Use local DNS Record (Cloudflare Tunnel 100MB Limit Workaround)

[Yavieh]

In this discussion, we’ll talk about using local DNS records to bypass this limit within the local network. By setting up a local DNS, we can route larger traffic locally while still using Cloudflare Tunnel for external connections.

Feel free to share your experiences and ideas!

This discussion was moved from here #1674

[Yavieh]

I've just set up 2nd option minutes ago and it is working great...when i am outside it uses cloudflare tunnel (only uploads <100mb) and when at home it goes locally

I am not an expert but here we go:

Go to your pihole: Local DNS - DNS Records and add:
-Domain: yourdomainorsubdomain.com
-Ip adress: localipwhereimmichisinstalled (without port)...Add it.
-Optional: flush dns at PC (open cmd console and write: ipconfig /flushdns) and at pihole update gravity under tools menu and also under settings menu go to system flush network table and restar dns resolver.

Install Nginx proxy manager and add a proxyhost:
-Domain name: yourdomainorsubdomain.com
-scheme: http
Forward Hostname / IP: localipwhereimmichisinstalled
-Forward port: portofimmich (usually 2283)
Tick: block common exploits and websockets support and Save.
No custom locations, no SSL, no Advanced settings is needed.

You can test it sending a ping at your local network to your domain and it should give you local ip. Use a vpn or mobile data and it should give you cloudflare's ip

I think that's all.

This was the last comment from camafive which i still got some Questions on.
How does nginx come in play here? The locas DNS Record directly links to the immich ip, so the nginx will never be reached or am i missing here something?

[tazire]

I was correct. So essentially what was happening in my case my port forwarding rule only applies to internet traffic. When the local DNS request was coming in this rule didn't apply and NPM internally is listening to port 1880 and 18443. I changed these to 80 and 443 and changed my port forwarding etc and it now works

[Yavieh]

I also got it working for my setup 🎉
Currently I got cloudflare tunnel where I also define the routes to the local instances like Immich and next cloud and co.
Then I got a npm installed just for my local routing. The npm also has the ssl cert for my domain otherwise it would not work for me as in the app I set up the url via https.
Then I got a dns record in my local adguard which is redirecting my Immich domain to my local npm which then proxies that to the Immich server.
Works perfectly 🤩
Now i can upload files bigger then 100mb in my local network. 🎉

[tehniemer]

Can anyone help me get this set up in a pfSense router using its DNS resolver and HAProxy?

[Yavieh]

Can anyone help me get this set up in a pfSense router using its DNS resolver and HAProxy?

Hey, im not familiar with that brand but i found this documentation which should be what you are searching for.

Im also not familiar with HAProxy. But it should work like any other reverse proxy i guess.

[tehniemer]

Thanks, I seem to have figured it out. I'll create a separate comment to outline the instructions for pfSense

[tehniemer]

I've managed to get this working using pfSense and its available packages. Here's how I went about it.

1. Install the acme and haproxy packages
2. Create an IP Alias to the Localhost interface, I used 192.168.100.1 for example. Firewall > Virtual IPs
3. Create a Host Override for the address pointing to whatever virtual IP you created in step 2. Services > DNS Resolver
4. Create an account key with your preferred ACME server. Services > Acme > Account Key
5. Create a certificate for your host/domain. I used a wildcard cert (*.domain.com), which forced the method to be a DNS challenge. But you could likely create a cert specific to the host without having to use DNS challenge. Services > Acme > Certificates
6. Click the "Issue/Renew" button when you are back on the certificates page
7. In HAProxy, create a backend with the address and port of your immich instance, leave the SSL boxes unchecked. Services > HAProxy > Backend
8. Create a frontend that listens on the IP from step 2 on ports 80 and 443. Check the SSL Offloading box in the entry for port 443. Services > HAProxy > Frontend
9. In the same frontend, create an access control list entry with the "host matches:" expression with a value of whatever the host and domain you used in the host override in step 3. Then in actions, set "Use Backend" with the condition set to the name of the ACL you just created and set the backend to the name of the backend you created in step 7. Finally, select the certificate you created in step 5 in the SSL Offloading section.

If all goes as planned, your service will be available on the domain of your choosing and when you ping it, it will return the IP Alias you set up instead of your public IP or IP of your registrar.

[SircasticFox]

I was fighting this issue for a while as well. Being behind a CGNAT and not having a public accessible IPv4 address I used cloudflare for immich to be reachable in countries where IPv6 coverage is quite bad (e.g. on vacation to backup my photos). But well, there comes to upload limit. Long story short, for this usecase unfortunately a local DNS doesn't really help me.

I solved this issue by completely getting rid of cloudflare and routing all the traffic through a VPS (that I already run anyway). My immich FQDN now points to my VPS IPv4 address which just routes the traffic to my Immich Instance. On the VPS I use Traefik for this.

Not a solution to keep cloudflare, but for people behind a CGNAT who used cloudflare to make Immich accessible everywhere.

[Neo11Neo]

I just found out that in the immich app under settings > network you are able to setup automatic url switching. This means you can directly point to your immich instance when you are connected to your local wifi.

[d1egoaz]

Thanks, this solved the issue for me, I guess I can live without uploading my videos over mobile.

[dsquare86]

I am using NPM for reverse proxy, Pihole w/ Unbound for DNS, and using DNS proxy from Cloudflare.

Solution was to add custom DNS Masq .conf file calling any address in my domain as local with a local DNS entry in Pihole pointing to NPM.

[jondycz]

My setup allows me to access immich over the same domain over SSL:
• locally - no limit
• from the internet (100MB limit)
• using Cloudflare One (zero trust warp) - no limit

Prerequisite: Adguard home to route your domains to local IPs

1. I installed nginxproxymanager and created an immich host - this allows local access with SSL
2. I installed cloudflare tunnel and pointed my domain to nginxproxymanager so that I can manage all my subdomain in one place - this allows for external access with 100MB limit
3. I connected my devices to cloudflare zero trust over the Cloudflare One app
4. IMPORTANT! - I created a firewall rule in the zero trust dashboard to forward my immich domain to the LOCAL IP of my nginxproxymanager. By default cloudflare One (warp) does not allow setting a custom DNS resolver (only for a business plan) so I couldn't use my local DNS server (Adguard) to resolve the immich IP to a local one. So devices connected through warp always tried to access immich externally through the cloudflare proxy. But using the firewall rule, all devices connected through warp now resolve the domain to a local IP that is not affected by the 100MB upload limit.

TLDR: When you need to upload files larger than 100MB, turn on Cloudflare One on your device and make sure to set up firewall rules so that your domain gets resolved to your local IP address and skips the cloudflare proxy

[Luggi1900]

Problem Description

I tried to copy your setup, but it does not work for me.

What I have done so far

1. Set up TrueNAS SCALE

2. Installed the Immich app on TrueNAS

   • TrueNAS app exposure ports: 8443 / 8080

3. Configured external access via Cloudflare

   • Bought the domain my.immich.com
   • Created a Cloudflare Tunnel to access Immich from the internet

   This works fine, but I hit Cloudflare’s 100 MB upload limit.

4. Tried to bypass the limit using local DNS (Pi-hole)

   • Installed the Pi-hole app on TrueNAS
   • Created a local DNS record:

     my.immich.com -> local.ip
     

   • Configured my FRITZ!Box to use local.ip as a DNS server

5. Set up Nginx Proxy Manager for local HTTPS/HTTP

   • Installed the Nginx Proxy Manager app on TrueNAS
   • Changed NPM’s ports to 443 / 80
   • Added a Proxy Host with:
     • Domain Name: my.immich.com
     • Scheme: http
     • Forward Hostname / IP: local.ip
     • Forward Port: 30041 (Immich port on TrueNAS)
   • Tested both without SSL and with SSL
   • Added this config to Advanced Settings:
     • https://docs.immich.app/administration/reverse-proxy

Current Issue

Even from inside the local network, accessing my.immich.com always goes through the Cloudflare Tunnel instead of using the local DNS override and the reverse proxy.

DNS Debugging

When I run nslookup my.immich.com, I get the following result:

Server:   UnKnown
Address:  2a00:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx

Name:     my.immich.com
Addresses:
          2a06:xxxx:xxxx::x
          2a06:xxxx:xxxx::x
          192.168.x.x

If i run nslookup my.immich.com 192.168.x.x, I get this result:

Server:   my.immich.com
Address:  192.168.x.x

Name:     my.immich.com
Addresses:
          2a06:xxxx:xxxx::x
          2a06:xxxx:xxxx::x
          192.168.x.x

I tried disabling IPv6 on my FRITZ!Box and also blocking the AAAA record in Pi-hole.
In both cases, my.immich.com becomes completely unreachable from the local network instead of falling back to IPv4.

I would be very grateful if someone could help me solve this issue.

[jondycz]

You have to create a firewall rule if you want clooudflare tunnel to use your local DNS. Check my comment that describes how to do it in this thread

[Yavieh]

That should not be nessecarry if his local dns already routes the outgoing request to the local nginx.
I also dont have any cloudflare firewall setting.

[Luggi1900]

I made the following changes:

• I updated the Cloudflare Tunnel so it no longer points directly to Immich but instead to Nginx.
• I disabled IPv6 in my local network.
• I created a second entry using a subdomain that does not exist in Cloudflare and is only configured in my Nginx setup.
• I added a local DNS record in pi-hole for this domain
• I did not configure SSL for this domain (for my.immich.com, SSL is set up via Cloudflare using a DNS challenge).

Now, this is what happens when I try to access my2.immich.com in the browser:

• Normal browser tab: ERR_SSL_UNRECOGNIZED_NAME_ALERT
• Private/incognito tab: "my2.immich.com does not support a secure connection with HTTPS", with an option to continue. When I continue, I am redirected to Immich.

If I use a custom SSL certificate, it works fine in both cases.

When I try to access my.immich.com, this happens:

• From within the LAN:
  ERR_SSL_UNRECOGNIZED_NAME_ALERT or
  ERR_QUIC_PROTOCOL_ERROR, changing every few refreshs
• From the internet: the default Nginx landing page ("Congratulations! ... you’re trying to access a host that isn’t set up yet")

[Yavieh]

My suggestions would be to configure ssl certs within your nginx, so then you have ssl connections for both outside and local.

The second thing is, im not sure if your dns is working as intended.
Pls try this to see if your dns reroute works. I just did the same with my adguard dns:

Take any domain for example test.immich.com and reroute that to google.com
When accessing thst domain now, it should show a google error page. If that works, your dns settings are working as expected. If non, pls set your pihole as the one and only dns in your device settings and test again.

Let me know the result.

[Luggi1900]

I actually managed to solve the issue a while ago and realized I forgot to post an update.

Just for info: I already had the SSL certs set up in Nginx via Cloudflare DNS challenge.

I honestly have no clue why the problem occurred in the first place because I don't really have the technical understanding for it, but I fixed it with the following steps:

I kept everything as described in my first post, except for the advanced settings – those aren't needed at all. The actual solution was the configuration in Pi-hole.

Instead of a single local DNS entry pointing my.immich.com to my local.ip, I did this:

1. Created a CNAME record: my.immich.com pointing to immich.com.
2. Created a local DNS record: immich.com pointing to local.ip.

With this setup, it finally works and the traffic stays local. Thanks for the help anyway :D