Domain as VPN-mimic with A-record pointing towards private address

Website, Application, Performance DNS & Network
1

What is the name of the domain?

git.redacted-for-privacy.tld

What is the error number?

1002

What is the error message?

DNS points to local or disallowed IP

What is the issue you’re encountering

Cloudflare disallowing connections to my subdomains

What steps have you taken to resolve the issue?

I wanted to configure Cloudflare’s DNS as to mimic VPN-like behavior.

I’ve searched all over the internet first, to see if Cloudflare supports such definitions, didn’t receive a 100% reply in that matter, so I went and configured domain’s DNS to do exactly that, point to my local server’s private address in A record, 192.168.1.20.

At first everything was working flawlessly (both for my main domain and subdomain), I even managed to obtain let’s encrypt certificates for the domain using DNS-01 challange, managed to launch a working gitlab instance on it too.

All changed when I tried to add a wildcard (*) CNAME to my DNS records to further limit required actions in multiple places when adding a new subdomain domain, then it all stopped working - and all I see is error 1002 “DNS points to local or disallowed IP” - but that is exactly the result I wanted to achieve, to allow my domain to point to private address.

How can I resolve this issue, because I want to keep my business with Cloudflare, but if that is not the way - I will have to migrate back to my registrar’s panel and give up on certificates.

PS. As of right now, only my git subdomain has this issue, I can access main domain just as intended (Pings/Tracert also work pointing me where I wanted).

Best regards

What feature, service or problem is this related to?

DNS records

What are the steps to reproduce the issue?

  • Clean out fresh domain’s DNS records
  • Add domain’s record pointing to local address: ex. A 10.0.0.10
  • Add alias: CNAME www
  • Add subdomain: CNAME git
  • Add wildcard: CNAME *
2

The DNS records need to point to your public IP address.

You can have DNS-Only records that point to private IP addresses, but that only works if you use the domain from home.

This would happen if you tried to create proxied records to a private IP, which you can’t do.

2 Likes
3

That did the trick!

It didn’t occur to me that it made no sense, that my subdomain was proxied CNAME while at the same time pointing at a DNS-only record, thank you for pointing that out.

Switched my cnames to DNS only, and it is working again.

Goal was to only allow resolving through specific local network - so it achieves exactly that!

Thank you very much for your time :smiley:

2 Likes
4

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.