← Back to Forum
1
Setup & Configuration

LocaltoNet reserved domain with wildcard subdomains behind Nginx or Traefik

Posted by olivia • July 11, 2026

I only ever see the simple one tunnel per app examples, but what I need is one HTTP tunnel landing on Nginx or Traefik and then routing app1, app2, etc to different local services. Before I touch DNS, I want to know if a reserved domain/subdomain in LocaltoNet will pass through wildcard hosts under it, or if it only accepts the exact hostname LocaltoNet issued.

Also not clear on the HTTP details here. Does LocaltoNet preserve the original Host header to the local proxy, where does TLS actually terminate in this setup, and does Nginx/Traefik need any special trusted proxy or forwarded header config for it to behave correctly?

Comments (4)

brooklynperez Jul 11, 2026

It only matched the exact reserved hostname when I tested it, wildcard DNS on my side didn't make LocaltoNet start accepting arbitrary subdomains through that same HTTP tunnel. So if you point *.example.com at it but the tunnel is for foo.example.com, requests for bar.example.com usually never reach Nginx/Traefik at all because the edge rejects them first.

ekennedy Jul 11, 2026

TLS terminates at LocaltoNet in that setup, and my local proxy just saw plain HTTP with the forwarded headers, so for Nginx/Traefik the important bit was trusting X-Forwarded-Proto/X-Forwarded-Host from the tunnel side or everything kept thinking the request was http and generating wrong redirects. So yeah, even if the host matching kills the wildcard idea, the reverse proxy part itself is pretty normal once you treat LocaltoNet as the front proxy.

emilywalker Jul 11, 2026

Set your proxy to use the forwarded client IP headers too, not just scheme/host, because LocaltoNet showed up as the remote addr for me until I trusted it and then rate limits/logs started making sense again. In Traefik that was the bit I almost missed, otherwise the routing worked but all requests looked like they came from one place.

olivia Jul 12, 2026

That client IP bit is exactly the sort of thing I would've missed, thanks. Did you have to allow a specific LocaltoNet proxy IP range in Traefik/Nginx for those forwarded headers, or did you end up trusting everything coming from the tunnel listener on localhost?

×