Cloudflare question reddit / selfhosted ---------------------------------------------------------------------- Fireman86336 · 2023-12-24 19:35 So I'm new to this. I currently have a few containers setup and connected through portainer. I have ddns setup with cloudflare and have a container with cloudflare to communicate my dynamic ip. Through my Verizon modem, I have port 443 forwarded to the ip of the containers. I feel like I'm missing one part to this as cloudflare and connect by I cannot get to my internal network. Any help would be greatly appreciated and this is my first attempt at self hosting. ---------------------------------------------------------------------- Waddoo123 · 2023-12-24 19:45 Are your containers running with their own dedicated IPs on the same LAN network or bridged? ---------------------------------------------------------------------- Fireman86336 · 2023-12-24 19:47 I currently have them all bridged. I'm not sure how to assign them their own IPs. ---------------------------------------------------------------------- Waddoo123 · 2023-12-24 19:51 Are you running Nginx in-between? I think the issue is, cloud flare gets to your homes IP, your router sends the data to the servers local IP address, then stops. The bridged IPs of your Dockers I believe are local to the docker network on the server. ---------------------------------------------------------------------- VviFMCgY · 2023-12-24 19:51 You want to setup a reverse proxy locally first ---------------------------------------------------------------------- LexSoup · 2023-12-24 19:53 In your case you’d be easier of installing cloudflared tunnel in a docker container (it’s free). Close port 443 and let cloudflared handle the traffic, there are plenty of youtube videos to explain the setup, it shouldn’t take more than 10-15 minutes. ---------------------------------------------------------------------- Zeal514 · 2023-12-24 20:13 Are each container's IPs different, or are they all on the same server? Typically, for dynamic IPs, use DDNS and link your domain to it: - A Name record: DDNS IP, mydomain.com - CNAME record: *.mydomain.com, mydomain.com Then, configure your router to direct traffic on specific ports to your server, like: WanIP:443 forwards to localserverIP:xxxx Consider using a reverse proxy to handle SSL certification and host multiple apps on a single server: WanIP:443 forwards to reverseproxyip:443 forwards to serverip:XXXX With a reverse proxy, you can route traffic to various containers using subdomains, e.g., vault.mydomain.com to local IP 10.0.40.5:8282. When using Cloudflare, ensure SSL encryption mode is set to Full (strict) to avoid SSL mismatches. ---------------------------------------------------------------------- Common-Web-3347 · 2023-12-24 20:19 You want to forward port 443 against your public IP on your modem. Not your local container IP. ---------------------------------------------------------------------- stephenc01 · 2023-12-24 20:56 This. Do not forward over the internet use cloudflared as part of your container network ---------------------------------------------------------------------- shoesli_ · 2023-12-24 20:58 The easy way is to install Cloudflare tunnel in Docker. The other alternative is using a reverse proxy like Traefik but it is a bit tricky to set up ---------------------------------------------------------------------- DisasterClean185 · 2023-12-24 21:01 That's exactly what I have done, the best way for the docker containers. ---------------------------------------------------------------------- Fireman86336 · 2023-12-24 21:08 Each container is setup on Bridge and getting a IP of [172.17.0.0](https://172.17.0.0) Should i setup each container with a separate IP? I can get to each of them via the host ubuntu server via the port number assigned On cloudflare i have : A record \*.domainname.com points to my dynamic IP from verizon A record [domainname.com](https://domainname.com) points to my dynamic IP from verizon On my verizon modem i have service: nginx Original port: 443 Protocol: TCP Internal address: [192.168.1.203](https://192.168.1.203) Forwarding port: 4443 As for reverse proxy, i have my cloudflare doing what you stated. ---------------------------------------------------------------------- Fireman86336 · 2023-12-24 21:10 yes they are all bridged. I cant figure out how to assign each container a IP. ---------------------------------------------------------------------- Waddoo123 · 2023-12-24 21:14 I'm saying you wouldn't want to. I know this is definitely biased towards Nginx, but it may help you understand: https://youtu.be/JKxlsvZXG7c?si=9XfRr_1vuIrwM_kr ---------------------------------------------------------------------- Fireman86336 · 2023-12-24 21:52 I'll give that a view I have nginx running in the same environment as my other containers. ---------------------------------------------------------------------- Waddoo123 · 2023-12-24 21:59 And that's fine. But you want to get the routing from cloudflare to your servers IP, the router port forward to Nginx, and Nginx forward to the dockers name and port from there. ---------------------------------------------------------------------- Fireman86336 · 2023-12-24 22:04 I'll give that a shot later. Is there any good documents/videos to help walk me though it. ---------------------------------------------------------------------- Zeal514 · 2023-12-24 22:09 >Each container is setup on Bridge and getting a IP of [172.17.0.0](https://172.17.0.0) Sounds like they are all on a bridge docker network, but all on the same host machine. So the IP of each container is the host client:xxxx, xxxx being the port that the app is on. So if the server your containers are all on is 10.0.40.5, and the port for the container is 3001, than it's 10.0.40.5:3001. (That's what you want). I assume this cause docker networks tend to be 172.x.x.x, but you might have set your lan to that as well. >On cloudflare i have : >A record \*.domainname.com points to my dynamic IP from verizon A record [domainname.com](https://domainname.com) points to my dynamic IP from verizon You need 1 A name record, that's your domain name, pointing to your public IP, getting updated via DDNS. I named mine, ddns.mydomain.com The CNAME is what you will need for alias's, aka multiple subdomains, you can make 1 CNAME record, and call it *.mydomain.com, and point it to DDNS.mydomaim.com, this way anything you setup with your reverse proxy will be included in the asterisk. I tend to make individual domains, for the services I want to be live outside of my vpn, gives me more control. But it shouldn't matter and is easily changeable. >service: nginx Original port: 443 Protocol: TCP Internal address: [192.168.1.203](https://192.168.1.203) Forwarding port: 4443 >As for reverse proxy, i have my cloudflare doing what you stated. Nginx is your reverse proxy. Cloud flares proxy is just proxying your public IP, that way someone who has your domain, doesn't also have your public IP. Proxys work by kinda funneling all traffic behind a server. So in cloud flares case, when I access your public domain, I go to cloud flares server, and cloud flares server returns me the info on your server, as far as I or any end user knows, your server is on cloud flares server. The reverse proxy does this, but in reverse, so it takes all requests it receives, than sends those requests to the appropriate applications. So in your case, you'd want all of your traffic from your domain, to go to your router, which will then go to your reverse proxy, 192.168.1.203:443 (or 4443, not sure what you mean by forwarding port), your reverse proxy will have the information on your apps. Personally I don't use nginx, I just use traefik. I hear caddy is great too. It's all done through a yaml file, which makes adding a new subdomain as simple as typing a command in your terminal and updating a record if need be, and it also automatically handles letsencrypt SSL certs. Also, gotta stress this. On cloud flare, under your website management, where you entered your DNS records. Go to the side bar, go to SSL/TLS, select full(strict). Not doing this will give you a https failure, and your sites will never load. (This took me like 3 days to figure out, stupid that cloud flare doesn't automatically do this when you select use proxy). ---------------------------------------------------------------------- Fireman86336 · 2023-12-24 22:09 The other issue I have is I have two different sub domains setup Heimdall.xxx.com Npm.xxx.com Both of them point to the same website Heimdall.xxx.com Cant figure out why. ---------------------------------------------------------------------- ajtatum · 2023-12-24 22:20 Depending on your setup, you may need to configure the Security on Cloudflare. For example, I use NGINX Proxy Manager and get Let's Encrypt SSLs and have Cloudflare set to Full Security. If it's not, then I'll get an error message similar to yours. ---------------------------------------------------------------------- habskilla · 2023-12-24 22:24 I have a docker-compose.yml that contains all my apps that are accessed via CloudFlare including the CloudFlare container. They all share one docker network. ---------------------------------------------------------------------- Waddoo123 · 2023-12-24 23:13 You don't need a Nginx subdomain for this. Your Heimdall subdomain in cloudflare should point to your LAN IP. (Your normal domain should as well). Then your router should port forward 80 and 443 and have that traffic routed to your servers IP:(nginx port). Then nginx pointed to Heimdall. I don't think any docs exist because of how each person's setup is unique in some way. I can DM you my wiki but I haven't built out the nginx items yet. ---------------------------------------------------------------------- Fireman86336 · 2023-12-24 23:14 That would be amazing once you get it setup. Any help is appreciated ---------------------------------------------------------------------- Waddoo123 · 2023-12-24 23:15 It'd be faster to DM me and hop on a discord call to explain than have me write up the wiki stuff to get you running. ---------------------------------------------------------------------- Fireman86336 · 2023-12-25 03:29 I installed cloudflared tunnel and turned off nginx and the cloudflare connector. I was able to configure the tunnel and got my first website to load externally. Does the cloudflare tunnel connector tell cloudflare if the dynamic IP changes? ---------------------------------------------------------------------- BoatsFloatOnWater · 2023-12-25 04:18 Doesn’t need to. Works like a VPN instead of ingress through your DMZ. ---------------------------------------------------------------------- SGT911_ · 2023-12-25 19:21 A nice alternative for DDNS can be reverse proxy tunnel, and cloudflare provides with ZeroTrust a reverse tunnel with hub.docker.com/cloudflare/cloudflared I expose all my services with this service, is very simple and fast. ---------------------------------------------------------------------- Fireman86336 · 2023-12-25 19:34 After many hours of troubleshooting, I was finally able to get cloudflared tunnel setup and got my first site externally accessable. Thank you all for all the help. This is truely a great community of people. ---------------------------------------------------------------------- fade2blak9 · 2023-12-25 22:35 This is the way. ---------------------------------------------------------------------- FrumunduhCheese · 2023-12-27 02:20 A compromised Service is a compromised service. Exposing a few ports is fine if you don’t maintain your app/service you’ll get hacked either way. ---------------------------------------------------------------------- stephenc01 · 2023-12-27 03:07 Open ports are susceptible to scanners or generic internet garbage. Cloudflared includes waf and auth as a gate. Defense in depth is the game. ---------------------------------------------------------------------- Waddoo123 · 2023-12-27 18:15 What was the end all issue?