IP forwarding with Nginx Proxy Manager (NPM)

[TheDreadPirate]

Can you add the host's IP to the known proxies? I'm assuming 192.168.X.X or something like that. I'm thinking that since you are using port publishing the traffic's "last hop" is still coming from the host? Or something like that.

On my setup, I only have the bridge network's gateway as a known proxy with plain Nginx on the host as the reverse proxy. So I'm not sure what I'm overlooking here.

[Ploutos]

Ok I add the local IP of my NAS (https://litter.catbox.moe/q3akqu.png) and restard Jellyfin

and it is still not working

[Ploutos]

In my docker network inspect bridge I read an odd response at the end (https://privatebin.net/?eeabc2f956e5940d...cw3f1hK82K)

"com.docker.network.bridge.enable_ip_masquerade": "true", maybe I can disable this !

Can you tell me if this is enable in your installation ? I can try to find a way to disable this dont you think ?

---

But I'm scared that the paquet wont be able to find their way out of the network if I disable this ...

[TheDreadPirate]

My bridge network "options" are empty. But yours being set to true isn't unusual. Docker's documentation says that is true by default.

https://docs.docker.com/engine/network/d...e/#options

So even though mine isn't explicitly set, it is probably true? I didn't do anything special with my bridge network. From what I'm reading, ip_masquerade should be set to true and the description of the option does not appear related to this problem.

Code:

networks:
  blackmoon:
    ipam:
      driver: default
      config:
        - subnet: '172.16.100.0/24'

And the Jellyfin container portion.

Code:

networks:
      blackmoon:
        ipv4_address: 172.16.100.10
    expose:
      - 8096

"expose" isn't necessary for your setup since Nginx Proxy Manager is in the same bridge network.

I'll have to do some testing this weekend and get back to you. I need to replicate your setup on my desktop.

[Ploutos]

I really thank you

Tell me if you forfeit,

Maybe it is impossible to IP forward with Nginx Proxy Manager ?

Well I will try a few things on my own

Thanks for everything from France <3

[Ploutos]

I tried to disable the native Nginx installed on DSM (Synology Operating System) but it is making crash a lot of things, for example Docker ...

I also tried to change the configuration of Nginx Proxy Manager so that the HTTP and HTTPS port are not 80 and 443 so I can put the NPM container in host network.
But every time I start the container NPM fail to start.

Mmmmh

---

I try to find an explaination of why when both container (NPM and Jellyfin) are in the same network the client IP is NATted by the gateway of the Docker "bridge" network.

It should act like a switch not a NAT

[TheDreadPirate]

I tried to replicate your setup as close as possible and I can't get it to behave the same. When I typed in the bridge IP for Jellyfin in my browser, bypassing Nginx Proxy manager, it did report the bridge gateway as the client IP. But accessing Jellyfin through Nginx with my fake domain always reported my client's actual IP. I didn't even have to set a known proxy. I only have "proxy_buffering off" in the advanced tab.

The default docker bridge also doesn't have any options set.

The only thing that makes sense at this point is that Synology is doing something that I can't replicate.

Code:

[
    {
        "Name": "docker_default",
        "Id": "aa3e2d657cf1be32a31c2cab1718674d96718fc51792f1816c3789d8ca2c8b36",
        "Created": "2025-02-15T12:27:24.69189096-05:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.18.0.0/16",
                    "Gateway": "172.18.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
            "17e8baf3ef27984148e9ce3a34f8e050349672bb6bd8f6d02328d8e70ec818eb": {
                "Name": "nginx",
                "EndpointID": "7ff225f51b676445255ccc8f0534be4e99aba324be83c0fcad87c7c9fcb397bb",
                "MacAddress": "02:42:ac:12:00:03",
                "IPv4Address": "172.18.0.3/16",
                "IPv6Address": ""
            },
            "99d687774ec2de69cd913b745418fd984b0ab33b2181bbd76aca47c7f30b350c": {
                "Name": "jellyfin-testing",
                "EndpointID": "2bf23cc502963ac5473d03036c66ee3a78189ceff7c5363599c15ef85d915560",
                "MacAddress": "02:42:ac:12:00:02",
                "IPv4Address": "172.18.0.2/16",
                "IPv6Address": ""
            }
        },
        "Options": {},
        "Labels": {
            "com.docker.compose.network": "default",
            "com.docker.compose.project": "docker",
            "com.docker.compose.version": "2.28.1"
        }
    }
]

[Ploutos]

Yeah It's probably an issue with the Synology OS, it is not a big deal I'm going to learn how to use Nginx (natively installed on DSM) without the UI.

Thanks a lot for your time and your patience

<3

[Southpawz]

I was having the same problem as described in this thread. To get the bridge proxy recognizing LAN hosts correctly, the known proxy should be set to 172.17.0.1 - the NAT IP (in my case), not the NPM container IP (172.17.0.x)