Your Firewalla has a built-in DNS server. This DNS server can be used to resolve a domain name, such as firewalla.com, to its IP address. You can also use Firewalla's DNS server to resolve a local domain (that's only significant on your network) to a local IP. If you want to access any devices locally, you can use its domain name.
- Each of your devices will have two names. One is a local domain name, and the other is a search domain name. Both of these can be used together.
## Local domain
% nslookup iphone.lan
## Search Domain
% nslookup iphone.firewalla
What can a local domain name be used for?
- Easily access your LAN devices by a friendly name. For example: use mynas.lan for a NAS storage unit.
What are some valid domains to use?
Please do not use common domain names like .com or .google.com, .co these will cause issues with your network.
As a reference from https://www.rfc-editor.org/rfc/rfc6762#appendix-G, the following top-level domains can be used on private internal networks:
.intranet .internal .private .corp .home .lan
Local domains are configured globally, meaning you can access them from any network segment. They may look something like iphone.lan, mypad.lan, etc. The domain here is ".lan." The domain is configurable, and you get one per Firewalla box.
- The local domain suffix cannot be changed on Firewalla Red, Blue, and Blue Plus. The default domain name is ".lan"
To see your device's local domain: Devices list -> any Device -> scroll down to find Local Domain -> Domain Name
The search domain is specific to each network segment. You can give different networks different domain names, such as mydevice.iot, mypad.home, etc. For example, you could rename your subdomains to .lan1, .lan2, .lan3, etc.
- Search domain is not supported on Firewalla Red, Blue, and Blue Plus.
To see your device's search domain: Network Manager -> any Local Network -> scroll down to find Search Domain
What's the difference?
- Local domain: All devices share the same local domain name. If you change the local domain name on one device, it will change for all devices.
- Search domain: Different local networks use different search domain names, managed by a DHCP service. Changing the search domain on one local network won't affect devices in other networks, but will affect devices in the same local network.
Why local domain requests are forwarded to upstream DNS?
# replace <lan> below with your own local domain
# 127.0.0.2 is just an IP that is not reachable, any unreachable IP is fine.
echo "local=/lan/127.0.0.2" >> /home/pi/.firewalla/config/dnsmasq_local/no_lan_forward
# use stop and start instead of restart to clean up resource correctly
sudo systemctl stop firerouter_dns
sudo systemctl start firerouter_dns