Having issues exposing to the internet reddit / selfhosted ---------------------------------------------------------------------- naxhh · 2023-12-30 09:30 Hi everyone! I'm having some dns/networking fun today. ​ I own a domain, let's say [example.com](https://example.com) ​ In my internal network I use pi-hole for DNS resolution. [example.com](https://example.com) and any subdomain (\*.example.com) points to Nginx Proxy Manager. Everything works fine there, HTTP & HTTPS. ​ Now, most of my services are internal only on npm (accept [192.168.0.0/16](https://192.168.0.0/16), deny all). And a few of them don't have any acl assigned (public) ​ Outside of my network [example.com](https://example.com) is proxied through cloudflare. So a DNS lookup will show cloudflare IP's. In cloudflare I have [example.com](https://example.com) and \*.example.com pointing to my public IP. My router forwards 80 & 443 to my NPM proxy (I even tried DMZ just in case) Checking my ports from canyouseeme seems everything is correct. ​ NPM is configured to show a 404 if a subdomain is not defined. ​ Now into the part I can't fully work out: From the internet. If I try to access a public resource like [home.example.com](https://home.example.com) (homarr) or [cloud.example.com](https://cloud.example.com) (nextcloud) nothing loads. ​ But if I try [madeup.example.com](https://madeup.example.com) where I don't have anything configured I get the 404 page from NPM. ​ So, it seems that I can reach NPM from the outside but after that, nothing goes by. My understanding was that the proxy was making the calls internally so I don't need to expose anything else. But the issue seems that my request can't pass once reaches NPM. What I'm missing? ​ Note: To test from the public I just disconnect my phone from the wi and any subdomain (\*.example.com) point to Nginx Proxy Manager.from the local network (isp doesn't allow that for some reason)point ---------------------------------------------------------------------- baba_janga · 2023-12-30 09:36 Did you tried cloudflare tunnel? ---------------------------------------------------------------------- ExoWire · 2023-12-30 09:47 Is the reverse proxy on the same device as the service? If yes, did you attach the same network to both of them? Is your proxy host 192.168.something or service:12345? Try again with something more simple like a static webpage behind one proxy. Maybe some [guide like this](https://deployn.de/en/blog/ubuntu- homeserver-setup/) might help. ---------------------------------------------------------------------- pavelic179 · 2023-12-30 10:29 Can you show us your nginx conf for one of those services, sounds like something is wrong there ---------------------------------------------------------------------- naxhh · 2023-12-30 10:30 everything is on the same phisical server. All the ones in the example are LXC containers, all of them have an IP on my local network and I can reach them from my PC. As said, locally it works so NPM can reach the lxc containers. I can reach [home.example.com](https://home.example.com) or [192.168.1.100:80](https://192.168.1.100:80) and both works. ​ My only problem is that it seems I can reach NPM from the public network but it doesn't do any hop after that. ---------------------------------------------------------------------- naxhh · 2023-12-30 10:33 didn't know it existed. It seems an improvement, npm can be reached directly only from cloudflare. ​ But I'm not sure how that will fix my issue, I'll give it a look regardless, thanks! ---------------------------------------------------------------------- naxhh · 2023-12-30 10:42 Not a lot to see but here it is. I haven't done any manual config on the conf files just through UI. ​ [https://ibb.co/4Nz5CZp](https://ibb.co/4Nz5CZp) [https://pastebin.com/Y9tCVQLJ](https://pastebin.com/Y9tCVQLJ) ---------------------------------------------------------------------- ExoWire · 2023-12-30 11:41 My question was not clear. Is it the same *docker* network? If yes, you should not enter 192.168.100.123 into the proxy host, but the host name. Can you see the log of NPM? ---------------------------------------------------------------------- naxhh · 2023-12-30 12:14 I'm still unsure of what you are hinting into. ​ I can resolve the domains on my local network. My NPM reaches the container. They are LXC container so there's no "docker network" ​ Both have an IP on my local network, I can reach through IP AND NPM proxy. ​ The only thing that doesn't work is from the outside. So domain.example > Router > NPM > Service ---------------------------------------------------------------------- naxhh · 2023-12-30 12:16 Update: This did indeed works! Which is quite nice but I'm sad I don't yet understand my issue. ​ A follow up question: How do you configure cloudflare in this case? ​ I basically create a tunnel, made the network available [192.168.0.0/16](https://192.168.0.0/16) And then configured services like [cloud.example.com](https://cloud.example.com) goes into [192.168.1.200:8080](https://192.168.1.200:8080) etc... ​ But now I have 2 proxies basically. NPM for local and Cloudfront for public internet. Which means I need to configure both every time I want to add a service that should be public. ​ I tried to make \*.example.com to go into my NPM IP but didn't manage to get it working. any advice? ---------------------------------------------------------------------- pavelic179 · 2023-12-30 14:20 You're right, that looks fine ---------------------------------------------------------------------- naxhh · 2023-12-30 15:46 I was able to make it work through cloudflared using a VPN tunlle into cloudflare. ​ But the current setup skips NPM altogether. Guess it will stay that way until I figure out a way to use npm as the source of truth ---------------------------------------------------------------------- sarkyscouser · 2023-12-30 19:23 Caddy will be the easiest reverse proxy to get set up, try that instead of NPM? Essentially a reverse proxy translates a sub domain e.g. sub.domain.com to an IP and port e.g. 192.168.100:8900 You only need to port forward ports 80 and 443 from you router to your server. ---------------------------------------------------------------------- phlooo · 2023-12-31 15:58 if you have \*.example.com pointing to your external IP then what you're experiencing is likely the (accept 192.168.0.0/16, deny all) rule that blocks you from accessing actual services, before even letting npm show the 404 page. ---------------------------------------------------------------------- naxhh · 2023-12-31 19:59 I see the 404 I don't see a service. Those services are "public" based on npm. I may try adding a custom rule that accepts everything anyway.