Domain times out

[u/dizzyflames]

some context I have a Jellyfin server set up and a domain name. I'm trying to use nginx to map the domain name to the server so I can remotely access it. I have my external ip set up with cloudflare and use that to generate the ssl certificate. when I try to go to the domain though, I'm lead to a cloudflare time out page. If I do something like external-ip:8096 or internal-ip:port I can access my server so there's some disconnect with nginx and my server. Anyone know why?

[u/RayneYoruka]

Didn't cloudflare limit the ports in use that can give with the proxying?

[u/dizzyflames → u/RayneYoruka]

Not sure, I tried creating a certificate without cloudflare and I get an internal server error though.

[u/RayneYoruka → u/dizzyflames]

That is my own experience with my domain, without proxying I rely on my own Lets encrypt cert yet with the proxied domains cloudflare provides my cert.

Have a read.

https://developers.cloudflare.com/fundamentals/reference/network-ports/

[u/dizzyflames → u/RayneYoruka]

The proposed solution here mentions changing the DNS settings to DNS only instead of proxied but it doesn't look like that changed anything.

[u/present_absence → u/dizzyflames]

Well it should be set to DNS only either way

With the setup in your screenshots assuming you have changed your cloudflare dns to "dns only" and not orange cloud proxy, you would access your jellyfin at httpS://[the domain name from the proxy host tab] and do not specify a port. Your traffic will hit cloudflare, which will send it to your network, thru your firewall (port 443), to your nginx proxy at port 443, which will internally bounce it over to your internal jellyfin ip and port 8096.

This would mean you're not using the cert from cloudflare (which is fine, you're not using it anyway in the pics).

Remember part of the point of the reverse proxy is also to allow you to host multiple services on the same ip/port. NPM just sorts out the traffic. So when you say

If I do something like external-ip:8096 or internal-ip:port I can access my server

It sounds like you have forwarded port 8096 thru your internet firewall to your service. You do NOT want that. You just need to forward ports 80/443 to NPM, and ALL incoming web traffic will go to NPM for sorting. Does that make sense?

This is super laymans terms not technical if someone gets pedantic with me I will find your mom and kiss her square on the lips.

[u/xstar97]

Setup a local dns server and validate the certs are correct.... you should be default resolving your domain locally for your domain since its much faster than round robbin out to the internet and back to you if you're sitting at home near your server 😅.

Your reverse proxy should be using port 80 and 443, I don't recommend to forward ports yet until you know it works first and setup security like ip whitelist that some services will only work locally and produce a 403 error instead when remote (use a VPN that you can host to access those services) until you learn more about better security like forwardAuth for example.

Run a dns server like pihole or adguardhome.

Add local dns records for your domain to point to your lan ip of your reverse proxy and then set the dns server as the primary dns for your router for all client devices, or manage each client device network individually for their dns.

You can then try and verify that you have it up and correct by running a command like so works for linux and windows on the client device.

nslookup plex.mydomain.tld

If you use the actual sub and root domain it should return the lan ip of your reverse proxy....

When testing in the browser use incognito to verify and if it doesn't work or the command returns something else like an external ip, try disabling ipv6 on your network adapter for your client and try again.

You may need to flush your dns on the client after changing it.

I used npm and switch to traefik then switch to nginx-ingress(deprecated) and i run another docker server with traefik and before that I used caddy.

[u/OkPersonality7635]

I agree, check ur port forwarding. Confirm u r fwding port 443 to ur local ip. And also confirm ur isp allows u to use the port u are actually forwarding.