ingressd
Sign inGet started
Docspreview · subject to change
Docs / Guides / Smart DNS

Smart DNS

Smart DNS sends chosen services, such as a streaming site, out through one of your nodes in another country. Your router forwards those domains to the node, the node resolves them at the exit and relays the connections. TLS stays end to end.

Before you start

You need a connected home and at least two nodes: the home's node, and an exit node in the country you want to appear in. Nodes of one organisation reach each other over a WireGuard mesh on UDP 51900.

How it works#

  1. Your router forwards the service's domains (for example formula1.com and f1tv.com) to the Smart DNS resolver on your node. The resolver listens on the node's tunnel address for your home, such as 100.64.0.1, so only your home can use it.
  2. The resolver asks the exit node to resolve the name from its location, then answers with the home node's own tunnel address.
  3. Your device connects to that address on port 443 or 80. The node reads the server name from the TLS handshake (or the HTTP Host header) and relays the stream over the mesh to the exit node, which connects to the real destination.

The node never decrypts the traffic: TLS runs from your device to the service.

Set it up#

  1. Exits: in the panel, open Smart DNS and add an exit: a node and its country. Optionally, give the exit a WireGuard VPN config so its traffic leaves through the VPN instead of the node's own address.
  2. Services: add a service from the catalog (for example F1 TV) or list its domains yourself, and choose its exit.
  3. Your router: forward each service domain to the resolver addresses the panel shows for your home, one per node the home is attached to. Most routers call this conditional forwarding or a DNS forward zone.

Details#

  • AAAA and HTTPS records are suppressed for routed names, so devices use IPv4 through the relay.
  • Answers are cached and served stale for up to 24 hours if the exit can't resolve, and lookups fail closed rather than leaking to your normal DNS.
  • The node checks that each exit really appears in its country.

Check it#

shellon the home's node
$ ingressd smartdns status
$ ingressd smartdns recent -n 20

status shows exits, mesh peers, relay usage and the country checks. recent lists recent lookups through the resolver: point a device at it, open the service, and use the list to find domains you have not routed yet.

Relay traffic is metered per service and shown on the panel's Usage page.