Use local DNS Record (Cloudflare Tunnel 100MB Limit Workaround)

[Yavieh]

In this discussion, we’ll talk about using local DNS records to bypass this limit within the local network. By setting up a local DNS, we can route larger traffic locally while still using Cloudflare Tunnel for external connections.

Feel free to share your experiences and ideas!

This discussion was moved from here #1674

[Yavieh]

I've just set up 2nd option minutes ago and it is working great...when i am outside it uses cloudflare tunnel (only uploads <100mb) and when at home it goes locally

I am not an expert but here we go:

Go to your pihole: Local DNS - DNS Records and add:
-Domain: yourdomainorsubdomain.com
-Ip adress: localipwhereimmichisinstalled (without port)...Add it.
-Optional: flush dns at PC (open cmd console and write: ipconfig /flushdns) and at pihole update gravity under tools menu and also under settings menu go to system flush network table and restar dns resolver.

Install Nginx proxy manager and add a proxyhost:
-Domain name: yourdomainorsubdomain.com
-scheme: http
Forward Hostname / IP: localipwhereimmichisinstalled
-Forward port: portofimmich (usually 2283)
Tick: block common exploits and websockets support and Save.
No custom locations, no SSL, no Advanced settings is needed.

You can test it sending a ping at your local network to your domain and it should give you local ip. Use a vpn or mobile data and it should give you cloudflare's ip

I think that's all.

This was the last comment from camafive which i still got some Questions on.
How does nginx come in play here? The locas DNS Record directly links to the immich ip, so the nginx will never be reached or am i missing here something?

[tazire]

I was correct. So essentially what was happening in my case my port forwarding rule only applies to internet traffic. When the local DNS request was coming in this rule didn't apply and NPM internally is listening to port 1880 and 18443. I changed these to 80 and 443 and changed my port forwarding etc and it now works

[Yavieh]

I also got it working for my setup 🎉
Currently I got cloudflare tunnel where I also define the routes to the local instances like Immich and next cloud and co.
Then I got a npm installed just for my local routing. The npm also has the ssl cert for my domain otherwise it would not work for me as in the app I set up the url via https.
Then I got a dns record in my local adguard which is redirecting my Immich domain to my local npm which then proxies that to the Immich server.
Works perfectly 🤩
Now i can upload files bigger then 100mb in my local network. 🎉

[tehniemer]

Can anyone help me get this set up in a pfSense router using its DNS resolver and HAProxy?

[Yavieh]

Can anyone help me get this set up in a pfSense router using its DNS resolver and HAProxy?

Hey, im not familiar with that brand but i found this documentation which should be what you are searching for.

Im also not familiar with HAProxy. But it should work like any other reverse proxy i guess.

[tehniemer]

Thanks, I seem to have figured it out. I'll create a separate comment to outline the instructions for pfSense

[tehniemer]

I've managed to get this working using pfSense and its available packages. Here's how I went about it.

1. Install the acme and haproxy packages
2. Create an IP Alias to the Localhost interface, I used 192.168.100.1 for example. Firewall > Virtual IPs
3. Create a Host Override for the address pointing to whatever virtual IP you created in step 2. Services > DNS Resolver
4. Create an account key with your preferred ACME server. Services > Acme > Account Key
5. Create a certificate for your host/domain. I used a wildcard cert (*.domain.com), which forced the method to be a DNS challenge. But you could likely create a cert specific to the host without having to use DNS challenge. Services > Acme > Certificates
6. Click the "Issue/Renew" button when you are back on the certificates page
7. In HAProxy, create a backend with the address and port of your immich instance, leave the SSL boxes unchecked. Services > HAProxy > Backend
8. Create a frontend that listens on the IP from step 2 on ports 80 and 443. Check the SSL Offloading box in the entry for port 443. Services > HAProxy > Frontend
9. In the same frontend, create an access control list entry with the "host matches:" expression with a value of whatever the host and domain you used in the host override in step 3. Then in actions, set "Use Backend" with the condition set to the name of the ACL you just created and set the backend to the name of the backend you created in step 7. Finally, select the certificate you created in step 5 in the SSL Offloading section.

If all goes as planned, your service will be available on the domain of your choosing and when you ping it, it will return the IP Alias you set up instead of your public IP or IP of your registrar.

[SircasticFox]

I was fighting this issue for a while as well. Being behind a CGNAT and not having a public accessible IPv4 address I used cloudflare for immich to be reachable in countries where IPv6 coverage is quite bad (e.g. on vacation to backup my photos). But well, there comes to upload limit. Long story short, for this usecase unfortunately a local DNS doesn't really help me.

I solved this issue by completely getting rid of cloudflare and routing all the traffic through a VPS (that I already run anyway). My immich FQDN now points to my VPS IPv4 address which just routes the traffic to my Immich Instance. On the VPS I use Traefik for this.

Not a solution to keep cloudflare, but for people behind a CGNAT who used cloudflare to make Immich accessible everywhere.