Homelab reverse proxy setup

Operating Systems & Open Source Linux
,
1

Hey, I am running an nginx proxy manager lxc in my labnet to forward different HTTPS/HTTP requests to specific services since I have access to a single public dynamic IP address.

I am running an duckdns.org ip address, that works.

The hard part about my setup, is that I am running double port forwards to my reverse proxy.

  1. Home LAN router (Teltonika) with port forward to my labnet router
  2. Labnet router (Ubiquiti CGU) to the proxmox LXC running the Docker image of Nging proxy manager.

I have been getting a couple different error-codes when I try to test server reachability

There is a server found at this domain but it returned an unexpected status code 400. Is it the NPM server? 
Please make sure your domain points to the IP where your NPM instance is running.

There is a server found at this domain but it returned an unexpected status code Invalid domain or IP. Is it the NPM server? 
Please make sure your domain points to the IP where your NPM instance is running.

I am getting different errors even if I have not changed anything. These two were taken within 5 min of each other

I am have setup DDOS protections on the Teltonika, but my labnet configuration is complicated. The VLAN where the reverse proxy and other services that I intend to push to internet is configured as DMZ.

image
image1590Ă—346 35.8 KB

I have done direct port forwards from my home network, although those are not on the default ports for HTTP/HTTPS but a custom port. This has also worked with double port forwading from my labnet to public. Although that host is not located at the DMZ, since I have not had the time to push that host into the DMZ VLAN.

Any ideas? Thanks for taking the time!

2

It looks like your double NAT + dynamic IP setup is causing inconsistent port forwarding and handshake issues between routers and your Nginx Proxy Manager. To improve reliability:

Simplify port forwarding: Forward external ports (80/443) directly to the LXC running NPM and avoid double hops.

Use a VPN tunnel or VPS relay: Terminate SSL and proxy traffic via a public Cloud or VPS (like WireGuard to Linode) to bypass your complex NAT setup.

If you’re testing geo-specific mobile endpoints or need stable external access, grabbing the best mobile proxy, like LightningProxies’ mobile proxies, can help simulate real mobile connections and fix routing quirks when connecting from outside networks.

1 Like