Cloudflare DNS Help reddit / selfhosted ---------------------------------------------------------------------- ChiefLewus · 2023-10-11 22:15 I’m struggling with this subject even after reading and videos. I’m trying to use nginx proxy to expose a handful of services to the public internet. My domain is managed by Cloudflare and I believe I have Nginx setup properly with SSL api from cloudflare. Im struggling to understand the dns settings section of cloudflare. Am I to make an A record with my domain and point it to my public IP? Then enable Cloudflare proxy service. Then a CNAME record would be the subdomain to whatever service I want and then setup properly in nginx proxy? If I don’t have a static IP from my ISP is there a way to automatically update my dynamic IP in Cloudflare so I don’t loose access? I’ve been trying to get this to work for the past two days now with very little success. ---------------------------------------------------------------------- zfa · 2023-10-11 23:15 > Am I to make an A record with my domain and point it to my public IP? Then enable Cloudflare proxy service. Then a CNAME record would be the subdomain to whatever service I want and then setup properly in nginx proxy? That would work just fine. As long as you have the records in Cloudflare DNS and the domain is all set to proxy something in NPM you're good to go. And yes, using a CNAME from the subdomain to your A record is the most elegant way so you only have to update that one IP address as your IP changes. > If I don’t have a static IP from my ISP is there a way to automatically update my dynamic IP in Cloudflare so I don’t loose access? It's a simple API call, or there's lots of 'my-first-script' style project for this on github. To throw something out from leftfield though... if you're going to be using Cloudflare to proxy all your (sub)domains, then if you have a dynamic IP you will be better off using a Cloudflare Tunnel (`cloudflared`) to get online. Doing so solves both the issue of creating your own CNAMEs and updating your dynamic IP record - you simply don't ever do either as Cloudflare will take care of all the record creation and routing of traffic for you. GL. ---------------------------------------------------------------------- ChiefLewus · 2023-10-11 23:20 I guess I need to read more on cloud flare tunnels to truly understand them. It would replace my self hosted proxy manager and point to the ports on my server for only the instances I wanted to expose and be accessed by like service.example.com? ---------------------------------------------------------------------- zfa · 2023-10-11 23:24 You can either point the Cloudflare Tunnel directly to the backend, or point it to the service on NPM and keep that in place proxying to the backends. Whilst the latter seems to duplicate functionality, it does allow you (down the track?) to have local access use the same hostname as public access by simply havnig local DNS entries which have subdomain.example.com hosts pointing to the NPM IP address (instead of getting Cloudflare's IP address from public DNS servers). I would think most homelabber/self-hosters end up with that topology as opposed to having eveything go through Cloudflare even when being access at home. ---------------------------------------------------------------------- ChiefLewus · 2023-10-11 23:26 Thank you! I’ll do a little studying on tunnels and try and implement it. ---------------------------------------------------------------------- zfa · 2023-10-11 23:27 No worries, HMU if you need anything else but the docs are stellar and once you get your head around the concept and have a play I'm sure you'll find it just set and forget. GL. ---------------------------------------------------------------------- chhotadonn · 2023-10-12 05:31 I use Cloudflare tunnel and it works great for all docker containers. Currently, I am trying to set up AdGuard Home DNS-over-TLS, but cloudflare seems to be blocking DoT over the tunnel/proxy. It only works if I add my Public IP as A DNS only record on Cloudflare. But just like OP, I don't have a static IP not to mention nslooup the dns address exposes my public ip. If I use NPM for DoT, will it somehow allow me to access it from outside of my local network without exposing my public ip? ---------------------------------------------------------------------- zfa · 2023-10-12 05:33 DNS-over-TLS isn't 'web' traffic and so won't be proxied by Cloudflare (unless you start moving into paid services such as Spectrum / Proxy anything etc). Cloudflare would proxy DoH though if you enabled that in AGH and used that instead. ---------------------------------------------------------------------- chhotadonn · 2023-10-12 06:05 DoH is enabled, but Android device currently doesn't support DoH through build-in private dns feature. Only DoT is allowed. ---------------------------------------------------------------------- zfa · 2023-10-12 06:11 Ah, yes unfortunately there's no overlap tech between CLoudflare and Android then unfortunately. That's not to say you can't encrypt lookups if you're willing to bolt on extra stuff - e.g. Wireguard on Android with `DNS` set to AGH IP and `AllowedIPs` configured to route those lookups over that link would do this, but we're just sticking on plasters at this point and it depends how much you want encrypted lookups and how much 'extra' you're willing to bolt on to get there. I have similar requirements myself and use somethign akin to that above. GL. ---------------------------------------------------------------------- chhotadonn · 2023-10-12 06:59 Aah, I was hoping to set it without much effort and additional services like wiregaurd or tailscale. Thank you for the info. ---------------------------------------------------------------------- ChiefLewus · 2023-10-12 17:15 So after some more tinkering I’ve discovered my ISP provider does not currently allow 80 and 443 to be open I guess? I’m using a Unifi UDM Pro and have the port forward rules set there. I’m not seeing any firewall setting that would prevent it either. When I check if the ports are open with yougetsignal.com it shows them closed. Also when I attempt to access my domain it shows an error code 522. Looks like a tunnel is my only option if my ISP truly doesn’t allow those two ports to be open? ---------------------------------------------------------------------- ChiefLewus · 2023-10-12 17:15 So after some more tinkering I’ve discovered my ISP provider does not currently allow 80 and 443 to be open I guess? I’m using a Unifi UDM Pro and have the port forward rules set there. I’m not seeing any firewall setting that would prevent it either. When I check if the ports are open with yougetsignal.com it shows them closed. Also when I attempt to access my domain it shows an error code 522. Looks like a tunnel is my only option if my ISP truly doesn’t allow those two ports to be open? ---------------------------------------------------------------------- zfa · 2023-10-12 19:56 Yep, Cloudflare Tunnel will get you working. ---------------------------------------------------------------------- ChiefLewus · 2023-10-12 20:02 Appreciate your help!