Accessing services externally - having trouble reddit / selfhosted ---------------------------------------------------------------------- S7ewie · 2023-10-31 08:56 I'm new to self hosting and home labs in general and I'm trying to understand how I can make some of my services accessible outside my network. At the moment I'm just experimenting with my Synology NAS (I know they have QuickConnect), but eventually I want to do it with JellyFin, Game Servers, NextCloud and various other things. My main priority is security. I know there's multiple ways of doing this and I've watched a bunch of different videos but I'm struggling to get it working so I'm trying to understand the steps a little better. Here I'm attempting to use NGINX as a reverse proxy with Cloudflare. 1. I have my own domain name. I purchased it from Namecheap and I've set it up to use Cloudflare nameservers (for this, i'll just use **example.net**) 2. In Cloudflare DNS settings, I have two records: (To my understanding, this should point my domain name plus any subdomains to my router) 1. Type: A Name: @ (acts as root, so my root domain name e.g. example.net) IPv4: My public IP address Proxied: Yes TTL: Auto 2. Type: CNAME Name \* (acts as wildcard) Target: My domain name (e.g. example.net) Proxied: Yes TTL: Auto 3. Now, I believe this will route all traffic to my router but my router won't let it in, so I need to forward the correct ports.. I think this might be where I'm getting things mixed up. **NGINX** is running in a docker container on **192.168.0.15** with published ports: 40080:80 40081:81 40443:443 So on my router, I'm allowing all inbound traffic on 40080 and 40443 and directing to 192.168.0.15. Which I "think" routes traffic to my home network to NGINX? Though I might have misunderstood how that works. 4. In NGINX I've set up a Let's Encrypt SSL certificate for domains example.net and \*.example.net and I've set "Use a DNS Challenge" using Cloudflare and the token I copied earlier. That adds successfully so I assume that worked. 5. Finally I go to "Add Proxy Host" and add a domain called nas.example.net and forward it to http 192.168.0.2 (my nas) with port 5000. This is what I can use to access the interface locally. So that's what I'm doing, and what I'm getting as a Cloudflare Connection Timed out Error 522 so something's not working somewhere but I'm not sure where. I also tried opening ports 80 and 443 on my firewall and directing traffic to [192.168.0.15](https://192.168.0.15) and I get a 521 server down error which I'm not sure whether is an improvement or not? I imagine it's just my misunderstanding one of the steps, likely around which ports I need to forward but I've tried all sorts and I'm not getting anywhere. Apologies for the long post. Any help? ---------------------------------------------------------------------- Eirikr70 · 2023-10-31 09:26 Have you configured [nas.example.net](https://nas.example.net) as a subdomain in your NGINX configuration files ? If you are security-conscious, I recommend that you also set up a Crowdsec container (intrusion detection system) in addition to your system. ---------------------------------------------------------------------- shadoodled · 2023-10-31 09:28 > So on my router, I’m allowing all inbound traffic on 40080 and 40443 and directing to 192.168.0.15. Route inbound traffic on port 80 to 192.168.0.15:40080 and 443 to 192.168.0.15:40443 ---------------------------------------------------------------------- Sajberspejs · 2023-10-31 09:45 I wouldn't expose ports like that. If security is a concern I would go with something like Nebula. https://m.youtube.com/watch?v=94KYUhUI1G0 If you look into it, you can host your lighthouses for free using Oracle Free Tier. ---------------------------------------------------------------------- S7ewie · 2023-10-31 09:49 I'm not sure my router lets me to that? I have to set up a "Service" Separately where I give it a name and choose a start and finish port, then I set up a firewall rule for this service. I had two services set up, one with Start and Finish 40080 and one with Start and Finish 40443. Am I misunderstanding this? Should it be Start 80 and Finish 40080? (and Start 443 and Finish 40443? [Services](https://imgur.com/a/czjbrPM) (i don't know why that's getting flagged as mature.. its not) [Firewall Rules](https://imgur.com/a/0gW59bL) I have just tried that however and I get the same Server is Down 521 error that I got with just rules for 80 and 443. Is this a step in the right direction? ---------------------------------------------------------------------- patg84 · 2023-10-31 09:49 Simplify it first: Go to "ipchicken.com" and write it down. Make sure the service you want to connect to on your nas is running. I'm assuming you're able to log in to 192.168.0.5:80 and it possibly redirects to 192.168.0.5:443. If you can be on your network and access either one via chrome or firefox, or whatever, keep reading. Assuming your setup is like this: Modem --> router --> switch --> nas Modem --> router --> nas If it's either one, open port 80 and 443 on your router and tie it to 192.168.0.5. Go here: https://portchecker.co/ Pop in your IP and test for port 80 then 443. If one or both are closed, you've got bigger issues. Restart everything first. Modem then router. If the ports are open after the reboot, then start complicating your set up. ---------------------------------------------------------------------- S7ewie · 2023-10-31 10:02 > I'm assuming you're able to log in to 192.168.0.5:80 and it possibly redirects to 192.168.0.5:443. The NAS is on [192.168.0.2:5000](https://192.168.0.2:5000) and yes I can access that on that link. NGINX WebUI is on [192.168.0.15:40081](https://192.168.0.15:40081) and yes I can access that. Setup at the moment is a lot simpler (in theory) as I'm currently using my ISPs all in one router/modem/switch (later planning to change this). So it's literally just: Router [192.168.0.1](https://192.168.0.1) \--> NAS 192.168.0.2 Router [192.168.0.1](https://192.168.0.1) \--> Machine with NGINX 1.9.168.0.15 On [portcheck.co](https://portcheck.co) \- 80 and 443 are apparently closed but 40080 and 40443 are open. ---------------------------------------------------------------------- patg84 · 2023-10-31 10:22 No. They're talking about a range when they say start and finish. Like 20 to 60 will open 20, 21, 22, etc up to 60. Start and finish should be the same port unless you want to open a range of ports. You'd port forward 40080 to 40080 for 192.168.0.15. Then do the same for the other port. Also choose both tcp/udp for now if it lets you to simplify. You may have to make a rule for each, one for tcp and one for udp. Some routers are stupid and don't include both ports at once in the GUI. ---------------------------------------------------------------------- patg84 · 2023-10-31 10:22 My bad, been awake for way too long lol. Ok so if you're getting the green on 40080 and 40443 when tied to 192.168.0.15 then 80 and 443 should be dead. I'm curious, go to cmd prompt on your machine and ping "nas.example.net". Does it come back with your IP you found earlier through IP Chicken? Straight up port forward 40081 on your modem and test that with that port checker tool. If you don't get the login page that you can access from your internal network, bypass cloudflare and retest after like 2 minutes. ---------------------------------------------------------------------- S7ewie · 2023-10-31 11:04 Yeah ok that's what I originally thought, it was a range. So we're back to how the firewall rules were originally set up and now I'm back to getting a Connection timed out error 522. [Firewall Rules](https://imgur.com/a/PWqHvUD) Both ports 40080 and 40443 are open according to [portchecker.co](https://portchecker.co) ---------------------------------------------------------------------- S7ewie · 2023-10-31 11:14 >I'm curious, go to cmd prompt on your machine and ping "nas.example.net". Does it come back with your IP you found earlier through IP Chicken? Hmm no, interestingly it comes back with a completely different IP to my apparent Public IP from [ipchicken.com](https://ipchicken.com) If I put {my public ip}:40081 into directly the browser though I do get to the NGINX WebUI, and I did that using my phone off WiFi so it seems like the ports are open? ---------------------------------------------------------------------- S7ewie · 2023-10-31 11:14 I have to do that separate from the NGINX WebUI? ---------------------------------------------------------------------- Eirikr70 · 2023-10-31 12:35 I don't know the NGINX web UI : I use good old conf files so I can't tell you. ---------------------------------------------------------------------- shadoodled · 2023-10-31 14:05 Traffic from Cloudflare will hit your router on ports 80 & 443. That's why I said 80 should route to your NAS 40080 and similarly 443 to 40443. If you're router doesn't allow that, you may need to just use 80 & 443 on your NAS. change the ports on your NPM docker-compose file to ports: - 80:80 - 443:443 On your router, make 2 port forwarding entries - one with start & end 80 (call it HTTP) and the other start & end 443 (HTTPS). Create firewall entries for both to forward to 192.168.0.5 ---------------------------------------------------------------------- S7ewie · 2023-10-31 14:24 Thank you!! I was mid way through testing this. It suddenly dawned on me whilst eating lunch that I wasn't forwarding the incoming traffic. I don't think my ISP router allows it but i'll be swapping to a Ubiquiti router soon so that should hopefully solve that. I changed NGINX back to the default ports 80:80 and 443:443 and it worked! :D Thank you!