Need help with local + Tailscale DNS resolution – Technitium + Nginx Proxy Manager setup

Hi everyone,

I'm reaching out because I’ve hit a wall with my self-hosting setup. Neither AI nor the usual documentation seem to help with my specific issue, so I’m hoping someone here with more experience can point me in the right direction.

I’m not exactly new to self-hosting, but I’ve only recently started trying to set things up properly, following best practices. Here’s a quick overview of my setup and the problem I’m facing:

---

Setup Overview

- Device: Dell OptiPlex running Tiny10 natively
- Installed Software:
  - Native: Tailscale + Technitium DNS
  - Docker Services: Grist, Keycloak, ConvertX, Jellyfin, etc.
- Local access: No issues. Everything works as expected on the LAN.
- Remote access: I’ve been relying on Tailscale, and it *was* working fine...

---

Recent Changes

About a week ago, I started moving towards a more “standardized” setup by adding:

- Technitium DNS (with split-horizon DNS)
- Nginx Proxy Manager (for reverse proxy + HTTPS)

That’s when things got tricky. My goal is:

> When accessing `mylocaldomain.internal` locally, it should resolve to the 'LAN IP'.
> When accessing it via Tailscale, it should resolve to the 'Tailscale IP'.

Technically, I *did* manage to configure DNS resolution correctly. When I run:

```bash
nslookup mylocaldomain.internal 192.168.1.10
nslookup mylocaldomain.internal 100.64.1.10
```

…it resolves as expected. But despite that, I just can’t get remote access to work reliably. It feels like my DNS settings aren't being respected by Tailscale or my network adapters (Wi-Fi/Ethernet).

---

Technitium Config (Simplified)

- Split-horizon DNS enabled
- Tried both 'primary zone' and 'conditional forwarder zone' — same results
- Static 'A records' work locally
- 'APP records' look like this ('@' and '*' records):

```json
{
  "100.64.1.1/24": ["100.64.1.10"],
  "192.168.1.1/24": ["192.168.1.10"],
  "127.0.0.1": ["192.168.1.10"]
}
```

– and technically these resolve correctly, too (tested with `nslookup`).

- I’m *not* using the global config.
- 'SOA and NS records' were automatically generated by Technitium. I initially left them as-is, and later modified the NS record’s IP to match my server’s local IP (from my router) to see if it would make a difference — but unfortunately, I didn’t notice any improvement in either case.

---

Reverse Proxy (NGINX Proxy Manager)

- I have several entries like:
  `dns.mylocaldomain.internal → mylocaldomain.internal:5380`
- Only using HTTPS (with `mkcert` self-signed certs) for services like Vaultwarden and Heimdall
- These work fine locally

---

What’s Going Wrong

Despite the correct resolution with `nslookup`, I can’t access my services over Tailscale. DNS lookups don't seem to work unless I manually specify the DNS IP, and even then I often get 502 errors, or the connection simply times out.

Other observations:

- When I set my server IP as the DNS on a client, `nslookup` shows either `hgw.local` or `unknown` as the DNS server — unless I explicitly define it in the command.
- I *don’t* want to mess with my modem/router settings if possible.
- I *don’t* have a public domain — everything is local/private.
- My self-signed certificates are trusted on my devices.
- Firewall shouldn't be an issue — I’ve checked rules on both the OS and the router, and nothing seems to be blocking the traffic.

---

I know this is a long post — thank you for reading this far! If there's anything obviously wrong in my approach or configuration, I’d really appreciate any insights, ideas, or guidance.

Thanks again 🙏