Hi, folks! I’ve learned a lot these past 8-9 months in self-hosting, but I’m not sure what’s going on with my reverse proxy setup. At this point, I’m only running Nginx Proxy Manager, Jellyfin, and Komga, separated from my home network via VLANs and firewall rules. My home network is 192.168.1.X and hosted services are on 192.168.10.X. Yet when I look at access logs for Jellyfin or Komga, both are reporting access from 192.168.65.1 when accessed from outside my home network. I don’t have a 65 subnet, so this is strange. The reverse proxy is run on a mini PC at .10.201, and Jellyfin and Komga are hosted on a NAS at .10.202; all of them run via Docker containers.
The instructions for Jellyfin for reverse proxy just say to list the address for the reverse proxy, which I did using IPv4 and the domain, and various configurations of only one or the other, as well as the 192.168.65.1 address that manifested out of nowhere. I haven’t observed any kind of change in IP address reporting after making changes here. I haven’t begun to try to configure Komga for the reverse proxy, because I figure until I get it working for Jellyfin and understand how to do it, it probably doesn’t matter; I only listed it here as evidence that two different services were reporting the same phantom IP address. I did ask for help on this issue on a Discord server a little while ago, and some of those folks suggested looking at the Docker networks. I left network settings on basically default for all three of these applications, and they all seem to generate something like a 172.17.0.X address, not the 192.168.65.1 that I’m seeing in logs.
I know there are supposed to be extra headers on network packets that these services can be aware of if they know it’s going through a reverse proxy first, and I figure this is important for proper monitoring of folks accessing my hosted services, so i want to get this figured out before I start running a few more apps. Any help anyone can offer would be appreciated. A lot of times, the documentation for this stuff is written up with an assumption of more understanding than the person reading it might have. Or maybe I just glanced right by something obvious and stupid.
Try setting this in advanced settings:
proxy\_set\_header Host $host; proxy\_set\_header X-Real-IP $remote\_addr; proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for; proxy\_set\_header X-Forwarded-Proto $scheme;Still the same problem, I’m afraid. I also experimented with putting some of this stuff in the Custom Locations section of NPM’s proxy host settings, since that’s how it looks in Jellyfin’s nginx guide. The only feedback that I got at any point that my changes in NPM were doing anything at all was when my mobile app failed to connect to my server because of how I’d mucked around in there; I did delete those changes before adding your suggestions, of course.
Long shot but you might’ve solved the nginx x-forwarded header multiple times without seeing it if the nginx proxy is behind the same bridged docker desktop system setup on your minipc then the visitors IP will show as 192.168.65.1 to the nginx proxy too so you forward that same ip to jellyfin even when it works.
An easy check would be to spin up nginx as a vm instead of a nginx reverse proxy docker image and see if it works.
No real solution, but a lot of chatter regarding that:
https://github.com/NginxProxyManager/nginx-proxy-manager/issues/674
Thanks, there’s a lot to read through in there, so I’ll see what, if anything, I can apply from it.
The main point was that if your mini-pc running the proxy is also behind a windows docker desktop install it too will have incoming connections appear as 192.168.65.1.
A solution then is to switch to a linux docker host where you can get rid of that hidden NAT. There are many webuis for docker such as dockge and portainer on linux without having to use the terminal.
My preffered solution would be to switch to a router/firewall with reverse proxy support such as opnsense with haproxy and skip the nginx proxy manager completely.
Having the proxy configured in the same UI as vlan, port forwarding, nat rules and so on is nice. https://opnsenselab.com/posts/opnsense-haproxy-reverse-proxy/
I have an OPNsense firewall, but I didn’t know it could do that. I was just following guides for the easy route for most of this stuff.
Congrats! Then you have a guide for an easy reverse proxy right inside your router. :)
Try it out and see if that doesn’t fit you better than the nginx proxy manager.
It looks like it’s a community plugin that’s not there out of the box, but it is for sure one more tool I have in my tool belt to solve this. Thanks for the tip!