Access local instance while on local wifi?

[leonardochaia]

Hi guys.
I am trying to implement cloudflared so I can remove my router's port forwarding.
Before cloudflared I was using nginx proxy manager with lets encrypt DNS challenge (for other sites) and port forwaring 80/443 to my homeassistant box. On my local DNS server (adguard) I set up a redirect rule for my home assistant domain pointing to the home assistant box. This decreases latency as it's all LAN traffic.

I wanna replicate the last bit of my previous setup by using cloudflared. This is what I did:

1. I installed cloudflared and configured my homeassistant domain as external hostname.
2. Everything works great from outside my network, but traffic inside the network is being routed through the tunnel increasing latency
3. So I setup my local DNS to rewrite traffic to my Nginx proxy manager, which has a Let's Encrypt cert.
4. Now everything works great locally; latency decreased. However, external access has been broken with invalid cipher error

I don't really know how these cloudflare tunnels work but I assume the certificate on the edge must match with the origin?
I haven't changed any settings on cloudflare yet. I was about to turn off Universal SSL but I guess it is not gonna work cause of this:

Similarly, any HTTP redirect to HTTPS at the origin while the Cloudflare proxy is enabled will result in users being unable to visit your site without a valid certificate at Cloudflare’s edge.

Has anyone implemented something similar?

Thanks!
Leo

[brenner-tobias]

Hi Leo,

for my local connections, I am using the IP of HA in the App (mapped to the Wifi Network so the app knows when to use local and when not) and for my browser I simply do not mind the added latency. Nevertheless, I get your point and agree that a "perfect" set-up does route your local traffic to HA via the internal IP and not the tunnel.

Now what I do not understand: How you "ruined" your external connection by changing the local DNS. I would also not use NPM in this process, but only HA itself. My approach would be the following:

1. Configure the Cloudflared Add-on with your hostname for HA
2. Get the origin certificates from Cloudflare and put them on your HA, configure the https integration accordingly. You could also put them on your NPM, but I do not really see a need for that. If you do not want to encrypt your LAN connection with https, you can skip that step.
3. Add a local DNS rewrite to the local IP of HA (or NPM).

[leonardochaia]

Hi Tobias thanks for the help and the awesome addon 👍

Now what I do not understand: How you "ruined" your external connection by changing the local DNS.

Is it possible it has to do with Lets encrypt? perhaps the _acme-challenge record. I am not sure what broke the tunnel but I don't think it's local DNS.

I didn't know about the origin certificate. Will take a look tomorrow but if the cert is signed by a trusted CA then it may work

Thanks!
Leo.

[leonardochaia]

So.. My issue was I changed from assistant.mydomain.com to assistant.homelab.mydomain.com at some point and that broke the SSL cert generated by cloudflare.

After changing back to assistant.mydomain.com and chaing the DNS rewrite rules it seems to be working as expected!

Sorry for the confusion, and thanks for the help :)

[leonardochaia]

Quick question: if I use a custom config on cloudflared and redirect all traffic to nginx proxy manager on SSL 443, I could turn on strict SSL on cloudflare right? cause my origin is being served by a trusted CA?

EDIT: smth like this?

ingress:
    - service: https://a0d7b954-nginxproxymanager

[brenner-tobias]

yes exactly, you can turn on strict SSL, which I also recommend.
Regarding the subdomain: The issue is, that Cloudflare only provides SSL certificates for a first level sub-domain in the free tier.

[brenner-tobias]

you can actually use the included flag "nginx_proxy_manager: true" which does basically what you are stating in your example

[leonardochaia]

that Cloudflare only provides SSL certificates for a first level sub-domain in the free tier.

Yeah, first time using cloudflare so I didn't know that. I was using a second level subdomain on my old place but, oh well, I'd rather have the tunnel.

you can actually use the included flag "nginx_proxy_manager: true" which does basically what you are stating in your example

Ah, I see I think I misunderstood the docs. I thought that nginx_proxy_manager: true" would keep routing my external hostname to homeassistant:8123 and ALSO add all nginx proxy manager hosts.

Will try that 👍
Thanks for all the help!