Tailscale funnel Nginx Proxy, cname cloudflare

[cord]

Hello Everybody...

First: I tried to access Nginx Proxy Manager in an LXC container on proxmox through a tailscale funnel.


I installed tailscale in the same container (unprivileged) as my Proxy Manager.


Using "sudo tailscale funnel --bg 80" I made it publicly accessible.


I can now access the Proxy Manager from any internet connected pc over https://proxy.aaa-bbb.ts.net


Issue #1: If I add a proxy configuration, with the source proxy.aaa-bbb.ts.net, and my Jellyfin Container as the destination, I can't get proxy.aaa-bbb.ts.net to connect to my Jellyfin container. I can still just access the Proxy LXC container at port 80.
Why is the proxy server not seeing proxy.aaa-bbb.ts.net as the source and forwarding it to my jellyfin destination?


Furthermore I tried using my fully qualified tailscale domain name with cloudflare.


Cloudflare DNS:


Type: cname


Name: @


Content: proxy.aaa-bbb.ts.net


Proxy status: DNS only

I would no expect mydomain.com to be resolved to proxy.proxy.aaa-bbb.ts.net (tailscale funnel) to be connected through the funnel to my LXC container with the proxy manager. However, I get ERR_CONNECTION_CLOSED.
What am I doing wrong?


Is all of this simply not possible? I'm looking for a way to get internet access to VMs/LXCs without having to open any ports on my router. This would allow me to run a small webserver and other services without port forwarding.

 

[Salamandre12]

Tailscale funnel terminates the request itself, so NPM never sees the original hostname and can’t route based on it. If you need hostname-based reverse proxying, run the services directly behind funnel or use Tailscale Serve instead of funnel.

 

[louie1961]

Or just use a Cloudflare Tunnel.

 

[UdoB]

If you have an external VPS or are willing to rent one for ~two Dollar per month, take a look here: https://github.com/fosrl/pangolin = "Tunneled Reverse Proxy Server with Access Control - Your own self-hosted zero trust tunnel."

This is a free Cloudflare Tunnel clone. Some (many?) functions are missing, of course. But it successfully and completely removes the necessity to open any ports on your home router.

Oh, and you own the underlying key for the Letsencrypt certificates, not some potentially problematic thirdparty provider. This is really important for paranoia level three and above ;-)

I am using/testing it since spring this year; until now it works really great.

Note that I am talking about a Homelab, light traffic, nothing important.