
pfsense.home.lab 192.168.1.1
pihole.home.lab 192.168.1.2
nginx.home.lab 192.168.1.2

Nginx Proxy Hosts

Domain Forward Host Forward Port
pfsense.home.lab 192.168.1.1 443
pihole.home.lab host.docker.internal 8080
nginx.home.lab host.docker.internal 81

pfSense DNS Settings

  • DHCP DNS Server → 192.168.1.2
  • DNS Resolver → forward all to 192.168.1.2