Help my understand Reverse Proxy and DNS Rewrites. What is happeing? reddit / selfhosted ---------------------------------------------------------------------- geroulas · 2023-12-14 15:44 I'm not a total noob at selfhosting but this network stuff really is messing with my brain.. I have a proxmox server and all my services are **local only**. I have Adguard setup as my DNS server. I have Nginx Proxy Manager setup. I setup **DNS rewrites** on Adguard: uptimekuma.myserver -> [192.168.1.10](https://192.168.1.10) (works when i go to uptimekuma.myserver:3001) jellyfin.myserver -> [192.168.1.15](https://192.168.1.15) (works when i go to uptimekuma.myserver:8096) \*.myserver -> [192.168.1.2](https://192.168.1.2) (NPM IP adress) I would like to go to uptimekuma.myserver **without specifiying a port**. So I set up NPM **Proxy Host**: jellyfin.myserver -> IP: [192.168.1.15](https://192.168.1.15) PORT: 8096 On my Browser this is working great by going to [http://jellyfin.myserver](http://jellyfin.myserver) But when I try it with other services like uptimekuma, proxmox, homeassistant, turnkey file server it does not resolve the adress. What is happening? From what i understant when I type uptimekuma.myserver -> Agduard sees \*.myserver and sends the traffic to -> [192.168.1.2](https://192.168.1.2) nginxproxymanager and this sees uptimekuma.myserver sends it to IP: 192.168.1.15 PORT: 8096... but its not working. If i manualy type [192.168.1.15:8096](https://192.168.1.15:8096) ofc its working as usual. My goal is to be able to do everything locally and be able to reach a service by typing grafana.myserver. If I could add https wihtout messing with online services for ssl certs that would be great as well. I nee that last part in order to get vaultwarden running. ​ ​ ---------------------------------------------------------------------- KD_done · 2023-12-14 16:15 Okay.. I'm gonna skip the SSL part.. cause running a local CA is not difficult, but you will need much less in the end I think. I have questions, but you don't have to answer them here.. they are just for you to figure or have an opinion on. What ever choice you make, if it works for you it's fine (exceptions apply)). Right.. the role of Adguard is passive! It doesn't do anything, except if you ask it information. So, if I would like to know what's behind cookie.myserver, it will give me a reply (and according to your overview, it would be 192.168.1.2. Other than that.. it doesn't do mucht of anything (yes, don't bite my head off.. it does add blocking and such and has more features than my nokia 3303.. I know).. it's a nameserver. If I would ask adguard to resolve jellyfin.myserver, it will give me 192.168.1.15. The non-exact match will always be the last option, never the first. And lets take a look at your proxy server, and this is the part of your explanation that confuses me a little. You are and are not using your proxy server to funny HTTP traffic to the right server. And if your goal is to have all services (like jellyseerrr.myserver and/or sonarr.myserver) pointing at the right spot.. why split it up with direct and non direct traffic? My suggestion as you have an NPM running, funnel everything HTTP related through it. (avoid streams and redirects.. not needed). You do this by only defining what you are going to use towards the proxy server, and avoid the wildcard. You could go for leaving the wildcard and using A records for exceptions.. but that's much more prone to mistakes than the other way around. So, no wildcard, and specifically a list of hosts towards the NPM, and don't forget give the NPM a name to (like proxy.myserver, and point that in NPM to port 81). As soon as you are happy with this.. you can comfortably focus on SSL certs in a local environment. ---------------------------------------------------------------------- RedditSlayer2020 · 2023-12-14 16:44 DNS is not a portmapper, it's a domain name to ip-adress mapper ---------------------------------------------------------------------- geroulas · 2023-12-14 16:45 ofc i will answer your question ;) I run it like this because that was the only way that made sense to me.. I didn't know any better xD I **think** I get almost everything you said, and thanks for the clarifications! The problem is, if I:Delete dns rewrite \*.myserver on AdguardCreate Proxy Host jellyfin.myserver on nginxproxymanagerI cant access the page :/ http:jellyfin.myserver. How does my pc know where jellyfin.myserver is? If adguard (my dns server defined on router) has no idea? Or by that: >You do this by only defining what you are going to use towards the proxy server I have to define everything in both adguard and npm: Adguard DNS rewrites: jellyfin.myserver -> 192..... and also NPM prxy host: jellyfin.myserver -> 192..... port:... ​ >don't forget give the NPM a name to (like proxy.myserver, and point that in NPM to port 81). Ok I put nginx.myserver to dns rewrites on adguard and aslo on nginx itself pointing to port 81... but i dont think this is what you meant xD What does this offer? ---------------------------------------------------------------------- Eisai_Kurosawa · 2023-12-14 19:46 Seems like a DNS issue. if you want nginx proxy to handle your connections you need to point all the domain you motioned to the IP of your nginx proxy. When you accessing your domain via browser, your browser will passing a header to the server, to tell the server which URL i'm accessing. Then, the nginx proxy will route the trafic accrdingly. ---------------------------------------------------------------------- multidollar · 2023-12-14 19:59 You want to do path based routing, sometimes called Application Request Routing. The Reverse Proxy does this job, not DNS. All records point to the reverse proxy and land at port 80 or 443 depending how you’ve done it. Then, the reverse proxy config routes the request based on the path to the backend server. So for example, Wordpress.domain.internal A 192.168.1.200 AnotherWordpress.domain.internal A 192.168.1.200 Would then hit the reverse proxy and route to the required backend host. Each backend target host could be listening on whatever port they want, it will always be port 80/443 because that’s what the reverse proxy does for you. ---------------------------------------------------------------------- geroulas · 2023-12-14 20:35 1. Do I need to put every service to my DNS rewrite? Doesn't \*.myserver do this job for all of them? 2. I did all of this, but some serives work and others dont.. for example homeassistant.myserver returns "502 Bad Gateway". ---------------------------------------------------------------------- geroulas · 2023-12-14 20:49 ok, but doesn't that still require for me to put **\*.domain.internal** point to **** to my Adguard DNS (DNS Rewrites)? If not how will my pc know how to get to .domain.internal? ---------------------------------------------------------------------- multidollar · 2023-12-14 20:52 Well, you need some source of internal DNS resolution. This doesn’t work without it. Also, this won’t really need DNS re-writing. You would be making regular A records on your internal DNS server to support this. All your DNS entries need to point to the Reverse Proxy. ---------------------------------------------------------------------- Eisai_Kurosawa · 2023-12-14 20:53 1. \*.myserver can work only if you delete all more specific entries (like jellyfin.myserver) on your DNS. 2. 502 usually means your NPM is unable to connect to the backend, you may want to check the IP and port of your homeassistant server have been set correctly in your NPM config. For security purposes, some services may need some configuration to allow a reverse proxy, otherwise, it will throw 400. https://community.home- assistant.io/t/home-assistant-400-bad-request-docker-proxy- solution/322163 ---------------------------------------------------------------------- KD_done · 2023-12-14 21:01 Hah :) Fair, and like I said.. you do what works for you.. and if it works, it works. First, let us sort the DNS part.. and follow what I say as long as you can understand what I'm saying, and just let me know where it stops so I can elaborate it a little more. Yes, you read what I wrote correctly. I know, I shouldn't write novels. Let me repeat myself, but put it in different wording. \*.myserver is something I would refuse to use, it is often confusing, especially when you are defining something within the wildcard too. So, I would opt for the removal of the wildcard (\*.mysever). For every service, create a seperate host in Adguard. Avoid possible double pointers, especially in a wildcard. I can explain what I have seen, but it's a total mess because of TTL's. And perhaps I will repeat myself regarding NPM config.. but, that's fine too.. You don't need redirects or streams (have fun with the 404 ;)). So, we are going to define every host we have added in Adguard.. so, jellyfin is going to point to 192.168.1.15 port 8096, for the kuma host (defined in Adguard) a smilar thing. Create a host, point it to 192.168.1.10 port 3001. The management interface of the NPM is on port 81. And ofcourse it's completely valid to add a host like "proxy.myserver" to the NPM itself, and configure the host to point at 192.168.1.2 port 81. Just because you are the admin you are allowed to look at a pretty name for an interface :) ---------------------------------------------------------------------- geroulas · 2023-12-14 21:04 >You would be making **regular A records** on your internal DNS server to support this. I can't seem to find how to do this on AdGuard Home. That's why i use DNS rewrite. **Can you point where on adguard I can add this?** ​ >Your post does actually seem to indicate your DNS entries are incorrect. I dont acctualy use all of these at the same time. I had either jellyfin.myserver, uptimekuma.myserver then I delete all and replace them with \*.myserver ---------------------------------------------------------------------- geroulas · 2023-12-14 21:15 Ok we are on the same page here..! Fairly clear! I only need you to explain what you mean by **create host** on Adguard: >For every service, **create** a seperate **host** in Adguard. You mean create a DNS rewrite (Filters->DNS rewrites->Add DNS rewrite)? Or I create my hosts somewhere else in adguard? ---------------------------------------------------------------------- Lucifer4o · 2023-12-14 21:24 OK. Sorry if you have a response already. Let's clean some stuff up - DNS is only responsible for Name to IP translation. If you want DNS explained in depth , I will send you links. As I see the problem - you need reverse HTTP proxy. (adGuard is off the table after DNS network traffic is modified) Set up Reverse Proxy. Set your A records for all custom port services to point to the Reverse proxy and in that set the IP and port for the target. And that's all. TL; DR - Use DNS for web, set up reverse proxy for IP:PORT ---------------------------------------------------------------------- geroulas · 2023-12-14 21:34 Thanks for the responce.. I got to clear some things up with everyones help.. I try to **set A records** on Adguard now.. Is this done on the Custom Filtering Rules? ---------------------------------------------------------------------- Lucifer4o · 2023-12-14 21:46 Wait ... is adGuard your main DNS resolver? If yes ... I don't know... ---------------------------------------------------------------------- geroulas · 2023-12-14 22:04 yes it is! Custom Filtering Rules seem to be the one I was looking for.. Everything looks to be working as intended now! ---------------------------------------------------------------------- KD_done · 2023-12-14 22:04 So, a host is short for hostname, which is in effect a DNS record you add (an A record). You host ([192.168.1.2](https://192.168.1.2)) has a hostname (jellyfin.myserver) pointed with an A record to it. And effing hell.. how dare you Adguard, using terms as "redirect" for a translation.. I get it, but, how dare you Adguard! As you noticed, I had to open up the Adguard manual.. Yes, but, when ever you talk to people about DNS, don't refer to redirects in DNS terms.. ever. The custom filter rules is the way to go, you are correct. That said, as long as you get the correct reply from Adguard, either way works I guess. ---------------------------------------------------------------------- geroulas · 2023-12-14 22:20 Thanks a lot!! You've been very helpful! I was more confsused by the terminology rather than what I had to do! I went to the adguard manual as well, but when you go to Custom Filtering Rules the title is Host Blocklist :/ and i though this is not it :) Anyway.. everything is running as expected now! And more importantly I learn a few more things on the way ! cheers mate! ---------------------------------------------------------------------- KD_done · 2023-12-14 23:28 You're welcome :) If you are curious and willing to learn by opening pandora's box on DNS, let me know.. it's far less dry and stuffy than SSL certs, but quickly as complicated if you loose track. And I'm willing to bet that at least 85% of all RFC's out there are RFC 1035 related, somehow, so it's not a terrible tech background to have. ---------------------------------------------------------------------- thePZ · 2023-12-15 17:39 /u/geroulas At least three of the services you listed all have some quirk to get working with reverse proxy. I am unfamiliar with turnkey stuff so can't speak on that, but this is what I had to do to get the ones I am familiar with working: ## Uptime Kuma: A) Ensure `Trust Proxy` is set to 'Yes' in your Uptime Kuma settings. B) In NPM, ensure `Websockets Support` is ticked on. C) In `Custom locations` define a location with [these settings](https://i.imgur.com/dKt8vBI.png) (Substitute your IP and port that you use to access uptime kuma, ensure the IP is followed by / as shown) D) This may not be necessary for you, but under advanced i use `proxy_hide_header x-frame-options;` in my custom config (needed for Organizr/iframes sometimes) ## Home Assistant: A) You need to define a `trusted_proxy` in your configurations http settings. Below is an example of mine (substitute the IP address with your NPM IP address) http: use_x_forwarded_for: true trusted_proxies: - 192.168.1.2 B) I still have `proxy_hide_header x-frame-options;` set here as a custom config as well ## Proxmox: A) This is access on https by default, so ensure you have https selected in NPM ---------------------------------------------------------------------- geroulas · 2023-12-15 18:06 I figured it out as well after some hours! I though I had it all wrong.. but it was actually these apps I started testing and got all kinds of errors.. Some notes: * As you said, uptime-kuma and home assistant work without *proxy\_hide\_header x-frame-options;* for my setup. * Everyone here recommended not to go with DNS rewrite, but instead create a host list. You do that by going to Custom Filtering Rules on Adguard.