Hi, folks! I’ve learned a lot these past 8-9 months in self-hosting, but I’m not sure what’s going on with my reverse proxy setup. At this point, I’m only running Nginx Proxy Manager, Jellyfin, and Komga, separated from my home network via VLANs and firewall rules. My home network is 192.168.1.X and hosted services are on 192.168.10.X. Yet when I look at access logs for Jellyfin or Komga, both are reporting access from 192.168.65.1 when accessed from outside my home network. I don’t have a 65 subnet, so this is strange. The reverse proxy is run on a mini PC at .10.201, and Jellyfin and Komga are hosted on a NAS at .10.202; all of them run via Docker containers.

The instructions for Jellyfin for reverse proxy just say to list the address for the reverse proxy, which I did using IPv4 and the domain, and various configurations of only one or the other, as well as the 192.168.65.1 address that manifested out of nowhere. I haven’t observed any kind of change in IP address reporting after making changes here. I haven’t begun to try to configure Komga for the reverse proxy, because I figure until I get it working for Jellyfin and understand how to do it, it probably doesn’t matter; I only listed it here as evidence that two different services were reporting the same phantom IP address. I did ask for help on this issue on a Discord server a little while ago, and some of those folks suggested looking at the Docker networks. I left network settings on basically default for all three of these applications, and they all seem to generate something like a 172.17.0.X address, not the 192.168.65.1 that I’m seeing in logs.

I know there are supposed to be extra headers on network packets that these services can be aware of if they know it’s going through a reverse proxy first, and I figure this is important for proper monitoring of folks accessing my hosted services, so i want to get this figured out before I start running a few more apps. Any help anyone can offer would be appreciated. A lot of times, the documentation for this stuff is written up with an assumption of more understanding than the person reading it might have. Or maybe I just glanced right by something obvious and stupid.

  • lemmyvore@feddit.nlEnglish
    2·
    14 hours ago

    Yeah that’s because most people are under the impression that Docker only allocates 172. addresses for its bridge network. I was under that impression too.

    Turns out it also allocates 192.168 addresses.

    Does it overlap my LAN? Is 192.168.65.X not distinguishable from my defined subnets with a 24-bit mask, now that I know where they’re coming from?

    The problem is that the default says 192.168.0.0/16, so it can also generate overlapping addresses. The fact it generated a 192.168.65.x address instead of an 192.168.1.x address was pure luck.

    Somehow all of the tutorials I’ve found in the past months to set up services behind a reverse proxy never mentioned any of these gotchas with Docker and networks.

    The common-sense assumption is that you will adjust your Docker daemon settings so that you prevent overlap with your LAN. (Also, I expect lots of tutorials aren’t that high quality to begin with.)

    If you edit daemon.json like I explained and explicitly only put 172. ranges in there you should be safe from overlaps in the future.

    • ampersandrew@lemmy.worldOPEnglish
      1·
      14 hours ago

      The common-sense assumption is that you will adjust your Docker daemon settings so that you prevent overlap with your LAN. (Also, I expect lots of tutorials aren’t that high quality to begin with.)

      I would say a high quality tutorial doesn’t assume that I know anything about Docker, and most of them didn’t (which is good, because I don’t), but they also didn’t seem to expect me to want better logging out of my hosted services. Thanks, the /16 subnetting makes sense. I’ll try to edit that json file later today. But we seemingly don’t expect this to fix the problem by itself, so other than telling Jellyfin to expect a proxy at the new reported IP address, what should I expect for next steps?

      • lemmyvore@feddit.nlEnglish
        2·
        14 hours ago

        Need to edit the proxy host for Jellyfin in NPM (advanced tab) and send the X-Forwaded-For header to it.

        proxy_set_header X-Forwarded-For $remote_addr;

        And also in Jellyfin settings you have to set the IP that it sees the reverse proxy coming from as a “known proxy”, so it knows it can trust that header when it comes from that IP.

        https://jellyfin.org/docs/general/post-install/networking/reverse-proxy/#forwarded-for-headers

        • ampersandrew@lemmy.worldOPEnglish
          1·
          5 hours ago

          Alright, I did all of the above. I added the proxy_set_header line to Custom Nginx Configuration for the Jellyfin proxy host by hitting the gear in the upper right of the edit window.

          The daemon.json file wasn’t on my mini PC (where NPM lives), so I made a new one with those contents sans the 192.168 line. It was already present on my NAS (where Jellyfin lives), but only with a few other lines that weren’t our default-address-pools. I appreciate your previous instructions not assuming that I know the structure of a JSON file, but I do work with them a lot for my day job, so I was comfortable appending to that file on the NAS (though I did have to re-learn some vim basics to do it).

          Anyway, after making those daemon.json file changes, I rebooted the whole machine in both places, not just Docker. That should be enough to make any IP addresses refresh themselves, right? But Jellyfin logs still show access coming from 192.168.65.1. I do find it strange that a container would be using an IP address like this one without reporting it somewhere, but in the Inspect tab of Docker Desktop on the mini PC, it just shows that 172.17.0.X address (2 for IPAddress, 1 for Gateway).