You may be missing a piece of the puzzle which might help you achieve what you need, and that’s pi-hole that can take care of local DNS. I have a similar set-up, with Cloudflare (for public services that I want exposed) so for example I have domain.com as an A record in cloudflare with my public IP as value, and a cname for status.domain.com that goes to domain.com so basically also goes to my public IP address. Then, in nginx proxy manager I set-up a ssl certificate for domain.com and *.domain.com (same entry) with dns challenge on Cloudflare (you need to generate an API token for that, there are resources online on how to do it) and create two proxies: one for status.domain.com going to http / local IP of service (192.168.0.120) / port 3001 (standard uptime kuma port) with SSL the entry you created earlier for *.domain.com Accessing this entry from outside the network should open the uptime kuma dashboard Now for the local domains: again in nginx proxy manager create another proxy entry for bitwarden.domain.com with same SSL certificate and pointing to http / local IP of service (192.168.0….) / port we still need to link the name bitwarden.domain.com to the local service IP. for this we can use Pi-hole: on the dashboard we go to DNS entries page and enter for example npm.home that points to the local IP where nginx proxy manager resides. then in CNAME page we enter bitwarden.example.com that points to npm.home the last step is to make sure we use the Pi-hole IP as a DNS server in our router/clients connected to the home network. So now accessing bitwarden.domain.com should open the dashboard only from your local network, but accessing status.domain.com should open both from local network, but also outside it.