How do you use a reverse proxy conveniently over VPN or using your local network? reddit / selfhosted ---------------------------------------------------------------------- RasenChidoriSS · 2023-11-13 04:30 I've got Nginx Proxy Manager set up and it's working wonderfully. However, I have some services I want to be able to access via reverse proxy, so I have SSL and can use a hostname to direct me to a service, but I only want to be able to access them via VPN. My best idea to make this work is to configure access so that only connections from my local network can access certain proxy hosts. This gives all external traffic a 403 on connection attempt. Is this the best or only way to go about it? Short of additional services such as Authelia and Fail2Ban of course, but I wanted to know if I have the right idea. ---------------------------------------------------------------------- audero · 2023-11-13 05:14 What are you trying to do exactly? You don’t need to reverse proxy services you want to access only via VPN. ---------------------------------------------------------------------- RasenChidoriSS · 2023-11-13 05:56 My goal is that I’d like to access services using “sub.domain.com”, but of course, I only want some of those accessible via the internet. For some subdomains, I’d only want to be able to use them on my local network or when connecting via VPN. ---------------------------------------------------------------------- zfa · 2023-11-13 06:12 Not sure I follow but if you're doing what I think you're doing you could simply just have two proxies - one for internal access and one for external access each with their own set of proxied hostnames. You obviously only expose the latter on your public_ip:443 port forward and ensure you don't have your more private services defined on it. Alternatively you could use the oft-overlooked `geo` in your nginx config, assuming NPM exposes it (don't use it so not sure). e.g. geo $public { default 1; 192.168.0.1/24 0; # internal subnet(s) 192.168.1.0/24 0; # also include your vpn subnet } You can then use have any 'restricted host' proxy config check `$public` and skedaddle before proxying the private services if access is not from an internal/vpn subnet, eg: if ($public) { return 302 https://www.example.com; } ---------------------------------------------------------------------- Eastern-Ad7222 · 2023-11-13 06:27 You can, i also do this: So i have sub.dom.com pointing to a public ip generatin certs with http01 using proxy manager. Then i have sub.priv.domain.com pointin to a PRIVATE ip an generatin certs with DNS01, this way, the dns will point to your private ip and only work when you are connected to vpn. See more here: https://youtu.be/qlcVx-k-02E?si=ZkhRwlG9Qh4EMCN7 ---------------------------------------------------------------------- ElevenNotes · 2023-11-13 06:30 Yes, sure he does. A reverse proxy adds TLS termination, so you have nice certs on all your endpoints that don’t use certs or don’t even provide TLS encrypted services. It also adds middlewares and much more, so, yes, he does not a reverse proxy, basically every webapp should only be run via reverse proxy and most TCP or UDP applications too. The benefits outweigh the cost. ---------------------------------------------------------------------- ElevenNotes · 2023-11-13 06:32 Use LetsEcnrypt with DNS challenge, so you can get certificates for your domain without opening a single port for access. [My](https://hub.docker.com/r/11notes/certbot) image provides that via RFC2136 enabled DNS. ---------------------------------------------------------------------- Frozen_Gecko · 2023-11-13 08:19 It's exactly what I do and works great ---------------------------------------------------------------------- wryterra · 2023-11-13 10:08 Yes this is how I do things. I run two instances of nginx proxy, one public facing and one private. External requests are routed to the public proxy and my local dns has CNAME records for all the domains my services run on forwarding to the internal proxy. That way I have a couple of subdomains exposed publicly (Plex, nextcloud and home assistant) thought subdomains declared in my public name server and many, many more on the internal proxy whose domain records exist only on my local dns. ---------------------------------------------------------------------- ImprovedJesus · 2023-11-13 13:38 I also do something similar ---------------------------------------------------------------------- RasenChidoriSS · 2023-11-13 14:21 Thank you! This is the most appealing option to me right now. I’m having trouble understanding how all my internal traffic could be routed via my internal DNS though. NPM listens on both 80 and 443. Is the idea to have NPM listen on 443 and and my local DNS on 80, then I configure my router to use local DNS to route my traffic accordingly? ---------------------------------------------------------------------- wryterra · 2023-11-13 15:24 It's down to having two distinct instances of nginx proxy and control of your local DNS (I use pihole as my DNS provider for local machines, but other DNS servers are available). So you have your public proxy, which for the sake of this example we'll call publicproxy.local, and you have your internal proxy which we'll call localproxy.local. You also have a dns provider, e.g. pihole.local Configure your router to provide pihole.local as the dns server for any client on your local network via DHCP. Then configure your firewall to forward port 443 to publicproxy.local In your local DNS provider configure CNAME or A records for any service you want to be able to access locally that point to localproxy.local. In your external name servers configure CNAME or A records for any service you want to be able to access locally that point to your public IP or DDNS address. For example: Cloudflare has a CNAME record for [plex.example.com](https://plex.example.com) which resolves to your public IP. Requests from outside your network hit your router which port forwards the request to publicproxy.local, publicproxy.local is configured to forward [plex.example.com](https://plex.example.com) to [192.168.0.6](https://192.168.0.6) (where your Plex server lives) pihole has a CNAME record for [plex.example.com](https://plex.example.com) which resolves to localproxy.local. localproxy.local is also configured to forward [plex.example.com](https://Plex.example.com) to [192.168.0.6](https://192.168.0.6). That means whether you request from outside or inside the network you'll end up hitting [192.168.0.6](https://192.168.0.6), success! Now, pihole also has a CNAME record for [sonarr.example.com](https://sonarr.example.com) which resolves to localproxy.local and the proxy is configured to forward [sonarr.example.com](https://sonarr.example.com) to [192.168.0.8](https://192.168.0.8) (where sonarr is in this example). There's no cloudflare record for that subdomain and the public proxy doesn't recognise it. So if you can't hit your public IP with a request for [sonarr.example.com](https://sonarr.example.com) at all, short of having a host file configured to force it. Even if you forced the domain resolution the public proxy doesn't recognise the URL and gives a 404. However, if you were to go to [sonarr.example.com](https://sonarr.example.com) locally you'd see sonarr. ---------------------------------------------------------------------- Deathmeter · 2023-11-14 01:37 I personally run tailscale on my host and a single traefik instance on docker. Anything that doesn't need to be accessed by other people listen to the hostname and get a 100.64.0.0/10 ip whitelist middleware to only allow connections through tailscale. That way a request sent through the public IP with a custom Host header can't be smuggled in and I don't have to deal with custom ports for a 2nd reverse proxy