HurracaineIke Posted July 30, 2022 Share Posted July 30, 2022 To start, I am very new to all this so probably just have some misunderstandings of how things work. Like a lot of people, I used SpaceInvader One's tutorial on getting my unraid server setup to run nextcloud behind SWAG with my connections routing through cloudflare. Everything works great through that path internally and externally, however my issue is when I am on my LAN and try to upload files to my nextcloud, I am limited to the speeds through cloudflare/my ISP - windows performance monitor is showing 8Mbits/s send, unraid shows peaks of 60Mbits/s receive on the NIC. I tested the LAN speeds from my desktop to my server using IPerf and am getting my expected 900+ Mbits/s speeds (yes, Mbits/s not MB/s) Here's a breakdown of my setup: Unraid 6.10.3 Linuxserver's SWAG docker Linuxserver's Nextcloud docker Linuxserver's MariaDB docker selfhoster's Cloudflare-DDNS docker Spant's Pihole Docker I have port 443 access turned off on my unraid server and connect to it locally only over port 80 (http). My SWAG uses unraidIP:1443 and unraidIP:180 My nextcloud uses unraidIP:444 mariaDB uses unraidIP:3306 Pihole is on a static IP in the same subnet as unraidIP, let's call it PiholeIP. I have my own domain from google domains linked to cloudflare. Cloudflare has a 'A' record for my public IP (which is updated using the Cloudflare-DDNS docker I believe) and then I have a CNAME pointing to that and I am able to successfully connect to my nextcloud using that xyz.domain.com. Both the A record and CNAME record are proxied on cloudflare (it was the only way I could get it to work when initially setting it up). SSL/TLS is set to Full (Strict) and I enabled HSTS. When I connect to xyz.domain.com the certificate is being provided by cloudflare (so not LetsEncrypt). My router forwards port 443 to SWAG at unraidIP:1443. I do not port forward port 80. SWAG is routed through cloudflare (through the config files I believe?). SWAG is then connected to my nextcloud. I have nextcloud and swag on a custom docker network ('proxynet') so they can talk to each other without having to dig deeper into config files. I did change SWAG to use 'Modern configuration' (e.g. TLSv1.3) instead of 'intermediate configuration' in the ssl.conf as I don't need older browser support. This is where my knowledge gets fuzzy and I'm kinda just throwing mud at a wall at this point...I think I have to setup a 'split-brain DNS'... I tried changing my nextcloud to unraidIP:443 and then using Pihole (which is setup and working nicely right now) to create a DNS record that directs me to unraidIP, however when I do this I get "“Privacy error: Your connection is not private” (NET::ERR_CERT_AUTHORITY_INVALID)" If I try going to unraidIP:443 locally, my router forwards that request to SWAG (port 1443) which then overwrites(?) that request to xyz.domain.com and sends me back through cloudflare. So I have not tried setting nextcloud back to port 444 and using port 443 for SWAG as I believe I would get the same result anyway? Which leads me to believe this is all a problem with cloudflare certificates or SWAG. I don't know if it's possible to get the certificate from cloudflare and install it somewhere so that local access is allowed (since my SSL/TLS is set to Full [Strict] ) or if there's something in the SWAG config that I can edit so that it sends requests through cloudflare only if it is a request from outside the network? My router is a basic D-link one so I don't have much in the way of firewall rules (that I can find) I seem to only be able to allow or deny WAN to LAN / LAN to WAN requests there. Plz send help. Quote Link to comment
bucketphobia Posted November 27, 2022 Share Posted November 27, 2022 Heya! Did you ever figure this out? Quote Link to comment
MP715 Posted November 28, 2022 Share Posted November 28, 2022 12 hours ago, bucketphobia said: Heya! Did you ever figure this out? No news is good news.... Usually Quote Link to comment
HurracaineIke Posted July 14, 2023 Author Share Posted July 14, 2023 (edited) @bucketphobia Super late response. Sorry I never come on here. I did actually figure it out eventually, however I can't recall off the top of my head exactly how. Pretty sure it was one of two things (or both): 1. Changed my SWAG instance to run on port 443 instead of port 1443 - something funky was going on there, I think it was something to do with Pihole not working with DNS records to a different port. 2. Added my unraid server IP address to the resolver.conf file in /mnt/user/appdata/swag/nginx (Although I think this was actually from me trying to get hostnames on Pihole...fairly certain it was solution 1) Edited July 14, 2023 by HurracaineIke Changed bullet points slightly to point to what I believe is the correct solution more clearly Quote Link to comment
Solution HurracaineIke Posted July 14, 2023 Author Solution Share Posted July 14, 2023 Thinking about it more and I definitely think point 1 was the solution. When you make the request to go to your domain it will be https (port 443) and pretty sure pihole takes that right away before it can get to your router (which would forward to port 1443). So then the request is going to your server at port 443 (instead of 1443) and thus you cannot connect to nextcloud directly. I couldn't find a way in pihole configs to forward 443 requests to 1443 with DNS records so setting swag to 443 fixed the issue if I recall correctly. Quote Link to comment
bucketphobia Posted September 5, 2023 Share Posted September 5, 2023 Hey @HurracaineIke, No worries at all, same! Yeah, that was the solution I settled on as well sometime after making the post. I moved unraid to IP 1443, SWAG to 443 and pihole redirected mydomain.com to [unraid local IP] Works like a charm. Appreciated for the response Quote Link to comment
ericperk Posted September 6, 2023 Share Posted September 6, 2023 It's good that you found a solution that worked for you. Quote Link to comment
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.