Question about reverse proxy reddit / selfhosted ---------------------------------------------------------------------- hammyexe · 2023-10-06 21:13 so im new at this stuff but how is it possible to use a reverse proxy and still connect for example to my website that is on port 8085 even if that port is closed and i haven't opened it to my router thought to access it from outside it had to be opened and since the port is closed does that make it way safer? also another question; if im using a docker container and want to make a reverse proxy using the localhost why do i have to put the network gateway : the port instead of the actual ip of the container : port? ---------------------------------------------------------------------- N0b0dy_Kn0ws_Wh0 · 2023-10-06 21:25 If your reverse proxy is on bare metal it does not have access to the docker network, so you need to expose ports, and proxy localhost:port. If you have your reverse proxy as a container in docker, joining it to the other container's network, you would proxy container IP:port since both contsi era are on the same network. you could even use the container name instead of IP address when proxying that way. ---------------------------------------------------------------------- hammyexe · 2023-10-06 21:32 If I have 80 and 443 ports exposed is that all the ports I need to have exposed externally; i can just have the rest of the ports for everytthing else exposed internally? Sorry I worded that second question terribly, I mean if I want to use a reverse proxy from a domain to another application in my server which is hosting both the reverse proxy and the other application. I just put the domain and for the forwarded ip; if I put localhost:(port) why does it not work? ---------------------------------------------------------------------- thekrautboy · 2023-10-06 21:34 > still connect for example to my website that is on port 8085 even if that port is closed You cannot. Thats why the port is closed. If you want to circumvent your proxy locally, then you need to "open" the port by mapping it to the Docker host and then accessing it directly through the Docker host IP and the mapped port. > and i haven't opened it to my router thought to access it from outside it had to be opened and since the port is closed does that make it way safer? I have no idea what that exactly means. > if im using a docker container and want to make a reverse proxy using the localhost Using "the localhost"? Again, i have no idea what you mean. > network gateway : the port instead of the actual ip of the container : port? And a third time, i have no idea what you are talking about. Can you simply share a example compose file and base your question on that? Or better yet, ask in the appropriate place, for example in /r/Docker. ---------------------------------------------------------------------- hammyexe · 2023-10-06 21:40 Sorry I typed that too quickly and did not word it properly. What I mean is the only ports that should be exposed externally is 443, and 80 correct? All the other ports just have to be exposed internally because the reverse proxy will redirect it? I don't need to open those ports in my router just through the docker config. Is everything i said correct or am I missing something. For the docker container, I mean if i was using nginx in a docker and it was connected to its own network. The gateway for example would be 172.x.x.1 and the container ip would be 172.x.x.145, If I want to use a reverse proxy from a domain to another application in my server which is hosting both the reverse proxy(nginx container) and the other application(any other container). I just put the domain and for the forwarded ip; if I put localhost:(port) why does it not work? Sorry, hopefully this helps you understand ---------------------------------------------------------------------- FroSSTII · 2023-10-06 21:40 Trying to decipher the your question, I assume you mean how can you website be access even though the port you expose is not open in your router/firewall? You would usually open port 443/80 (hopefully only 443) to the revers proxy IP via your firewall/router, the revers proxy will have entries to the different services and what port to reach them by. For example 8085, which your service would be listining to locally. Because your service and revers proxy are on the same internal network it is able to forward the traffic that it gets to the service. Allowing you to reach as many web services as you would like with only exposing a single port. I am bit confused by your second question, I assume you are looking to know why you need to add the default gateway if you want to use localhost, devices can register their own local domain to your local DNS server (which I assume is also your DHCP server) in order to know who is who, you need to let them know where to look, instead of like 8.8.8.8 (cloudflare) or 1.1.1.1 (google) Hopefully I was able to answer some of what you were looking to know :) ---------------------------------------------------------------------- hammyexe · 2023-10-06 21:43 The first part, yes I completely understand now thank you alot, also another quick question; so when I publish a port in docker, that only exposes it internally to applications/software in the network right? Sorry I didnt understand what you meant by the 2nd answer but here is the question worded better sorry: For the docker container, I mean if i was using nginx in a docker and it was connected to its own network. The gateway for example would be 172.x.x.1 and the container ip would be 172.x.x.145, If I want to use a reverse proxy from a domain to another application in my server which is hosting both the reverse proxy(nginx container) and the other application(any other container). I just put the domain and for the forwarded ip; if I put localhost:(port) why does it not work? ---------------------------------------------------------------------- thekrautboy · 2023-10-06 21:51 > Sorry I typed that too quickly and did not word it properly. What I mean is the only ports that should be exposed externally is 443, and 80 correct? All the other ports just have to be exposed internally because the reverse proxy will redirect it? I don't need to open those ports in my router just through the docker config. Is everything i said correct or am I missing something. Basically yes. I mean if i was using nginx in a docker Please dont call it "a docker"... its a container. Docker is the software you use, or the company who provides that software. But "a docker" is not a thing. > For the docker container, I mean if i was using nginx in a docker and it was connected to its own network. The gateway for example would be 172.x.x.1 and the container ip would be 172.x.x.145, If I want to use a reverse proxy from a domain to another application in my server which is hosting both the reverse proxy(nginx container) and the other application(any other container). I just put the domain and for the forwarded ip; if I put localhost:(port) why does it not work? Honestly most of that doesnt make sense to me. But basically, you do not need to worry at all about IPs and gateways with Docker networking. Its all done automatically. If you have a container like nginx for example and you need to refer to another container that is part of the same network, you simply use the containername as the hostname to connect to it, no IPs, no gateways. Docker does it all for you. And if you use localhost in a Docker setup, it refers to the actual container itself, not like "localhost=Docker host machine" so dont try that. Localhost is always "yourself". ---------------------------------------------------------------------- hammyexe · 2023-10-06 21:54 Ok I see thanks alot for the insight! ---------------------------------------------------------------------- FroSSTII · 2023-10-06 21:57 Correct, by default your router/firewall will block all traffic trying to get in to your network, with the exception it will allow for traffic to come in if you asked for it (if you typed youtube.com in your browser) Youtube server can send the data to your computer, and the firewall will allow it. Ports you expose with docker are only exposed to your internal network, unless you open them on your router/firewall as well. You can ignore my second answer I misunderstood you. localhost is another way of saying 127.0.0.1 its a special address that called a loopback address. From the point view of the container when you use localhost it will try to reach it by its internal IP address of 127.0.0.1 which would lead to the revers proxy itself. What you can add the revers proxy container to the network of the other containers and that would let you use their container name. That would be the best way to go about it. ---------------------------------------------------------------------- hammyexe · 2023-10-06 22:04 [https://github.com/NginxProxyManager/nginx-proxy- manager/discussions/1837](https://github.com/NginxProxyManager/nginx- proxy-manager/discussions/1837) For example here I dont really understand the answer on why using the localhost wont work but you need to use the network gateway, that is what I was trying to ask. >localhost is another way of saying 127.0.0.1 its a special address that called a loopback address. From the point view of the container when you use localhost it will try to reach it by its internal IP address of 127.0.0.1 which would lead to the revers proxy itself. so its basically looping back to the container I think is what I understood, but what ip would I put if I wanted to use my whole machines local ip :then port. But I want to use a static hostname or ip because Its a dynamic ip and it would be a hassle changing everytime ---------------------------------------------------------------------- N0b0dy_Kn0ws_Wh0 · 2023-10-06 22:09 yes you would only need to expose ports 80 and 443 externally. I think you are running your proxy in a docker container. If that is so then in the ngnix container localhost points to the container itself, which is why you point it to the other container's IP to proxy. This is because of docker's default networking configuration where the host is seperate from the containers. Also if you have both containers on the same docker network you do not need to publish ports like 8025, you would only publish ports like 80 and 443 which you would access externally. ---------------------------------------------------------------------- hammyexe · 2023-10-06 22:16 So if I have all of them on the same network I dont need to publish or expose and ports internally or externally, if so is that more secure? ---------------------------------------------------------------------- FroSSTII · 2023-10-06 22:30 Let me try to simplify it, loopback address = localhost = 127.0.0.1 (most commonly) are all ways to reference the IP address of the container (in this case). So if your container IP address is 172.25.46.25 (for example) when you ask NPM (nginx proxy manager) to forward the traffic to localhost:5000 NPM looks at it and points it back to its own 172.25.46.25 address. By default docker network are bridge network, that means that if a container needs something outside its local network it will send the traffic via your server physical network (using its default gateway and DNS server) You have a few options: * Add the NPM container to the network of the other containers than you can use {container\_name:port} ([multi-host- networking](https://docs.docker.com/compose/networking/#multi-host- networking)) what I would recommend you do. * Point NPM to your physical machine IP, because all of your docker containers are on the same machine this will work * Point NPM to the docker network IP address (NPM will use your server physical network to reach it) (I would avoid this one personally) ---------------------------------------------------------------------- hammyexe · 2023-10-06 22:41 Okay thank you alot for your patience i think im going to do the first option. You really helped me understand this stuff thanks again! ---------------------------------------------------------------------- N0b0dy_Kn0ws_Wh0 · 2023-10-06 22:43 You would publish what you need to access externally, i.e. 80 and 443 and the rest the proxying container should be able to access as they are on the same network. I do think that is more secure, at least the way I set it up in my setup I have one network for services that need to be proxied, this works best for services that have seperate compenents like web, db, redis, etc. e.g. I am running caddy as my reverse proxy. I am also running paperless-ngx which I want to expose. paperless-ngx has seperate containers, webserver, postgres, Tika, gotenberg, broker. The paperless-ngx service has a network for all it's containers. I have a network called web which is for services I want to expose using caddy. Only caddy and paperless-ngx's webserver are joined to this network. This means that if there was a vulnerability in caddy, the only access it has is to the webserver component of my paperless-ngx service. ---------------------------------------------------------------------- hammyexe · 2023-10-06 22:48 Oh I think I understand now, but if someone were to access my nginx reverse proxy; like if there were a vulnerability would they have access to all the other containers in the network? ---------------------------------------------------------------------- FroSSTII · 2023-10-06 22:55 Glad that it helped understand the concept better :) Regarding the game server, in theory as far as I understand ngix is able to proxy none https traffic. But you would usually find that there is no need for it, it just adds complexity. Game servers would usually have unique ports(unlike web services)like Minecraft for example using port 25565. If you add a record for MC.mydomain.com in your DNS provider and open the port on your firewall, that should be it. You can connect to it via your domain name from outside your network. ---------------------------------------------------------------------- hammyexe · 2023-10-06 23:09 Okay I see thanks, and sorry but one more thing; so what does publishing a port in docker do/ exposing it. And is there a differnce in forwarding ports via like a computer/linux machine vs a router? ---------------------------------------------------------------------- kuerious · 2023-10-06 23:19 Scenario: (you) Computer A Computer B (server) Web request: PC: (random port) -> requests connection to URL -> http (Port 80) or https (Port 443) + URL (your DDNS or DNS) Internet Router Ports 80 & 443 traffic are all forwarded to the reverse proxy internal to your network. This reverse proxy takes all HTTP\\HTTPS traffic & compares it to a list (you've specified) of internal web servers & the relevant ports (80, 443, non-standard ports, etc.), and so acts as the "intermediary" between "you" and "server". tl:dr A "reverse proxy" = venue coordinator ---------------------------------------------------------------------- hammyexe · 2023-10-06 23:26 Ahh, I see thanks a lot!