# Same domains for local & remote access (Split-DNS + Wireguard) **URL:** \ **Category:** General\ **Tags:** pangolin\ **Created:** [January 25, 2026, 8:09am UTC](https://forum.hhf.technology/t/same-domains-for-local-remote-access-split-dns-wireguard/4212 "2026-01-25T08:09:21Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Floordb](https://forum.hhf.technology/user_avatar/forum.hhf.technology/floordb/32/1694_2.png) [@Floordb](https://forum.hhf.technology/u/Floordb)\ **Post date:** [January 25, 2026, 8:09am UTC](https://forum.hhf.technology/t/same-domains-for-local-remote-access-split-dns-wireguard/4212/1 "2026-01-25T08:09:21Z")
Is it possible to have `jellyfin.example.com` resolve to an internal IP while I’m on my LAN, but use the same domain via Pangolin Wireguard when I’m outside? I want to avoid routing local traffic through the VPS when I’m at home. ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [January 25, 2026, 3:03pm UTC](https://forum.hhf.technology/t/same-domains-for-local-remote-access-split-dns-wireguard/4212/2 "2026-01-25T15:03:48Z")
Yes, you can achieve this with split DNS, where your domain (e.g., [jellyfin.example.com](http://jellyfin.example.com)) resolves to the local IP (e.g., 10.30.30.25 for jellyfin) when on your home LAN, but points to your pangolin-exposed endpoint (via wg tunnel) when outside. this keeps local traffic direct and efficient, avoiding the VPS round-trip. Pangolin handles the external access by proxying the domain through its dashboard-configured resource, which tunnels via WireGuard to your home setup. end-to-end example incorporating your wg/proxmox setup the split DNS integration. I’ll use Pi-hole for the DNS (easy to run in an LXC on Proxmox), assuming your public DNS (e.g., Cloudflare) has [jellyfin.example.com](http://jellyfin.example.com) as a CNAME to your Pangolin resource domain (e.g., [jellyfin.pangolin.yourvps.com](http://jellyfin.pangolin.yourvps.com)). ### Step 1: make sure your base setup works (wg + jellyfin via Pangolin) - Change Pangolin resource upstream to `http://100.89.x.x:8096` (use HTTP, not HTTPS, unless Jellyfin is TLS-enabled internally). - In wg LXC: verify rules with `iptables -t nat -L -v -n` (look for hits on access). test local curl: `curl http://10.30.30.25:8096`. - In pangolin dashboard: confirm the resource is tied to the wg site. test tunnel: SSH to VPS, `docker exec -it gerbil curl http://100.89.x.x:8096`. - Proxmox: make sure LXCs are on the same bridge, privileged for iptables, and no firewalls block inter-LXC traffic. Once external access works (e.g., [jellyfin.example.com](http://jellyfin.example.com) loads via Pangolin from outside), proceed to split DNS. ### Step 2: Set Up Split DNS with Pi-hole in a Proxmox LXC 1. **Create Pi-hole LXC** : 2. **Add Local Override in Pi-hole** : 3. **Configure Your Network to Use Pi-hole DNS** : 4. **Test the Split** : ### Tips and Troubleshooting - **Pangolin-Specific** : If using multiple resources, add more local DNS entries (e.g., for Emby). WireGuard’s PersistentKeepalive=5 helps NAT stability. - **Security** : Block WAN access to Pi-hole (port 53) in your router firewall. Use Pi-hole’s ad-blocking for bonus LAN protection. - **Alternatives** : If no extra LXC, run Pi-hole in Docker on Proxmox host or use your router’s built-in DNS (e.g., OpenWRT’s dnsmasq with `address=/jellyfin.example.com/10.30.30.25`). - **Issues?** : Check Pi-hole query log for resolutions. If external still overrides locally, flush DNS cache (`ipconfig /flushdns` on Windows, `systemd-resolve --flush-caches` on Linux). this single setup gives access: local when home, tunneled via pangolin/wg when away. ---
**Author:** ![Floordb](https://forum.hhf.technology/user_avatar/forum.hhf.technology/floordb/32/1694_2.png) [@Floordb](https://forum.hhf.technology/u/Floordb)\ **Post date:** [January 25, 2026, 4:11pm UTC](https://forum.hhf.technology/t/same-domains-for-local-remote-access-split-dns-wireguard/4212/3 "2026-01-25T16:11:21Z")
Thanks for the long response but I’ve got some questions. Is this possible with Adguard home? And I’m using my unifi router as a WG client connected to Pangolin. I’ve got a Nginx Proxy manager running and have some domains with [radarr.local.example.com](http://radarr.local.example.com) and have a wildcard domain _.example.com pointed at my Pangolin setup. With this setup ill have 2 domains for Jellyfin ; [jellyfin.local.example.com](http://jellyfin.local.example.com) internal and [jellyfin.example.com](http://jellyfin.example.com) external. Internal ive a dns rewrite in Adguard with_ \*.local.example.com pointing to ngnx with a wildcard cert. I cant add a port number in Adguard.. However that’s not great because ill need to switch from urls. Do I need the setup a cname? ---
**Author:** ![Floordb](https://forum.hhf.technology/user_avatar/forum.hhf.technology/floordb/32/1694_2.png) [@Floordb](https://forum.hhf.technology/u/Floordb)\ **Post date:** [January 26, 2026, 5:19am UTC](https://forum.hhf.technology/t/same-domains-for-local-remote-access-split-dns-wireguard/4212/5 "2026-01-26T05:19:53Z")
Thanks! Much easier than I Thought. I didnt know that it was possible to have 2 wildcard certs for the same domain.