Help with Getting My Reverse Proxy to Forward the Correct IP Address

Submitted ⁨⁨5⁩ ⁨hours⁩ ago⁩ by ⁨ampersandrew@lemmy.world⁩ to ⁨selfhosted@lemmy.world⁩

Hi, folks! I’ve learned a lot these past 8-9 months in self-hosting, but I’m not sure what’s going on with my reverse proxy setup. At this point, I’m only running Nginx Proxy Manager, Jellyfin, and Komga, separated from my home network via VLANs and firewall rules. My home network is 192.168.1.X and hosted services are on 192.168.10.X. Yet when I look at access logs for Jellyfin or Komga, both are reporting access from 192.168.65.1 when accessed from outside my home network. I don’t have a 65 subnet, so this is strange. The reverse proxy is run on a mini PC at .10.201, and Jellyfin and Komga are hosted on a NAS at .10.202; all of them run via Docker containers.

The instructions for Jellyfin for reverse proxy just say to list the address for the reverse proxy, which I did using IPv4 and the domain, and various configurations of only one or the other, as well as the 192.168.65.1 address that manifested out of nowhere. I haven’t observed any kind of change here. I haven’t begun to try to configure Komga for the reverse proxy, because I figure until I get it working for Jellyfin and understand how to do it, it probably doesn’t matter; I only listed it here as evidence that two different services were reporting the same phantom IP address. I did ask for help on this issue on a Discord server a little while ago, and some of those folks suggested looking at the Docker networks. I left network settings on basically default for all three of these applications, and they all seem to generate something like a 172.17.0.X address, not the 192.168.65.1 that I’m seeing in logs.

I know there are supposed to be extra headers on network packets that these services can be aware of if they know it’s going through a reverse proxy first, and I figure this is important for proper monitoring of folks accessing my hosted services, so i want to get this figured out before I start running a few more apps. Any help anyone can offer would be helpful. A lot of times, the documentation for this stuff is written up with an assumption of more understanding than the person reading it might have. Or maybe I just glanced right by something obvious and stupid.

source

Comments

Sort:hotnew top

Ooops@feddit.org ⁨2⁩ ⁨hours⁩ ago

the 192.168.65.1 address that manifested out of nowhere

Or it’s the internal virtual lan your docker config uses…

source
- ampersandrew@lemmy.world ⁨2⁩ ⁨hours⁩ ago
  Yeah, that appears to be the case from a link someone else linked here, but I was unable to trace that from anywhere I could find in my containers before.
  
  source
  - Ooops@feddit.org ⁨2⁩ ⁨hours⁩ ago
    Well… it’s the default iirc (192.168.65.0/24). So that’s what docker uses if there is no explicit configuration.
    
    source
    -> View More Comments
treadful@lemmy.zip ⁨5⁩ ⁨hours⁩ ago
You’re gonna want to configure nginx to send along an X-Forwarded-For HTTP header (there’s also Forwarded, but it’s not as well supported yet). An example in a location block:

location / { proxy_pass http://backend/; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }

Looks like Jellyfin supports it.
source
- ampersandrew@lemmy.world ⁨4⁩ ⁨hours⁩ ago
  I’m not quite sure where this goes. It’s Nginx Proxy Manager (in case that affects your answer compared to vanilla nginx), and I’m using Docker Desktop for much the same reason: I’m doing as much configuration via GUI as possible. Is this a Docker configuration or an Nginx Proxy Manager configuration? There is a “Custom Nginx Configuration” screen for my Proxy Host; does it go there? In a nested location block?
  
  source
  - roofuskit@lemmy.world ⁨9⁩ ⁨minutes⁩ ago
    ssl.conf
    
    source
  - treadful@lemmy.zip ⁨3⁩ ⁨hours⁩ ago
    I really don’t know shit about the GUI tools, but presumably they overlay on the same configuration.
    
    The config I posted would be part of the nginx configuration. You’re instructing it to append the client IP to the X-Forwarded-For header.
    
    There is a “Custom Nginx Configuration” screen for my Proxy Host; does it go there? In a nested location block?
    
    I doubt it, but I’m not sure. The location block would normally be where your reverse proxy configuration would already be, and you’d need to just add that one line. But again, I don’t know how that translates to these GUI tools. Maybe if you search for proxy_add_x_forwarded_for and “Nginx Proxy Manager” you might find what you need.
    
    source
    -> View More Comments
anamethatisnt@sopuli.xyz ⁨5⁩ ⁨hours⁩ ago
docs.docker.com/desktop/features/networking/#how-…
I think your discord friends are right.

Outbound traffic from the container is sent through Network Address Translation (NAT) using a virtual adapter (typically with an internal IP such as 192.168.65.3). You can view or change this with the Docker Desktop settings.

source
airgapped@piefed.social ⁨3⁩ ⁨hours⁩ ago
In addition to configuring x-forwaded-for in NPM, you will also need to add 192.168.65.0/24 under Dashboard > Advanced > Networking > Known Proxies

source
lemmyvore@feddit.nl ⁨5⁩ ⁨hours⁩ ago
Just to understand better:

When you say “when accessed from outside my home network”, what kind of access is that? Port forward? VPN?

Is 192.168.1.1 your router?

What’s your LAN netmask?

NPM listens on 192.168.10.201 ports and Jellyfin/Komga on 192.168.10.202 ports?

A connection from the outside comes through the router, gets forwarded to 192.168.10.201:443, the proxy sends it to 192.168.10.202:8096, and it shows up in the Jellyfin logs as coming from 192.168.65.1?

If all of the above is correct I would look at the network interfaces that are up on the mini-PC and the NAS, as well as inside the containers of the proxy and of Jellyfin, and see if there isn’t a 192.168.65.1 up on there somewhere for whatever reason.

You can also try making a manual request (wget, curl, nc) from the proxy container to Jellyfin and see what it shows up as.

May also want to see what’s the DNS situation in your LAN and on those machines. You mentioned “names” being used, how are those defined and resolved?

Last but not least are the containers you mentioned using docker bridge networks or ipvlan?
source
- ampersandrew@lemmy.world ⁨4⁩ ⁨hours⁩ ago
  
  When you say “when accessed from outside my home network”, what kind of access is that? Port forward? VPN?
  
  Accessing via 443 forwarding to my reverse proxy from the internet. My dad will hit my Jellyfin server from his house, and I can hit that server from mobile networks when I’m not on wi-fi.
  
  Is 192.168.1.1 your router?
  
  Yes. It’s also .10.1 on the 10 VLAN.
  
  What’s your LAN netmask?
  
  255.255.255.0 on both VLANs
  
  NPM listens on 192.168.10.201 ports and Jellyfin/Komga on 192.168.10.202 ports?
  
  Correct.
  
  A connection from the outside comes through the router, gets forwarded to 192.168.10.201:443, the proxy sends it to 192.168.10.202:8096, and it shows up in the Jellyfin logs as coming from 192.168.65.1?
  
  Correct. Jellyfin is actually listening on a different, auto generated, arbitrary port that I just stuck with, but other than that, you got it.
  
  I did check every IP address I could find anywhere on my network and couldn’t find the 192.168.65.X anywhere, but @anamethatisnt@sopuli.xyz here in this thread seems to have identified this as some NAT setting built in to Docker. Running on default settings for network, because I had no idea why I would want to modify any of those settings, they are running as bridge networks.
  
  source