Walkthrough: publish a web app

This walkthrough publishes a NAS web interface that runs on your LAN at http://192.168.1.20:5000 as https://nas.example.com, with a trusted Let's Encrypt certificate, through the reverse proxy. If your router is behind CGNAT, follow the Cloudflare Tunnel variant at the end instead.

You need:

• a domain whose DNS is hosted on Cloudflare (example.com here);

• a Cloudflare API token with Zone → Zone → Read and Zone → DNS → Edit on that zone (see Cloudflare API tokens);

• a public IPv4 address on the router's WAN, with inbound tcp ports 80 and 443 not blocked by your ISP.

1. Register the NAS

The proxy sends traffic to a registered host with a fixed address.

1. Open Hosts → Devices and find the NAS. Devices that aren't registered yet are listed while Show unregistered is on, which is the default.

2. Click Adopt on the NAS's row.

3. Set Name to nas and Static IP to 192.168.1.20. Suggest proposes a free address if you'd rather let the router choose. Leave Public hostname empty: that field points a name at the device itself, and would conflict with the route.

4. Click Adopt, then choose Save and apply from the Save menu.

5. Restart the NAS, or renew its DHCP lease, so it picks up the reserved address.

See Hosts and host groups for details.

2. Point the name at the router

nas.example.com has to resolve to the router's public address. The simplest way is to let the router publish it:

1. Open Network → Dynamic DNS and turn on Enable dynamic DNS.

2. Click Set token…, paste the Cloudflare token into API token, and click Save token.

3. Choose Save and apply from the Save menu.

Don't add nas.example.com to Router names. The reverse proxy's Publish hostnames switch, which is on by default, publishes every route hostname through dynamic DNS once the route exists. Listing it under Router names as well fails the build. See Cloudflare dynamic DNS.

If you'd rather manage the record yourself, turn off Publish hostnames in step 4, and create the record at your DNS provider: an A record with the router's public IPv4 address, or a CNAME to a name that already points at the router, such as home.example.com.

3. Set up certificates

1. Open Ingress → Reverse proxy.

2. In the Certificates card, fill in Contact email, such as admin@example.com.

3. Check I accept the Let's Encrypt Subscriber Agreement.

4. Leave Default challenge at HTTP (port 80). Let's Encrypt checks the name by fetching a file over port 80, which the proxy answers.

4. Add the route

1. Turn on Enable reverse proxy. Leave Publish hostnames on.

2. Click Add route and fill in:

   • Name: NAS

   • Hostnames: type nas.example.com and press Enter.

   • Host: nas

   • Port: 5000. If you're not sure of the port, click Scan ports and pick one from the list.

   • Scheme: http, since the NAS serves plain HTTP on port 5000.

   • Certificate challenge: leave it at Default.

   • HSTS: leave it off until everything works.

3. Click Add.

5. Save and apply

Choose Save and apply from the Save menu. The line beside the button shows Applying settings…, then Applied. The rebuild carries on if you leave the page; the System entry in Cockpit's menu shows it's running.

If Save and apply is disabled, the tab lists what's wrong under Fix these before applying. The troubleshooting table covers the usual causes.

6. Watch the certificate

The route's Certificate column shows Pending while the router serves a self-signed placeholder, or Renewing… while the order runs. When the order succeeds, it changes to Valid until and the certificate's end date. The status doesn't refresh on its own, so reload the page to update it.

If it stays Pending, or last renewal failed appears under it, the order failed. Check the name with dig +short nas.example.com, and read the order's log:

journalctl -u acme-order-renew-nas.example.com

Fix the cause, then click Renew now on the route to try again.

7. Test it

From outside your network, such as a phone on mobile data, open https://nas.example.com. The NAS login page appears with no certificate warning. From a computer outside the network you can also check the details:

dig +short nas.example.com A
curl -I http://nas.example.com/
curl -I https://nas.example.com/

• dig prints the router's public IPv4 address.

• The first curl gets 308 Permanent Redirect, with a location header pointing at https://nas.example.com/.

• The second curl gets the NAS's own response, such as 200 or a redirect to its login page, with no certificate error.

From inside, open the same URL on a laptop on the LAN. The name resolves to the router's WAN address, and the router's hairpin rule hands the connection to the proxy, so the public name works inside without any DNS changes.

Troubleshooting

Variant: behind CGNAT with Cloudflare Tunnel

Behind CGNAT, nothing on the internet can connect to the router over IPv4, so IPv4 clients can't reach the reverse proxy. Cloudflare Tunnel works anyway, because the router opens the connection to Cloudflare. It needs no certificate settings and no dynamic DNS: Cloudflare provides the certificate, and the router creates the DNS record.

1. Register the NAS as in step 1.

2. Create a token in the Cloudflare dashboard with Account → Cloudflare Tunnel → Edit, Zone → Zone → Read and Zone → DNS → Edit. See Cloudflare API tokens.

3. Remove other uses of the name. If you followed the steps above, delete the nas.example.com route on Ingress → Reverse proxy, or turn the proxy off. The name also can't be a dynamic DNS Router names entry or a host's Public hostname.

4. Open Ingress → Tunnel. Click Set token…, paste the token into API token, and click Save token.

5. Turn on Enable Cloudflare Tunnel.

6. Click Add hostname and fill in Hostname nas.example.com, Host nas, Port 5000 and Scheme http. Click Add.

7. Choose Save and apply from the Save menu.

8. In the Tunnel status card, click Sync now. Last sync shows ok, nas.example.com shows ok under the DNS records, and the tunnel's status turns healthy once the connector is connected.

Then open https://nas.example.com from outside. It works from inside too: the name resolves to Cloudflare, so LAN clients go out to Cloudflare and come back through the tunnel.