Problem with Reflection DNS and work local services

[SektorCT]

Hello everyone.
I am a recent Opnsense user and was very surprised by the capabilities of this system.
But I encountered a number of difficulties with the settings, I would like to understand where I am make a mistake.
Below I will attach a description of slightly detailed problems and what I am trying to solve.
Plus I am attaching screenshots of all those places that should make my settings in the system clear.
I also tried to do Reflection DNS according to the documentation, reflection and chose the very 1 method.
I hope for feedback on my situation.

What I'm trying to implement:

• 1. When accessing the domain name (authentik.name.com) from the Internet, we get access.
• 2. When accessing the domain name (authentik.name.com) from the local network, the router does not let us into the Internet and see it in the local network.
• 3. DNS requests are processed by the local Adguard. It is also the default server.
• 4. When connecting a client in the local network, it receives the IP addresses of the DNS servers and the router from Opnsense.
• 5. Services can normally access the Internet. (for example, checking for their updates)

Problems:

• When accessing the name authentik.name.com from the local network, the request goes to the Internet, the local IP is not detected.
• When accessing the service qbittorrent.name.com, the service is not detected. It can only be opened by its IP address and port.
• The router automatically distributes the DNS addresses of the adguard servers and its own, but it is not listed.
• Neither the services nor authentik in particular can check for their updates. Truenas cannot update the catalog. (They cannot go online?)

[SektorCT]

For some reason, screenshots are not attached.

[SektorCT]

I thank in advance those who responded to my post

[Fabian Wenk]

As far as I understand your OPNsense is using AdGuard as resolver for your local internal network.
The setups I have done the Unbound DNS service is in use. There is the possibility to use the Override to let some hostname from an also public domain resolve to the internal private IP address. Does AdGuard not provide something like this?