Can't get my private domain on LAN with SSL to work. What am I doing wrong? reddit / selfhosted ---------------------------------------------------------------------- Illuminated_Humanoid · 2023-10-16 00:00 Hi, Got tired of using IPs and ports and the lack of internal SSL certs, so I decided to finally make the time to work on this. I found many guides and tutorials on this and decided that I would go the route of using Cloudflare for DNS and NginX Proxy Manager for the Proxy and SSL part. I feel like I did everything as I should, and so far I cannot get the domain to work on my LAN. Here's what I did. * Signed up a new domain on Cloudflare * Set two DNS entries in Cloudflare. One 'CNAME' entry with the domain name and one 'A' entry with the LAN IP of my NAS that hosts all my stuff. * I then set up an API token on cloudflare that gives DNS editing privileges for the domain in question. * I went into NginX Proxy Managers 'SSL certificate' tab and created an SSL certificate for the domain and any of its subdomains. I entered the cloudflare API token in here for this to work. * I went into the 'Proxy hosts' sections in NPM and made one entry for my main domain to point to my main NAS. After running the above steps all with what appears to be success, I would imagine when entering my domain that it would point me directly to the NAS login page, but nothing happens. What am I missing or doing wrong here? ---------------------------------------------------------------------- Octa_vian · 2023-10-16 00:24 Does opening the website via IP work? Direct connection from LAN or (as i guess) via the proxy (from LAN as well as external)? Any differences there? ---------------------------------------------------------------------- Illuminated_Humanoid · 2023-10-16 00:28 I'm not sure if I exactly understand what you're asking. You'll have to excuse my ignorance, as I'm very new to this. ---------------------------------------------------------------------- PumaXCS · 2023-10-16 00:37 Follow this YT tutorial that does exactly what you want using the same apps. If it still doesn't work post timestamp of where you are getting lost https://youtu.be/qlcVx-k-02E?si=C2qIEpWjYen3llyR ---------------------------------------------------------------------- Octa_vian · 2023-10-16 00:38 Before you try to connect to the NAS via proxy with working DNS and SSL, split the issue up: Try to connect using the IP, figure out what works and what does not and go from there. If you can access the NAS login using an IP in the URL it's a DNS-issue. If it works with the hostname in the URL but you get a cert warning, everything works apart from SSL. From what you said in the OP, i imagined following setup in your LAN, or at least that is how traffic should flow: Router nginx proxy NAS I guess it's a good start to check from where you're able to connect to your NAS using IPs only. Like accessing it directly from LAN, if that doesn't work you have the issue right at the root. If that works, try to connect the NAS using the proxy. If that doesn't work your config there is wrong. ---------------------------------------------------------------------- Illuminated_Humanoid · 2023-10-16 00:45 This is exactly the tutorial I followed. I followed it exactly as described, so that's why I am confused on where I went wrong? ---------------------------------------------------------------------- Illuminated_Humanoid · 2023-10-16 00:47 When you say try to connect first with the IP, you mean my LAN IP for the NAS? Yes, that IP address works fine. When I enter the hostname, it gives me the typical error in Firefox "hmm, we're having trouble finding that site" ---------------------------------------------------------------------- PumaXCS · 2023-10-16 00:56 Based on the steps you listed I assumed so. The A record should be named your domain and pointing to your IP. The CNAME should be a wild card "*. Domain. Com" pointed to your domain. Both of these entries should be turned off for proxy and DNS only in cloudflare. ---------------------------------------------------------------------- Illuminated_Humanoid · 2023-10-16 01:01 When you say A record should be pointing to my IP, do you mean my NAS IP where my service is hosted on that I want my domain forwarded to or my static public IP of my home network? The rest of it I understand, have it down as it should. ---------------------------------------------------------------------- PumaXCS · 2023-10-16 01:06 The IP of the nginx proxy. We want the request to go to the proxy to be forwarded to the entries created in there. ---------------------------------------------------------------------- Illuminated_Humanoid · 2023-10-16 01:07 The only difference in my setup compared to the YouTube tutorial creators is that I have my docker in my Synology NAS. That said, the IP I am using is my NAS IP but without the port number. The port number is what dictates what service is loaded in my NAS. ---------------------------------------------------------------------- ZFCD · 2023-10-16 01:14 It's possible your router does not allow hairpin routing. This happened to me, so I worked around it by manually adding the IP and hostname to the windows host file located in: C:\Windows\System32\drivers\etc ---------------------------------------------------------------------- Illuminated_Humanoid · 2023-10-16 01:15 I don't use windows. I am using Linux on my desktop and my server is running DSM which is also linux by Synology. ---------------------------------------------------------------------- PumaXCS · 2023-10-16 01:16 There isn't an issue with them sharing IPs aslong as the same IP you are using to access NPM is the same IP for the A record the domain is set to use. Regardless of the other steps for ssl certs you should be able to access these with a warning popup if the records are set correctly. ---------------------------------------------------------------------- ZFCD · 2023-10-16 01:20 It's the exact same process in linux. Just find the location of your hosts file on your desktop and add the IP and hostname ---------------------------------------------------------------------- Illuminated_Humanoid · 2023-10-16 01:20 Seems like ive done everything right but no luck. Does firewall or port forwarding play a role in this? I have my NAS firewall hardened, and my router is set to block anything with no rules matched. Aside from that, I can't think of any other reason why this wouldn't be working. I was sure to choose the API token instead of key and since it was able to get the certificates issued, that part is fine. It's just the actual internal proxy is not taking me where I want to go. ---------------------------------------------------------------------- Illuminated_Humanoid · 2023-10-16 01:20 But what would my desktop have to do with anything? All this action is happening on my NAS. ---------------------------------------------------------------------- Raj-The-IV · 2023-10-16 01:44 Hairpin routing means traffic that goes out one interface of your router and attempting to go back in on another interface. In your example, your desktop and NAS are on a LAN interface and you’re trying to reach a service going through the WAN interface. Some routers don’t allow this. By modifying your host file on your desktop, you’re telling your desktop to use the LAN IP of the NAS instead of your WAN IP. You could achieve the same if you ran DNS internally on your network (called split-brain DNS). ---------------------------------------------------------------------- ffimnsr · 2023-10-16 01:52 I think it's a bad idea to put a private address (RFC1918 address space) into public DNS. First, it will create confusion and second MITM. Just host your own DNS in coredns/bind/pihole/aadvark than hosting it on public DNS like cloudflare. I mean, it can be done, but it's considered malpractice. Or if you don't want to, just put it on your host file