Nginx Proxy Manager on a separate VLAN

What is it?

This project started as a desire to step away from Cloudflare Tunnels and its terms of service. But I wanted something more secure that forwarding ports 80 and 443 to a Docker container on my main network.

So I had an idea: what if I set up Nginx Proxy Manager (NPM) on a Raspberry Pi that sits on a separate, locked down VLAN? In theory, it's a simple idea. Just keep the VLAN from talking to the main LAN (or my other IoT VLAN), but let any device on the primary network talk to the proxy VLAN. At the same time, the proxy manager should be able to talk to the server that hosts my Docker containers.

In practice, this project took a lot more work than I thought, but I did eventually figure it out.

What do you need?

Obviously, you need some services to expose publicly, such as Jellyfin, running on a server on a network. Secondly, you need the ability to create VLANs on your router. (I use a UniFi Dream Machine.) You'll need to create the firewall rules to establish the secure setup.

Next, you need a separate server on a different VLAN to run Nginx Proxy Manager or whatever you want to use. NPM just happens to be what I'm most familiar with, but I imagine it should work just as well with Traefik or something similar.

Theoretically, you could build a separate virtual machine (VM) and section it off to the proxy VLAN, but I didn't test this.

How do you do this?

I won't outline all of the steps here. However, I will have full documentation and an accompanying blog post, Proxying Docker containers on a separate VLAN.