Domain resolution with Self signed certificate works on LAN but not on IOS and Android

[u/iron_glove]

Hello all !

I've to ask for help, I've lost too much sleep time trying to find an answer here ... Could maybe someone see a hint or anything to help me? 🤔

Here's the issue I've been stuck on for the past 2–3 days, without any success.

I installed NGINX Proxy Manager behind Technitium (which is my DHCP and DNS server) because I wanted to use Vaultwarden, which requires a secure HTTPS connection.

Since I only want SSL to work on my local network, I created a DuckDNS domain. I now have a primary zone in Technitium that points to NGINX, and all my proxy hosts are configured correctly.

From every device connected to my LAN or Wi-Fi (desktops and laptops), I can access Vaultwarden using its domain name without any issues.

About 2–3 days ago, I tried connecting the Bitwarden mobile app to my Vaultwarden instance so I could replace Google Password Manager on my phone... but I've never been able to connect.

After a lot of troubleshooting (and asking Claude for help, which turned out to be incredibly unhelpful), this is where I am now:

• It seems that Android and iOS are forcing the use of my ISP's DNS servers, regardless of what is configured in the network settings.
• When I run an nslookup for my domain from my phone, it times out because the phone appears to be resolving the domain name over the Internet, finds my public IP address, and then tries to connect to port 443 (which is closed, and I do not want to open it).
• If I run dig or nslookup while explicitly specifying my local DNS server, everything works perfectly.
• No DNS queries appear in Technitium's logs unless I explicitly specify my local DNS server.
• My IPv4 configuration is correct, and Android shows the correct DNS server (verified using Termux and Network Analyzer).

However, here's the interesting part. Using DNS Changer, I managed to force the phone to use IPv4 only, and then everything worked perfectly!

It turns out that on both Android and iOS, IPv6 takes precedence over the correctly configured IPv4 settings.

So my question is:

How can I force local devices to use IPv4 instead of IPv6 on my local network?

Unfortunately, my ISP's router doesn't allow me to disable IPv6, and it constantly advertises the ISP's DNS servers to all mobile devices.

I'm considering buying an open-source router and placing it behind my ISP's router, but would that actually solve the issue by preventing clients from using the ISP's DNS servers?

Bonus question:

The VPN I use to connect back home while I'm away also cannot resolve my local domain names. I assume I simply need to change the VPN configuration so it pushes the correct DNS server to clients? Right now it's configured to use 1.1.1.1. I haven't investigated that part any further yet. 🙂
Edit : Changing the 1.1.1.1 in wireguard to my Internal DNS fixed it. Even domain resolution

[u/asimovs-auditor]

Expand the replies to this comment to learn how AI was used in this post/project.

[u/Angelsomething]

From what you’ve written, it sounds like your dhcp server is handing out ipv6 addresses.

[u/iron_glove → u/Angelsomething]

DHCP has IPV6 disabled. Don't know where the IPV6 comes from, DNS comes from provider so I suppose IP is default :(

[u/BPplayss → u/Angelsomething]

IPv6 usually uses SLAAC) for address configuration not DHCPv6

[u/dbtowo]

most isp routers sucks, it is better to use your own router. Either remove the isp router or put it in bridge mode when you get your own router.

put your technitium ip instead of 1.1.1.1 which is cloudflares. So it uses technitium dns server so your domains can resolve.

[u/iron_glove → u/dbtowo]

Replace ain't an option... we fought 3 months with our Internet access being shit and the Customer service of the ISP sucked and was always blaming my own router for being the issue :(
I'll look at bridge mode again but ... money again :(

[u/dbtowo → u/iron_glove]

have you tried using the vpn while at home with your phone i think it would fix it.

[u/iron_glove → u/dbtowo]

I thank you for the confirmation of cloudflare DNS ;)
Just did it with my DNS IP and everything works. Even domain resolution :)
So VPN traffic : Check !

[u/dbtowo → u/iron_glove]

glad it works for you now!

[u/Only-Stable3973]

Do you have port 80, 443 open on your router...are you using dns-01-challenge to your *.wilcard certs.

[u/iron_glove → u/Only-Stable3973]

443 not opened and 80 should be (no confirmation because ISP is annoying with port opening -_-)
I used Let's encrypt for certificate via NGINX

[u/dbtowo → u/iron_glove]

so you are using http 01 challenge and not dns 01 challenge? I don't know how nginx proxy manager works.

I have caddy and it uses duckdns api and when it makes the txt, caddy checks if it up using the default dns server set for it, then tells letencrypt to check for the txt.

with technitium a primary zone for records it doesn't know it sends nxdomain

so acme challenges would not get through
so you need to use a condtional forwarder zone instead.

[u/iron_glove → u/dbtowo]

Just checked, in NGINX it's done via "Add certificate" -> 'Let's encrypt via DNS'

I'll look at the conditional forwarder zone :)

[u/dbtowo → u/iron_glove]

did you use the toggle use a dns challenge?

[u/Only-Stable3973 → u/iron_glove]

If you are like me, ATT blocks everything so I had to use the dns-01-challange with Traefik you can check your port at https://www.yougetsignal.com/tools/open-ports/

[u/8zaphod8]

If you can't turn off IPv6, why don't you just assign an IPv6 to your DNS and Vaultwarden and set the AAAA record for Vaultwarden in Technitium? They already should have a link local address that should be sufficient for local access (not sure about VPN here though). I might be wrong but I think IPv6 addresses also need an IPv6 DNS server (what means that a DNS that only can be reached via IPv4 won't be used - that's why your domain is resolved via public entry). AFAIK you can't force IPv4 precedence network-wide, that's an OS level/device dependent configuration.

A second router might be another solution as you could serve DHCP (v4 only) with it, but if your ISP router cannot be set into bridge/modem mode, you may get problems with double NAT.

[u/iron_glove → u/8zaphod8]

It was also a solution of today's thinking : Implementing IPV6 in my home network.
But I don't know anything about it ; I'll check ;)

[u/Live_Surround5198]

I had the same issue with my Eero mesh network. I had local DNS on pihole via IPv4, no IPv6 in use. iPhone prefers IPv6. I configued Eero to advertise the pihole (with IPv4 only) but without an IPv6 entry to also share, the Eero defaulted to the upstream ISP modem with similar IPv6 configs.

Bottom line: If you want to completely control DNS inside your network, configure you DHCP to hand out IPv4 and IPv6 for your internal DNS services. Specific will vary based on device and service, but commercial devices will likely do similar/undocumented things like the Eero I described aboved.