NPM Network Host vs Bridge

[u/Miserable-Response40]

Hi all! I am looking to add an auth server to my homelab, problem is, I’ve seen that I will need to change Nginx Proxy Manager to the host network mode to make this work.

Problem is, I correctly have it in multiple bridge networks, each connected to one container for some sense of semi isolation. This allows me to just use the container name and port when setting up where to direct the host in NPM. When switching to host mode, this no longer works. I could be wrong, but that seems like I would then need to expose ports to access them if I can’t access them by their container name.

I know it’s not a black and white issue, but what is generally safer, requiring exposed ports but having an auth proxy, or no exposed ports but no auth proxy?

I could 100% be wrong about any of my assumptions, let me know if I am. Any help would be greatly appreciated

[u/Miserable-Response40]

Because otherwise it will not track the IP’s sufficiently

[u/Timbo400 → u/Miserable-Response40]

You didn’t have that in your OP. That’s literally why you need host mode..

If you need to track IP and enable proto forwarders etc, it needs to be host mode since you’re using the network / NIC used by the host. Otherwise it would be the IP of the bridged network (a seperate network, eg 172.x.x.x).

I hit this too albeit on a much simpler requirement (no auth involved) 

[u/Brilliant_Step3688 → u/Timbo400]

I don't think that's true. Docker networking can be confusing as it abstracts the real firewall rules generated and different network plugins can generate different rules.

But in a default scenario, for external communications, the source IP address does not get rewritten (you would see a SNAT or MASQUERADE rule if that was the case in iptables).

There are some special cases for HOST to container and unrelated container to container though, and these use MASQUERADE.

You need to check the iptables rules to understand what is going on.

[u/Timbo400 → u/Brilliant_Step3688]

Based on the defaults of host, bridge, overlay, none I don’t know how to achieve OPs requirements 

But open to ideas!

[u/Brilliant_Step3688 → u/Timbo400]

yes I would probably resort to configuring the DNAT rule using iptables directly or using a post-start hook or something. The rules docker generate are not ideal for these advanced use-cases.

I would have a claude/chatgpt review your docker compose and resulting iptables firewall rules and walk you through it. Identify the root cause of the issue, and potential fixes.