2. Domain Name and DNS setup

It is recommended that you use either a local domain name or purchase one that can then be used on your MyFin instance. Using a domain name with either or both a local and remote DNS server, will allow an easier way for users to reach your MyFin instance. It is recommended that you purchase a public domain from a reputable seller (Registrar).

It is important that the registrar have the ability to add DNS entries and have the ability for you to access it via an API. This will allow for the reverse proxy to make DNS challenge calls for SSL creation and renewals.

If your registrar does not allow API access, you can still either link it to Cloudflare to use their Tunnels and SSL certificate. Or you can use the http-01 challenge for SSL certificate creation and renewals (requires opening ports and having portforwarding).

The reverse proxy we will use in this guide (Nginx - Nginx Proxy Manager) supports Cloudflare, so we will be using them in this guide. Please research further in order to make sure your registrar supports DNS challenge, dns registration and if the reverse proxy you will use has the ability to talk to your registrars’ API in order to make DNS challenge calls.

In this guide we will use CloudFlare for the following:

• Domain Name
• Public DNS
• Remote Secure Tunnel (Cloudflare Argo Tunnel) this is optional

For our local DNS server we will use the following:

• Unbound DNS (OpnSense)

You can use any local DNS server that has an option to set domain overrides or registration.

2.1 Domain name purchase#

We have purchased our domain name from Cloudflare, since we will be using their other free products (Tunnel and DNS Challenge) Having everything through them will be the simplest method.

We will use the following domain name in this guide, but please note that we have registered a different domain name and we will be blurring it out and using the following in its place for demonstration purposes:

yourdomain.com

2.2 Local Host Override / Registration (Optional)#

If you have a DNS server or router that supports Host Overrides (also known as Split DNS, or Split-Horizon DNS), you can configure it so that devices on your local network resolve your domain name directly to your server’s local IP address.

For example, when a device is connected to your local network:

yourdomain.com → 192.168.1.250

When the same device is outside your local network, it will use the public DNS record configured with your registrar (Cloudflare in this instance):

yourdomain.com → Your Public IP (or Cloudflare Tunnel)

This means local users connect directly to your server over the LAN instead of routing traffic through Cloudflare Tunnel.

If you do not configure a local host override, devices on your local network will resolve the public DNS record and access MyFin through Cloudflare Tunnel, just like remote users.

Note

Using a local host override bypasses the Cloudflare Tunnel and any Cloudflare Access authentication you may have configured. Local users will connect directly to your Nginx Proxy Manager instance over your local network.

In this guide we use Unbound DNS running on OPNsense, but the same concept applies to many other routers and DNS servers that support local host overrides.

Configuring a Local Host Override using Unbound DNS (OPNsense)#

If your router is running OPNsense with Unbound DNS, you can configure a Host Override so that devices on your local network resolve yourdomain.com directly to your MyFin server instead of using the Cloudflare Tunnel.

Before you begin#

Ensure you know:

Step 1 - Open Unbound DNS#

Log in to your OPNsense web interface.

Navigate to:

Services → Unbound DNS → Overrides

Step 2 - Add a Host Override#

Click the + button to create a new Host Override.

Since MyFin is being hosted on the root domain (yourdomain.com), configure the override as follows:

Note

If you are hosting MyFin on a subdomain such as myfin.yourdomain.com, enter myfin as the Host and yourdomain.com as the Domain.

Click Save.

Step 3 - Apply Changes#

After saving, click:

Apply Changes

Unbound will reload its configuration.

Step 4 - Verify DNS Resolution#

From a computer on your local network, open a terminal or command prompt.

Windows#

nslookup yourdomain.com

Linux / macOS#

dig yourdomain.com

or

nslookup yourdomain.com

The result should show your local server IP.

Example:

Name:    yourdomain.com
Address: 192.168.1.250

How It Works#

Without a DNS Override:

PC
 │
 ▼
Cloudflare DNS
 │
 ▼
Cloudflare Tunnel
 │
 ▼
Nginx Proxy Manager
 │
 ▼
MyFin

With a DNS Override:

PC
 │
 ▼
Unbound DNS
 │
 ▼
192.168.1.250
 │
 ▼
Nginx Proxy Manager
 │
 ▼
MyFin

Traffic no longer leaves your local network.

Troubleshooting#

The domain does not resolve or still resolves to Cloudflare#

Your computer may be using a different DNS server.

Verify your DNS server.

Windows

ipconfig /all

Linux

resolvectl status

or

cat /etc/resolv.conf

The DNS server should be your DNS server in this case the OPNsense router.

Flush the DNS Cache#

After creating the Host Override, clear your computer’s DNS cache.

Windows

ipconfig /flushdns

macOS

sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

Linux (systemd-resolved)

sudo resolvectl flush-caches

Result#

Your network will now behave as follows:

Local users will access MyFin directly over your LAN, while remote users will continue to connect securely through Cloudflare Tunnel.