RBR850 How to support https on local network (NOT remote) with nat loopback

---

RBR850_owner wrote:

So last resort appear to be NAT loopback.

My knowledge on this is low and I've seen some complaints on this forum about setting up NAT loopback which go way beyond my cap.

The poor documentation about this from NETGEAR doesn't help either.
So does anyone know how to do this?

---

Let's start with this: According to Which NETGEAR routers support NAT loopback? your RBR850 (and many others) are supporting NAT Loopback. The design of a NAT Loopback is that you can operate a server on the LAN, while having it accessible over the LAN -and- the public IP address. The idea is that you have a URL like https://your-magic-home.assistant.me[:port] which does resolve on the LAN to the LAN IP address of your home automation server address, while resoling the same from the wild Internet will point to the public IP address of your Internet connection, assigned to your router WAN/Internet-Port.

---

RBR850_owner wrote:

So I want to secure the communication to my home assistant (webserver) on the local network.
I don't want to expose my home assistant to the outside world.
I can get a domain and lets encrypt cert but of course this would resolve to my public ip, which does not work on the local network unless you allow traffic from the internet to get access to your local home assistant. I don't want this!

---

Operate your home assistant as a https server, for the sake with an Let's Encrypt Cert, but only on the LAN respectively the LAN IP. The certificate is signed for a hostname, and FQDN, not for an IP address. It's irrelevant on which IP address you are operating the server. 

---

RBR850_owner wrote:

Unfortunately the RBR850 does not allow me to register and route local traffic for my home assistant url.

---

Curious where this idea is coming from. Routing (NAT, whatever, ...) is done based on IP addresses, never based on an URL.  

---

RBR850_owner wrote:

Nor does the RBR850 allow to set a DNS server of my own (wtf).

---

At some point, you might need your own DNS server (, or two): One for your LAN, and one for the Internet side of things. This could be implemented in split tunneling. However: Appears you don't want this at all, so no DNS for the internet side required. 

Coming back on the URL https://your-magic-home.assistant.me[:port]

To resolve this URL embedded hostname (FQDN) like your-magic-home.assistant.me for systems on your LAN, a simple local DNS server is sufficient, your-magic-home.assistant.me does only have to point to your LAN IP address, somewhere within a RFC1918 Address Allocation for Private Internets subnet. This could be the whatever LAN IP your router is defaulting to, or you head to some more security by obscurity, and used whatever correct RFC 1918 subnet you want. Keep in mind, these consumer class routers have limited resources, and your subnet can't exceed 256 IP addresses (254 workable), for example in the 192.168.1.0/24 subnet.

Beyond me, why you talk about implementing a NAT loopback ... because you never want any port forwarding, and even less access your fancy home-automation system from abroad. (why ever).

Keep in mind operating your fancy new home automation system as a https server does not make it more secure.

Interesting project, but certainly a longer learning curve involved. Good luck!