as the title says, I need some help getting SWAG working so I can give access to my emby server to my friends and family.

I've been trying to follow this guide and am getting stuck at step 3 after installing SWAG:

 

For step 1, I set up a domain through duckdns.org (unraidembytest.duckdns.org) and installed the duckdns docker container.

For step 2, I have my own docker network that all my containers are mapped to.

For step 3, I set the following for the SWAG docker container and the port forwarding in my router (TP-Link AX1800):

SWAG Docker Container:

• Set HTTP port to 9090 from 80 (8080 was already in use)
• Set HTTPS port to 9443 from 443
• Set URL to "duckdns.org"
• Set subdomain to "embyunraidtest"
• Set my email
• Set only_subdomains to "true"

Swag80 Port Forward:

• Set UnRAID IP address
• Set external port to 9090
• Set internal port to 80

Swag443 Port Forward:

• Set UnRAID IP address
• Set external port to 9443
• Set internal port to 443

When following the guide, I save the router settings then apply the changes to the SWAG container. After looking at the logs, I get the following error message:

Quote

 

"Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems: Domain: embyunraidtest.duckdns.org Type: connection Detail: <MY_IP_ADDRESS>: Fetching http://embyunraidtest.duckdns.org/.well-known/acme-challenge/AS8c2A0WlPQ674yF985E-ZYhpG09XuYbKzyaEkNLoe8: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to download the challenge files from the temporary standalone webserver started by Certbot on port 80. Ensure that the listed domains point to this machine and that it can accept inbound connections from the internet.

ERROR: Cert does not exist! Please see the validation error above. The issue may be due to incorrect dns or port forwarding settings. Please fix your settings and recreate the container"

 

I'm really not sure how to fix this. I've tried swapping the internal and external ports in my router settings, uninstalling and reinstalling SWAG, and trying different domains through duckdns. I would really appreciate any UnRAID Jedi Masters helping me with this problem. Thanks!

 

Do you have any GEO blocking in place either in your router or configured in swag? And your port forward is wrong, external should be 443 and 80. You can check here if your ports are open: https://www.yougetsignal.com/tools/open-ports/

Admittedly I know very little about routers and networking.  I've not configured anything beyond what the guide has said to, so only whatever is in the SWAG docker container and router port-forward settings.

 

I visited the website you listed and input my external IP address with ports 80 and 443 - both are closed.  I tried swapping the external and internal ports such that external ports are 80 and 443, and the internal are 9090 and 9443, but that hasn't fixed it either.

 

Could it be some router setting that I am unaware of?

Are you double NAT'ed? Or are you behind CGNAT? By that I mean do you have a another router in front of your TP-Link AX1800? Or are you using some kind of 4 or 5G (mobile) internet? It could also be that your ISP blocks port 80, some do that. But port 443 most are not blocking.

Edited May 21, 20242 yr by strike

I have a gateway in bridge mode connected to my AX1800 router, which my UnRAID machine is connected directly to.  Is that what you mean?

As long as it's in bridge mode you should be fine. And I assume your answer is no to 4/5G internet? If so you should maybe check with your ISP if they block any ports. If your port forwarding is now correct there should be no other reason why the ports are not open, other then if your ISP blocks of course. Maybe try rebooting your router.

Correct on the no 4/5G internet.  I just tried rebooting my router and that did not fix the issue.  I am going to reach out to my ISP to see if they are blocking the ports.

Make sure you have correct routes setup on unriad for the reverse proxy and connection is going over it.
Setting to custom ip and giving it a lan # is ideal to guarantee protforwarding...

?
https://emby.media/docker-server.html
https://docs.linuxserver.io/general/swag/

Alot of ISP are moving to cgnat to maintain the ipv4 address.
If you are on cgnat then you will need to use a VPN with a brokerage server.
ex tailscale / openvpn &/or Wireguard...

you can run a security scan to yourself with tools like nmap or online pen testing tools like 
Gibson research shields up.
https://www.grc.com/x/ne.dll?bh0bkyd2

if you are on cell data you are definitely on cgant.
https://www.draytek.co.uk/information/blog/what-is-cgnat#:~:text=CGNAT has its own reserved,%2C most likely%2C using CGNAT.

you can't open ports on a router behind CGNAT
You would need to call you ISP and ask to pay for a public static IP.

So I contacted my ISP and got the following info:

• CGNAT is NOT used, my ISP just assigns IPs dynamically.
• Ports blocked include: 25, 80, 8080, 135-139, 445, 1043, 6588, 1080, and 3128
• I confirmed that my gateway is configured to be in Bridge Mode

 

Any ideas on what else I can do?

Since port 80 is blocked the only option you have with swag is to use the DNS method with a supported provider. And for that you need your own domain and can't use duckdns as you don't control their DNS servers. OR you can look into cloudflare tunnel, then you don't need to open ports, but need to trust cloudflare with all your data as everything in tunneled through them. Look up IBRACORP's youtube video on how to set up cloudflare tunnel. I don't remember if you need your own domain with cloudflare tunnel or not but it's probably a good idea. You can still use swag with it.

Or wait I think maybe swag added DNS challenge support for duckdns. A quick google search says so anyway. I didn't read any of it just saw that some people had it working

Edited May 21, 20242 yr by strike

I just noticed that my public IP address is different than the internet IP address listed on my router's admin page.  Could this also be impacting something?

 

Router Internet IP: 192.168.x.x

Public IP from whatismyipaddress.com: 69.113.x.x

"The router internet IP" is just the internal IP and not your public IP. That IP is probably your gateway as you called it. Or it's your router IP. You can check that. That probably means bridge mode isn't working or is not setup correctly. I might be wrong there as I always just had one router and never had the need to setup brigde mode. But logic says if in bridge mode your public IP should show up and not the IP of your gateway.

If bridge mode is not working you are effectively double NAT'ed. If you can't get the bridge mode to work you can work around it by forwarding the ports you need to forward in your "gateway" to your router IP, then again from your router to your unraid server. like you already did.

Edited May 21, 20242 yr by strike

Update:

I was able to get SWAG to say "server ready" by changing the following settings under the SWAG container:

• URL = embyunraidtest.duckdns.org
• validation  = dns
• subdomains = wildcard
• dnsplugin = duckdns

I can't work on it for the rest of the day, but SWAG seems to now be working.  Is there a way to confirm this?

Update 2:

With SWAG saying "server ready", I decided to try and continue with the guide I linked, but now I get stuck at Step 7.

 

For Step 4, I already had the binhex version of the Emby container installed.

 

For Step 5, I configured the emby.subdomain.conf file as instructed:

• Set server_name to "embyunraidtest.*"
• Set $upstream_app to "binhex-emby"
• Saved as .conf
• Restarted the SWAG container after saving

For Step 6, I also configured the network settings as described:

• Set Public HTTPS port number to "443"
• Set external domain to "embyunraidtest.duckdns.org"
• Set Secure connection mode to "handled by reverse proxy"
• Disabled automatic port mapping
• Saved settings
• Restarted the Emby container

I get stuck at Step 7 where we test the remote connection.  When I go to "https://embyunraidtest.duckdns.org" I get a timeout error when trying to connect.  I feel like I am almost there, but missing a crucial step.  I appreciate the help so far

if this is public facing. You can always use a proxy site and connect to yourself.

https://www.proxysite.com/

Okay I've made pretty good progress in the last day.  I was wary about my ports not reporting as opened, so I dug a little into that.  I noticed there are 3 separate IP addresses I needed to be aware of.  My Public IP from my ISP, my Internet IP from my router, and my local IP of my UnRAID machine.  I went into my gateway and set ports 80 and 443 of the Public IP to ports 80 and 443 of my Internet IP.  Then I went into my router and confirmed ports 80 and 443 of my Internet IP were being sent to ports 9090 and 9443 of my local IP.  After checking on yougetsignal.com I can see that <Public IP> ports 80 and 443 are now both being reported as open.

 

I was also wary of duckDNS, so I purchased a domain through cloudflare and made sure to set the CNAME filter for emby.domain.url, and an A filter to my Public IP.  I edited the emby network settings and the nginx proxy .conf file, but am still having trouble.  SWAG seems to be working fine at the moment, I am just running into trouble connecting to emby now.

 

I continued with the guide and set all the proper emby settings but now run into connection issues.  When I go to my browser, I can navigate to <Public IP>:80 and <Public IP>:443 and see the SWAG landing page.  However, if I navigate to emby.domain.url, I am met with an error saying the page isn't redirecting properly.

Edited May 23, 20242 yr by Pulk

Good job, looks like you're almost there. Can you post your swag configs? The emby.conf and default.conf which should be one directory up I think. And have you installed the cloudflare ddns app? I'm in the process of data recovery so I can't log into my emby and check, but what does it say in the dashboard where it lists your local IP and  domain. Does it say port 443 or 8920 or something for your domain?

And when you went to your domain did you use http or https? 

I've attached screenshots of the emby.subdomain.conf and default.conf files below.  I've not downloaded the cloudflare ddns app, is it necessary?  In my emby dashboard it lists the local LAN as http://<Emby Container IP>:8096 and remote WAN as https://emby.domain.url.  I tried both http and https when trying to connect to WAN and both gave the same result of failing to redirect (eg: http://emby.domain.url and https://emby.domain.url both report the webpage failed to redirect properly).

 

You need an ddns app to always have your public IP synced with your domain. Same as you had with duckdns. So your CNAME is just emby right? Then you point your domain to that. And your container name is binhex-emby?

When I set up reverse proxy with emby I think I had to edit a config file in emby and set the https port to 443. Don't remember exactly where in the config file, but I remember I couldn't get it to work without it. That was many years ago so it might not be needed now, but worth a try.

Okay, I've uninstalled the duckdns container and installed the cloudflare-ddns container from Oznu.  My CNAME is just emby, container name is binhex-emby, and I've set the HTTPS port to 443 in emby network settings.  Still the same behavior with not redirecting properly.  Trying from another browser I can see the error is too many HTTP redirects, maybe this can help point to what's wrong?

Isn't there a setting in cloudflare about redericts, maybe turn it off. Since swag is already doing that.