Hi everyone!

I have a strange issue with my NPM setup. It was working fine for many months, but since the integration of Tailscale to Docker, I have accessed my services less through it. Yesterday I tried to do it and got an error 504 after the Cloudflare access authentication.

(clearification: I use tailscale integration for docker only I acces remotely, but for those which need normal remote acces i have a reverse proxy setup)

Looked it up, and found that the issue is between the nginx proxy manager docker and the other docker containers. Tried a lot of troubleshooting, both using the forums, Reddit, and AI.

But nothing worked and I feel lost.

My setup is:

• domain through cloudflare

• Cloudflared docker updating the ip

• Unraid server

  • running 7.1.4

  • on .18 ip addreess

  • docker is using the macvlan network type

  • Host access to custom networks disabled

• NPM container

  • using the official image from the CA store

  • using br0 network

  • with a .11 ip address

  • listening on the default ports of 80 and 443

• Router

  • forwarding ports 80, 443 from the wan to the NPM

So far I've tried:

• curl/ping the containers from the npm container with the result of host unreachable

• changing to ip vlan network type

• toggling the host access to custom networks option

I don't know what else I can try or what might be causing the issue. I also can't pinpoint when the issue started. The only thing I changed recently in my setup was a managed network switch, but that's 1gig and my server sits on the 2.5G one, so I don't think that causes the issue.

If anyone has any ideas, I'm all ears!

if implementing tailscale its usual tail scale via side car / tsproxy and the need of 1 npm(Ngin proxy manger) per container shared over tail scale...
each docker that you want over tailscale would need their own npm and tailscale integration.

this means plex > npm to go to plex >npm tailscale setup > tailscal get to plex via npm
immich neeed a new npm and another tailscal addon to the new npm to use immich over tail scale...

some dockers web server and systems need adational headers and tailscal can be fincay with the serve/funnel options to get npm working...

https://docs.immich.app/administration/reverse-proxy/

Edited October 28, 2025Oct 28 by bmartino1
spelling - forum werdness with links

what is it your trying to do?

xyz? > ?npm > ?tailscale or cloudflare dns > ? world wide access?

All I can say for now is if you're using br0 networking for containers you need to enable the host access setting in docker settings: (set to enabled)

It will flat out not be able to reach other containers on bridge/host network modes if you don't.

Honestly, you really shouldn't be using br0. You would be better off just keeping it on bridge network and moving the unraid webgui ports off of 80 and 443 to something else like 81 and 4430.

Edited October 29, 2025Oct 29 by MowMdown

On 10/28/2025 at 7:30 PM, bmartino1 said:

what is it your trying to do?

xyz? > ?npm > ?tailscale or cloudflare dns > ? world wide access?

Internet->npm->docker

As I mentioned I have a few things which need outside acces, like game servers.

But I updated the npm docker and it started working again fortunately.

On 10/29/2025 at 1:38 PM, MowMdown said:

All I can say for now is if you're using br0 networking for containers you need to enable the host access setting in docker settings: (set to enabled)

It will flat out not be able to reach other containers on bridge/host network modes if you don't.

Honestly, you really shouldn't be using br0. You would be better off just keeping it on bridge network and moving the unraid webgui ports off of 80 and 443 to something else like 81 and 4430.

What's the problem with br0?

it has to do with docker custom br0 ipvlan/macvlan and docker isolaton.

under docker settings if host access to custom networks is disabled unraid will not make a shim bridge to have teh docker on host, bridgemode or inteh custom br0 comunicate with each other. this is due to docker netwrok isolation.

So traffic entering the npm docker can't reach my local network? But can it reach other containers?

11 minutes ago, socioeconomic-forecast2975 said:

So traffic entering the npm docker can't reach my local network? But can it reach other containers?

Depends on your network settings and how npn and your local network is configured. I can't say one way of the other as I don't know your network layout. in theory yes. in theory no. some settings need to be changed, fixed and checked. not eouth info to say which way one or the other...

as example, my recomend unraid running network settings. especaly when using tailscale or a reversy proxy like npm, cady, trefek.... etc.

Is your npm docker using ipvlan or macvlan? what docker network? did you give it a static ip?


SO lets see what I run ... example how unriad makes the hyperv network is dictated in the vm settings:

this should be br0 so new vms created will get a lan ip... default is vmbr which is a unraid dhcp server that give it internet but not always lan access....

Similar docker network settings can affect traffic. I personally prefer macvlan...



this is because I want my dockers to be lan independent and have their own mac and not share a layer3 mac that can cause network routing issues.

and general network setup are you using bridge mode? Bonding have multiple network nics?

all of this can affect if a docker is able to traverse the network on the unraid host and on the lan via the router.

Edited November 2, 2025Nov 2 by bmartino1
spelling

On 11/2/2025 at 10:58 AM, socioeconomic-forecast2975 said:

So traffic entering the npm docker can't reach my local network? But can it reach other containers?

With using br0 networking, and not enabling host access, traffic through NPM will be able to access your LAN network EXCEPT for anything running on unraid. Unraid becomes a black hole until you enable it.

IMO there is zero need to even use br0 networking or assigning custom IPs for individual containers.