Reverse proxy help

[jmanko16]

Still very beginner here, so I'm sure this is easy fix but appreciate help with reverse proxy.

I would like my plex, calibre, calibre-web, and audio bookshelf docker to be accessible via reverse proxy. (Up until now using open vpn on devices and then logging into the "local IP") but would like to share books with family members who are even less tech savvy. The best option would seem to be reverse proxy outside home network.

I have a name.synology.me domain, and have this setup. I have also been able to set my netgear orbi router to expose 443, and have been able to access synology apps (photos drive etc) outside the wifi network with https://name.synology.me. I went to reverse proxy and set this up for Plex.name.synology.me and so on for each and set up certificate in let's encrypt. When I am on my local network I have no issue access the site https://plex.name.synology.me, but when I connect remotely I can not access the site https://plex.name.synology.me.

Help!!

 

[Telos]

Share your RP settings, otherwise we can only guess.

 

[jmanko16]

Share your RP settings, otherwise we can only guess.

example below

 

[fredbert]

For the destination are you sure it isn't HTTPS? Also if the the service is accessible on the NAS's own LAN IP then the destination IP can be 127.0.0.1 (localhost). For docker containers that are running direct to the LAN then you use their own LAN IP.

The reverse proxy can work HTTPS to it from web clients and HTTP to the real web service, but that service does have to be listing on HTTP.

I have done this for a few web services too, Plex included, and it works.

 

[jmanko16]

For the destination are you sure it isn't HTTPS? Also if the the service is accessible on the NAS's own LAN IP then the destination IP can be 127.0.0.1 (localhost). For docker containers that are running direct to the LAN then you use their own LAN IP.

The reverse proxy can work HTTPS to it from web clients and HTTP to the real web service, but that service does have to be listing on HTTP.

I have done this for a few web services too, Plex included, and it works.

destination is definitely http: as it will not open locally on https.

I tried localhost and thr links no longer work at all.

Interestingly I have been able to get the Plex and Audiobookshelf containers to work locally and remote (but sometimes they fail, almost like safari will sometimes log in and others won't). My Calibre-web won't load at all. Now I'm more confused as I'm getting some to work and others will not.

 

[Telos]

I'm not familiar with that 3rd screenshot, or what it is telling me. I would expect external port 443 to be forwarded to your NAS LAN IP, port 443.

Are you sure 443 is actually open? Have you tested it? Does your ISP allow external connections through 443?

 

[fredbert]

It could be the certificate. Does the certificate include the wildcard *.mynas.synology.me ? And have you assigned this certificate to each remote proxy in Control Panel / Security / Certificate?

I use Calibre-Web and have it in bridge mode so that it's fixed container port is mapped to a NAS LAN IP port. The port on the NAS LAN IP needs to be fixed too, so don't use auto. As I have it it bridge mode the reverse proxy rule destination is set to HTTP / localhost / assigned NAS LAN IP port.

Looking at your DSM setup controlling the router (why do it this way?) the Internet ports are non-standard being forwarded to the NAS on standard ports? I'm guessing it's this way around as I don't use this feature, preferring to configure my router manually.

 

[jmanko16]

I'm not familiar with that 3rd screenshot, or what it is telling me. I would expect external port 443 to be forwarded to your NAS LAN IP, port 443.

Are you sure 443 is actually open? Have you tested it? Does your ISP allow external connections through 443?

Yes I tested and it is open.

-- post merged: 18. Nov 2022 --

It could be the certificate. Does the certificate include the wildcard *.mynas.synology.me ? And have you assigned this certificate to each remote proxy in Control Panel / Security / Certificate?

I use Calibre-Web and have it in bridge mode so that it's fixed container port is mapped to a NAS LAN IP port. The port on the NAS LAN IP needs to be fixed too, so don't use auto. As I have it it bridge mode the reverse proxy rule destination is set to HTTP / localhost / assigned NAS LAN IP port.

Looking at your DSM setup controlling the router (why do it this way?) the Internet ports are non-standard being forwarded to the NAS on standard ports? I'm guessing it's this way around as I don't use this feature, preferring to configure my router manually.

Yes I have all the certificates set.

Calibre web is in bridge.

I had been using router only for port forward but thought maybe I screwed up so tried with the NAS controlling to see if it helped.

 

[jmanko16]

It could be the certificate. Does the certificate include the wildcard *.mynas.synology.me ? And have you assigned this certificate to each remote proxy in Control Panel / Security / Certificate?

I use Calibre-Web and have it in bridge mode so that it's fixed container port is mapped to a NAS LAN IP port. The port on the NAS LAN IP needs to be fixed too, so don't use auto. As I have it it bridge mode the reverse proxy rule destination is set to HTTP / localhost / assigned NAS LAN IP port.

Looking at your DSM setup controlling the router (why do it this way?) the Internet ports are non-standard being forwarded to the NAS on standard ports? I'm guessing it's this way around as I don't use this feature, preferring to configure my router manually.

I did go to my router and manually port forwarded 80 and 443, and have confirmed with my DDNS I was able to see those ports.

 

[fredbert]

OK, so what is working and what isn’t?

From the Internet can you access Web Station main website (if you have it installed)? That would suggest the port forward is working.

From the Internet can you now access the local Plex Media Server website? If you have port forwarded the default 32400 Plex port, does that work? Does the request using the reverse proxy work?

Do you have any DSM firewall that could be blocking connections from parts of the Internet?

 

[jmanko16]

Well big thank you so far.

I started back over from the beginning and only using port forwarding on router for 80, 443 and deleted the others on synology.

I went back and renewed certificates (while the certificate was listed for each page I am wondering if maybe I had missed adding the * to make the wildcards).

I currently have my audio bookshelf, plex working fine.

Current issue is my calibre-web opens on local network and not remote.

 

[fredbert]

That’s good. I was starting to run out of ideas

 

[jmanko16]

OK, so what is working and what isn’t?

From the Internet can you access Web Station main website (if you have it installed)? That would suggest the port forward is working.

From the Internet can you now access the local Plex Media Server website? If you have port forwarded the default 32400 Plex port, does that work? Does the request using the reverse proxy work?

Do you have any DSM firewall that could be blocking connections from parts of the Internet?

web station works.
Plex local media server works via internet.
Local audiobookshelf server works via internet.
turned off firewall to test to make sure not a limiting factor.
calibre-web works locally (with my name.synology.me) but not via internet.

 

[fredbert]

My Calibre-Web container is running HTTP, but I have a reverse proxy that clients connect using HTTPS and this is connected onto the HTTP. I prefer having just HTTPS access.

To confirm, you have used a unique name to access it? e.g. calibre.mynas.synology.com etc.

You might trying a new reverse proxy rule to see if something got cached along the way.

 

[jmanko16]

My Calibre-Web container is running HTTP, but I have a reverse proxy that clients connect using HTTPS and this is connected onto the HTTP. I prefer having just HTTPS access.

To confirm, you have used a unique name to access it? e.g. calibre.mynas.synology.com etc.

You might trying a new reverse proxy rule to see if something got cached along the way.

my calibre is localhost:8083 via http://

I setup a reverse proxy that is calibre.name.synology.me via https:// that directs to the http://localhost:8083, it just does not work when using outside home network.

I did try a new reverse proxy rule and also tried loading a new docker image as well and running into same issue just with calibre-web

 

[fredbert]

So you have mapped NAS LAN IP port 8083 to Docker container port 8083?

And there are no typos in the reverse proxy or browsed URL?

This is pretty much what my Calibre-Web r-rpoxy looks like. I use a personal domain and I don'y usually give Internet access so have a profile to limit to LAN IPs (except when I renew the certificate).

And the Docker container's port setting. As example I'm using DSM LAN IP port 32123.

 

[jmanko16]

So you have mapped NAS LAN IP port 8083 to Docker container port 8083?

And there are no typos in the reverse proxy or browsed URL?

This is pretty much what my Calibre-Web r-rpoxy looks like. I use a personal domain and I don'y usually give Internet access so have a profile to limit to LAN IPs (except when I renew the certificate).
View attachment 11400

And the Docker container's port setting. As example I'm using DSM LAN IP port 32123.
View attachment 11401

my setup was essentially the same. Tried multiple different local ports.

Am not sure exactly what I did but cleared cache on all browsers, spun up new docker and just started from scratch and now it's working with the same setup. Thanks again, new to all the port forwarding and reverse proxy. Its easy in theory but I always seem to find something that trips me up.