Great guide and even better timing! Solved a problem I just couldn't sort out myself with NPM running in a LXC container on Proxmox. Everything up, running and working now. Thanks Frank, you're a star!
I have an existing instance of npm running on Synology NAS and pihole running on a separate raspberry pi (not involved at all with npm).. even after watching and trying this I cannot understand how to make this setup work for internal only use. The part that is still very confusing is the npm_network vs npm_zbridge, why and what they are doing. Maybe it would make more sense to move npm to the pi and run both in docker instead of bare metal? or pihole to the NAS? Thoughts?
Enjoyed the video. Silly question, when referencing the "Accessing Synology Services with Cloudflare..." video, should one follow that entire video/guide prior to completing the steps in this video?
Thanks for the video. 2 quick questions- 1. Is this necessary if you are not exposing the services to the internet? 2. Can you create a quick guide on changes we need to do on Pfsense if we want to run NPM inhouse along with Cloudflare? Thanks
Definitely not necessary - it's mainly for usage and there are a few services that require a reverse proxy to work (Vaultwarden is one of them), and if you don't want to expose it externally, this is one way to do it. There aren't really any changes on the pfSense side. You would just create a DNS record in the DNS resolver rather than using Pi-hole.
Thanks for this great guide. I was able to get it working on my Synology NAS with no issues. I am curious, could I use Tailscale to access my web apps through my tailnet while away from my local network?
Thanks! Yes, you should be able to if you configure a DNS server in Tailscale, but if you're accessing them remotely and using Tailscale on the same NAS, you probably have to use the bridge IP.
Great video--thank you! I used your previous guide for Adguard but decided to uninstall it completely to use Pihole+NPM. I was having noob issues getting adguard to work with npm (network/macvlan etc). Could you do a follow-up guide to make this work well with Tailscale? I know you can set a local DNS in Tailscale, but I was having issues connecting to devices. I'm debating just going back to OpenVPN on my router because I could not get my off-network tailscale device to resolve anything DSM related (NAS is enabled for subnet routing with tailscale, and is running Pihole + NPM.)
Thanks! If you're running Tailscale on the NAS, it makes it more complicated because you have to use the bridge network IP as opposed to the NPM IP, but it adds a lot of complexity. I'm not sure I'd do this with that setup if I'm being honest.
Sorry for my stupid beginner question. When I have a domain I own and forward my services to the web with cloudflare at 443, doesn't it mean I have an open door for public to access my services? E.g. Synology DSM?
I'm running my NAS on a 12 hours daily basis. Is it possbile to outsource the task to my raspberrypi that is running 24/7? I mean it should make no difference right?
Thank you for this video and tutorial. This is exactly what I need. Just a couple of questions though. Can you explain again the npm_network and npm_bridge for? I think you mentioned these in the video but my thick head is just not getting it. Is this for bridging all the containers running on the Container Manager? Also, I already have pihole running on raspberry pi, and I have my docker containers running on portainer on my NAS, do I just use the generic Docker Compose file for the reverse proxy?
The bridge is strictly used for NAS to Container communication. Since we're using a macvlan network interface (npm_network), the NAS cannot communicate with the NPM container through the npm_network - that's what we're using the bridge for. The gateway (.1) is the NAS, and the IP (.10) is the container. Yes, if you have a separate server, the generic Docker container will do what you're looking for!
@@WunderTechTutorials Hi! Me again :) I cannot get a wildcard SSL certificate on my Cloudflare domain; it's just timing out. Do I need to run the cloudflared tunnel like in the other video you referenced?
@@WunderTechTutorials Hi Frank, thanks for your response. I figured out what was wrong. The container log showed that it couldn't connect to pypi to install the cloudflare module. The docker-compose has the bridge with higher priority than the macvlan network, but the bridge network doesn't have an outside route; only the macvlan network does. So, I temporarily removed the bridge from the container, and then I was able to pull a cert. But if I put the bridge back, this would fail when it comes time to renew the cert, right? And I need that bridge.
Nice video I actually use macvlan on Synology but in different VLANs over a LAGG. Btw I tried in NPM to to set it as well for the Synology drive app, but it's not working, because the app needs two ports. Do you know how to set it in NPM?
Thanks! Did you set it up as a login portal in DSM and assign a port to it? If so, you should be able to use that port - I show it towards the end of the video.
@@WunderTechTutorials Yes, but the problem is when you use the APP, the connections from the appp is done under port 6690, on which the NMP is not listening. And I do not know how to set NPM to listen on this port.
@@MiFonito The app works for me using the method shown in the video. That's how I've been running it, but you can't have two ports for one reverse proxy rule either way.
@@WunderTechTutorials hmm interesting than I probably have somewhere a missconfig in the NPM. I will review it. Many thanks for the input! You gave me some ideas on what to check. Also to be more clear I am speaking about the Mobile or Desktop app client.
By creating macvlan network in docker compose it re-creates the network every time you restart right? I created mine in terminal but have to run a script so that it recreates every time restart NAS.
No, it should create it once (assuming you don't have any other network interfaces with the same name), and it'll reference it every time it starts, but only create it the first time. I just confirmed on my test setup that it all works as expected after a reboot.
@@WunderTechTutorials Thanks, I think it's because the method I was using was creating a nother macvlan interface on the host that communicates with the docker containers on another macvlan network, but it gets removed with each restart. Your way is much better, will redo everything and follow your guide.
So, I got to the point where I set up the DNS record in Pihole, I'm using Duck DNS. when I entered the domain for NPM in the browser it say server not found. What am I doing wrong?
so the DNS record (xyz.subdomain.duckdns.org) is pointing to the NPM server? And you have a proxy host record in NPM with the correct HTTP/HTTPS, server IP, and port?
Great guide and even better timing! Solved a problem I just couldn't sort out myself with NPM running in a LXC container on Proxmox. Everything up, running and working now. Thanks Frank, you're a star!
Glad to hear it helped! Thanks for watching!
I was looking exactly for this. Thanks in advanced. You are the best 🙌
Excellent video Frank, this is definetly one of the best guides on the topic to date. everything is explained beautifully and clearly. excellent job!
Thanks, Avi! Appreciate you watching!
Love your videos! Quick question! Do you have to create an A record in CloudFlare for your subdomain?
I think you are using pfsense as a router/fw. It would be good if you can prepare some of pfsense videos for us :) rules etc
I'll add it to my list! It's hard for me to tell how much interest there is in pfSense videos.
Long live NGINX PM!
I have an existing instance of npm running on Synology NAS and pihole running on a separate raspberry pi (not involved at all with npm).. even after watching and trying this I cannot understand how to make this setup work for internal only use. The part that is still very confusing is the npm_network vs npm_zbridge, why and what they are doing. Maybe it would make more sense to move npm to the pi and run both in docker instead of bare metal? or pihole to the NAS? Thoughts?
Enjoyed the video. Silly question, when referencing the "Accessing Synology Services with Cloudflare..." video, should one follow that entire video/guide prior to completing the steps in this video?
Thanks! No, only the first part where you connect the domain to Cloudflare. Then you can pick back up here.
Great video! I’ll try if this setup works with Photostation and custom subdomain. Thanks!
Thanks for the video. 2 quick questions-
1. Is this necessary if you are not exposing the services to the internet?
2. Can you create a quick guide on changes we need to do on Pfsense if we want to run NPM inhouse along with Cloudflare?
Thanks
Definitely not necessary - it's mainly for usage and there are a few services that require a reverse proxy to work (Vaultwarden is one of them), and if you don't want to expose it externally, this is one way to do it.
There aren't really any changes on the pfSense side. You would just create a DNS record in the DNS resolver rather than using Pi-hole.
@@WunderTechTutorials Thank you for your response.
Thanks for this great guide. I was able to get it working on my Synology NAS with no issues. I am curious, could I use Tailscale to access my web apps through my tailnet while away from my local network?
Thanks! Yes, you should be able to if you configure a DNS server in Tailscale, but if you're accessing them remotely and using Tailscale on the same NAS, you probably have to use the bridge IP.
Great video--thank you! I used your previous guide for Adguard but decided to uninstall it completely to use Pihole+NPM. I was having noob issues getting adguard to work with npm (network/macvlan etc). Could you do a follow-up guide to make this work well with Tailscale? I know you can set a local DNS in Tailscale, but I was having issues connecting to devices. I'm debating just going back to OpenVPN on my router because I could not get my off-network tailscale device to resolve anything DSM related (NAS is enabled for subnet routing with tailscale, and is running Pihole + NPM.)
Thanks! If you're running Tailscale on the NAS, it makes it more complicated because you have to use the bridge network IP as opposed to the NPM IP, but it adds a lot of complexity. I'm not sure I'd do this with that setup if I'm being honest.
Excelente!!!
Lo Andaba Buscando!
Sorry for my stupid beginner question. When I have a domain I own and forward my services to the web with cloudflare at 443, doesn't it mean I have an open door for public to access my services? E.g. Synology DSM?
Yes, if you expose them to the web. This tutorial (assuming you're following it), doesn't expose anything to the Internet.
Thanks!
Very nice video thanks. This method doesn’t expose anything externally to the wider internet this is just for internal lan usage correct?
Thanks! Correct, just for internal usage.
@@WunderTechTutorials that's awesome will give it a go tonight on prox. thanks!!
Great Video! I am using Unbound-DNS from opnsense. There is no CNAME possibility. What to do? Thanks!
Thanks! Do you have an alias option?
you can create a wildcard A record and point it to the IP of the npm. Then you won't have to add cnames each time you create a sub domain.
I'm running my NAS on a 12 hours daily basis. Is it possbile to outsource the task to my raspberrypi that is running 24/7? I mean it should make no difference right?
Absolutely! Should run great on a Pi.
Thank you for this video and tutorial. This is exactly what I need. Just a couple of questions though. Can you explain again the npm_network and npm_bridge for? I think you mentioned these in the video but my thick head is just not getting it. Is this for bridging all the containers running on the Container Manager?
Also, I already have pihole running on raspberry pi, and I have my docker containers running on portainer on my NAS, do I just use the generic Docker Compose file for the reverse proxy?
The bridge is strictly used for NAS to Container communication. Since we're using a macvlan network interface (npm_network), the NAS cannot communicate with the NPM container through the npm_network - that's what we're using the bridge for. The gateway (.1) is the NAS, and the IP (.10) is the container.
Yes, if you have a separate server, the generic Docker container will do what you're looking for!
@@WunderTechTutorials Oh gotcha! Thanks again.
@@WunderTechTutorials Hi! Me again :) I cannot get a wildcard SSL certificate on my Cloudflare domain; it's just timing out. Do I need to run the cloudflared tunnel like in the other video you referenced?
@@CelsoBarriga No, you should just be able to use the Cloudflare token. Did you set the permissions properly?
@@WunderTechTutorials Hi Frank, thanks for your response. I figured out what was wrong. The container log showed that it couldn't connect to pypi to install the cloudflare module. The docker-compose has the bridge with higher priority than the macvlan network, but the bridge network doesn't have an outside route; only the macvlan network does. So, I temporarily removed the bridge from the container, and then I was able to pull a cert. But if I put the bridge back, this would fail when it comes time to renew the cert, right? And I need that bridge.
Nice video I actually use macvlan on Synology but in different VLANs over a LAGG. Btw I tried in NPM to to set it as well for the Synology drive app, but it's not working, because the app needs two ports. Do you know how to set it in NPM?
Thanks! Did you set it up as a login portal in DSM and assign a port to it? If so, you should be able to use that port - I show it towards the end of the video.
@@WunderTechTutorials Yes, but the problem is when you use the APP, the connections from the appp is done under port 6690, on which the NMP is not listening. And I do not know how to set NPM to listen on this port.
@@MiFonito The app works for me using the method shown in the video. That's how I've been running it, but you can't have two ports for one reverse proxy rule either way.
@@WunderTechTutorials hmm interesting than I probably have somewhere a missconfig in the NPM. I will review it. Many thanks for the input! You gave me some ideas on what to check.
Also to be more clear I am speaking about the Mobile or Desktop app client.
My apologies, I thought you meant the mobile app. Right now, this will not work with the desktop app.
By creating macvlan network in docker compose it re-creates the network every time you restart right? I created mine in terminal but have to run a script so that it recreates every time restart NAS.
No, it should create it once (assuming you don't have any other network interfaces with the same name), and it'll reference it every time it starts, but only create it the first time. I just confirmed on my test setup that it all works as expected after a reboot.
@@WunderTechTutorials Thanks, I think it's because the method I was using was creating a nother macvlan interface on the host that communicates with the docker containers on another macvlan network, but it gets removed with each restart. Your way is much better, will redo everything and follow your guide.
So, I got to the point where I set up the DNS record in Pihole, I'm using Duck DNS. when I entered the domain for NPM in the browser it say server not found. What am I doing wrong?
so the DNS record (xyz.subdomain.duckdns.org) is pointing to the NPM server? And you have a proxy host record in NPM with the correct HTTP/HTTPS, server IP, and port?
@@WunderTechTutorials yes, I'm stumped.
@@WunderTechTutorials Hmmm, it suddenly started working! Didn't change a thing. THanks for your help. Great video as usual.
Is it safe compared to Tailscale?
This is only for internal DNS resolution (though you could use it externally, but Tailscale is more secure in that regard).
cloudflare tunnel.... problem solved. No open ports etc.
This is for internal DNS resolution + cert.