I want to make some services accessible from the ethernet, say my jellyfin instance or something, and some to be available locally only (traefik dashboard, proxmox).

Is there any way to make it so that all *.local.mydomain.com are only accessible from lan? I'm planning to give my local services a local.mydomain.com domain. (traefik.local.mydomain.com, pihole.local.mydomain.com)