this post was submitted on 27 Sep 2025
17 points (100.0% liked)

Selfhosted

51807 readers
639 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
17
Split Tunnel by Domain on Router Level? (lemmy.ml)
submitted 1 day ago by brownmustardminion@lemmy.ml to c/selfhosted@lemmy.world
7 comments fedilink hide all child comments
 

Running pfsense, I was able to route my entire LAN subnet through a VPN. I have firewall and NAT rules that use an alias to filter outgoing connections to specific domains outside of the VPN gateway.

This works great. But here's the problem. Wildcards are not supported within pfsense aliases, and therefore unless you know the specific subdomain for a service, there's no way to reroute services that use rotating or load balancing subdomains.

Surely this is a big problem in large companies. I'm sure they utilize a paid solution to solve this problem.

Are there any solutions for self hosting that are FOSS or within pfsense?

you are viewing a single comment's thread
view the rest of the comments
[–] frongt@lemmy.zip 9 points 1 day ago (1 children)

What exactly are you trying to split out? Generally, routing is done at the IP level, not by name.

[–] brownmustardminion@lemmy.ml 3 points 1 day ago (1 children)

There's a few apps I need to split out. Top priority is the signiant app which according to their documentation requires various AWS subdomains as well as their own. Specific subdomains are not specified and are implied to change regularly/on demand.

In an ideal world I would do my split tunneling on the device itself, but I don't trust Windows and thus I run my VPN at the router level.

This isn't a problem for most things, but I need to utilize my full bandwidth to transfer large files to clients in a timely manner, and a VPN becomes a massive bottleneck.

Pfsense lets you alias by domain name (I believe it regularly resolves down to an IP and uses that for filtering), but again, you need to supply the exact subdomain.

Just wondering if there's an alternative solution to this issue. If it's external to pfsense that's not the end of the world.

Worst case scenario, I would set up a dedicated Linux box or maybe even a VM which could share access to the file transfer NAS and split tunnel the entire box around the VPN. Definitely less convenient.

[–] frongt@lemmy.zip 3 points 23 hours ago

Can you configure those apps to use a proxy? You could set up a tiny little VM or container that has direct access, and upload through there.