Issue accessing Synology NAS using Nginx Proxy Manager with Cloudflare
domain
reddit / selfhosted

----------------------------------------------------------------------
Last-Beautiful-3747 · 2023-11-21 22:09

First of all, Apologies for the long message. Thought this would give
a clear understanding of my issue. Please let me know if it causes
more confusion and I will correct it.

#### Issue:

Unable to access my Synology NAS using Nginx Proxy Manager via the
Cloudflare domain name after using it for a while with Synology's
DDNS.

#### Background:

When I first bought my Synology 1621+, the main purpose for it was to
use it as Storage (backups, media and Photos etc.). After that, I
decided to utilize its other capabilities to self-host Plex, Jellyfin,
Bitwarden etc. services in docker. To access them externally, I
created a domain within Synology (using DDNS setup) called
'example.synology.me' and created Let's Encrypt certificates for the
same. Then configured Synology's reverse proxy by creating subdomains
called 'mynas.example.synology.me', 'plex.example.synology.me' etc.,
to access a few of those services externally (including Synology
Photos). It was all working fine.

But since then, I created several docker containers and VMs for Media
Management (like soanrr, radarr etc.), Home Assistant with
Zigbee2MQTT, Frigate, DNS-based AdBlocking and also self-hosting note-
taking apps etc. Now, I have around 25 docker containers managed via
portainer and 4 VMs.

As my Home Lab services expand, I now have a few services I deployed
externally to Synology (brought a few mini PCs with decent
configuration). So, instead of using Synology's DDNS, I would use a
common service like NPM to manage all my reverse proxy requests. I
also purchased a domain in Cloudflare for this.

I started configuring one service at a time and so far Bitwarden,
Adguard, Home Assistant and Zigbee2MQTT are configured in Proxymox
(migrated from Synology) and also able to access them externally using
Cloudflare domain name via Nginx Proxy Manager.

But when I tried to do the same to my Synology NAS, it just did not
work. I am stuck at Bad Gateway (502 Error) when I tried to access it
via an external URL configured to redirect to Synology NAS. Below is
the current workflow:

Added DNS Entry called 'mynas.cloudflare.com' -> Created a Proxy Host
entry in NPM with https://Synology_ip:ssl_port and assigned Cloudflare
Origin Certificates.

I tried to change it non-ssl but still got the same bad gateway error.

#### Observations:

So, started looking at NPM logs and found that there are several SSL
Handshake errors between NPM and Synology as below.

`
*444141 peer closed connection in SSL handshake (104: Connection reset
by peer) while SSL handshaking to upstream, clientt: ***PublicIP***,
server: mynas.cloudflare.com, request: "GET / HTTP/2.0", upstreeam:
"https://Synology_ip:ssl_port/", host: "mynas.cloudflare.com",
referrer: "https://mynas.cloudflare.com/"
`

Also, observed that Synology's local HTTPS URL has a self-signed
certificate attached which points to a certificate generated in past
(i.e. example.synology.me). So I think this could be causing the issue
but I don't know how to avoid it.

Also, when I tried with a non-SSL URL i.e.
http://synology_ip:non_ssl_port, it still gave me a Bad Gateway error
and NPM shows the error as below.

`
*445654 recv() failed (104: Connection reset by peer) while reading
response header from upstream, client: ***PublicIP***, server:
mynas.cloudflare.com, request: "GET / HTTP/2.0", upstream:
"http://synology_ip:non_ssl_port/", host: "mynas.cloudflare.com"
`

Now I am lost as to what could be the issue here. If anyone faced a
similar issue and managed to fix it, any help would be greatly
appreciated.

----------------------------------------------------------------------
ElevenNotes · 2023-11-21 22:27

Make sure you ignore invalid SSL certificate on your backend from your
proxy and make sure your proxy supports websockets, because Synology
uses websockets. Here is a simple example from nginx:

server { ...
    location / {
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_http_version 1.1;
      proxy_pass https://synology:8443;
    }
}

----------------------------------------------------------------------
Last-Beautiful-3747 · 2023-11-21 22:43

Thanks for the response.

Since I use Nginx Proxy Manager, should I add this info to 'Custom
Nginx Configuration' section of the Advanced tab?

And yeah, I enabled Websockets support in NPM.

----------------------------------------------------------------------
ElevenNotes · 2023-11-21 22:50

I’m unfamiliar with NPM, I only use normal nginx.