Cloudflare Tunnels and NGINX Reverse Proxy Question
reddit / selfhosted

----------------------------------------------------------------------
thraxst · 2023-11-08 14:36

I have been hosting a reverse proxy locally and exposing ports to
allow access to external access to some services. I am switching over
to Cloudflare Tunnels in order to increase security/close ports.

I still have the reverse proxy and my router redirects any local
requests for \*.mydomain.com to the reverse proxy ip.

I have one tunnel that goes to service1.mydomain.com that does not use
the reverse proxy and I want to setup a second tunnel for my reverse
proxy.

What I am trying to understand is it possible to have one tunnel for
service1.mydomain.com and a second tunnel for \*.mydomain.com (where
service1.mydomain.com isnt include) for the reverse proxy?

----------------------------------------------------------------------
Anejey · 2023-11-08 15:54

It'd probably be best to set up separate DNS entries instead of using
wildcard entry, so that it doesn't interfere with the other tunnel.

----------------------------------------------------------------------
thraxst · 2023-11-08 16:02

So just setting up a DNS entry per service pointing to the reverse
proxy tunnel?

- service1.domain.com -> service1.tunnel
- service2.domain.com -> reverse.proxy.tunnel
- service3.domain.com -> reverse.proxy.tunnel
- service4.domain.com -> reverse.proxy.tunnel
- service5.domain.com -> reverse.proxy.tunnel

----------------------------------------------------------------------
Anejey · 2023-11-08 16:03

That's how I got it. Works great.

----------------------------------------------------------------------
thraxst · 2023-11-08 20:41

Mind sharing more details on your settings? I have a tunnel from nginx
-> cloudflare, but am getting errors.

In the tunnel I have a public host name for 'service2.mydomain.com' to
'http://loalhost' which gives me a 'ERR\_TOO\_MANY\_REDIRECTS' error.

If I change the Service to https://localhost or https://localhost:443
I get a 502 error. I have tried this with or without No TLS Verify
enabled.

NPM has SSL certs for all of my services via LetsEncrypt.

----------------------------------------------------------------------
Anejey · 2023-11-08 21:13

I had the same error when I had "Force SSL" enabled through the Proxy
Manager.

Here is an example nginx config for one of my services:

    server {
  set $forward_scheme http;
  set $server         "192.168.0.2??";
  set $port           5000;

  listen 80;
listen [::]:80;

  server_name ????.example.com;

  # Block Exploits
  include /etc/nginx/conf.d/include/block-exploits.conf;

  access_log /data/logs/proxy-host-52_access.log proxy;
  error_log /data/logs/proxy-host-52_error.log warn;

  location / {

            add_header       X-Served-By $host;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto  $scheme;
        proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP          $remote_addr;
        proxy_pass       $forward_scheme://$server:$port$request_uri;
  }

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}


Cloudflare itself should take care of the certificates, so I'd try
disabling LetsEncrypt. That's probably the problem.

----------------------------------------------------------------------
thraxst · 2023-11-08 21:38

Thanks, that seemed to work. I switch to using nginx proxy manager so
unchecking Force SSL worked. I left the certs in there so they still
get used when accessed from inside the network, but Cloudflare certs
when accessed externally.