Hello i will try to keep it short, but i have tried for months to get a reverse proxy to play nice with my vlan segmented network and i am just not getting anywhere. Maybe someone can read below and give me some suggestions: Just one note i have a cloudflare tunnel placed on vlan 20 that can communicate with vlan 10 so it is only the nginx having this kind of issue. Network Topology & EnvironmentOS / Hypervisor: Unraid version 7.0.0. Gateway: UniFi Gateway. Switch Link: Port 6 on the UniFi switch connects directly to the Unraid host. It is configured as a full Trunk Port. VLAN Trunk Profile: Native VLAN is set to Management (VLAN 1). Tagged VLAN Management is set to "Allow All" to pass 802.1Q frames for VLANs 10 and 20 down the wire VLAN ID Name Subnet Key IPs & Notes 1 Management 192.168.1.0/24 Unraid Host Management IP: 192.168.1.10 10 Servers-Trusted 192.168.10.0/24 Hosts internal target VMs/containers (e.g., Jellyfin: 192.168.10.5) 20 Servers-Untrusted (DMZ) 192.168.20.0/24 Target location for Nginx Proxy Manager (NPM: 192.168.20.70) 50 Guest 192.168.50.0/24 — 2. Hypervisor & Docker ConfigurationPhysical Interface: Bonded link (bond0) combining physical interfaces. It is running in active-backup mode. Bridging Infrastructure: Enabled (br0), creating a standard Linux virtual bridge. VLAN Tagging: Handled cleanly at the OS level, splitting out sub-interfaces br0.10 and br0.20. Host Isolation: VLAN 10 (br0.10) and VLAN 20 (br0.20) have IP Assignment set to "None". The Unraid host has no IP footprint on these networks and acts purely as a Layer 2 virtual switch. Docker Subsystem: Custom networks for br0.10 and br0.20 explicitly defined with correct subnets and gateways (e.g., 192.168.20.1 pointing to the UniFi Gateway). Drivers Tested: Both macvlan and ipvlan (L2) have been tested. Host access to custom networks is currently Disabled. 3. Container Configurations & Port ForwardsNginx Proxy Manager (NPM) Container SettingsNetwork Type: Custom br0.20-Servers-Untrusted. Fixed IP: 192.168.20.70. Web UI Port: 7818. Template Port Configurations: HTTP mapped to 1880 (Container Port 1080); HTTPS mapped to 18443 (Container Port 4443). Jellyfin Container SettingsNetwork Type: Custom br0.10-Servers-Trusted. Fixed IP: 192.168.10.5. Router Port Forwarding Rules (UniFi)HTTP: WAN Port 80 -> Forwarded to 192.168.20.70 on Port 1880 (TCP). HTTPS: WAN Port 443 -> Forwarded to 192.168.20.70 on Port 18443. 4. Symptoms & The Problem BreakdownWhat Works: When NPM runs on Docker's default Bridge mode, it works completely. It successfully maps host ports (1880/18443 to container 80/443), hides behind the host's management IP (192.168.1.10), and proxies traffic to backend targets. Internal DNS resolution also works perfectly. The Breakdown: The exact moment NPM is switched from Bridge mode to a custom network assigned to br0.10 or br0.20, all traffic fails. Inter-VLAN Block: NPM cannot communicate across subnets to reach backend services like Jellyfin (192.168.10.5). This persists even when UniFi firewall rules are wide open. External WAN Rejection: External connection attempts (e.g., via cellular data) time out or return a strict "Connection Refused" error.