I have a bunch of services running on my LAN, mostly from a single Debian machine. I access them at URLs like http://devicename.lan:portnumber. I would like to change to http://servicename.devicename.lan.
How it works now: The router (openwrt) sets a static IP per device and the port number is selected by the application or system unit running it.
What is the absolute simplest way to accomplish this? I don’t mind if it is managed by the router or by the server machine itself. Hoping for something that can be configured with a text file or web interface or other basic mathod.
These sevices are private, just for me and I have no plans to ever access them externally. I have so far avoided any certificates or SSL or other stuff. I don’t use docker and would rather not get into it right now. I like my domain name setup how it is with fake local domains.
Hoping this could be possible without making a whole project out of it.
You want a reverse proxy. A reverse proxy reads requests to subdomains and then forwards them to ports and back.
The easiest GUI one is: https://nginxproxymanager.com/
But there is also just straight nginx, or you can use Caddy or traefik or anything else.
One benefit of Caddy over NPM: local certificates.
The latest selfh.st newsletter linked to a relevant video:
You can use local certs with nginx proxy manager as well. You can upload certs via the web ui.
Rather than local certs though, I would recommend buying a domain and using it locally, with https. The problem with the local cert approach outlined in the video, is that importing a root cert opens up a big security hole to MITM attacks. If an attacker gets the root certificate, they can now MITM everything else your browser is accessing. You turn the browser from one of the most secure components of a modern OS, into only as secure as the server hosting the root certificates.
The approach I would prefer, is to buy a domain, and use it locally, using DNS-01 challenges to get letsencrypt signed certificates even from within an internal network. Both Caddy and NPM have support for DNS-01 challenges.
Thanks for the explanation, something I need to look into!
It looks like criticisms similar to mine were offered in the comments of the youtube video you linked at first, and now the youtuber has released a second video, a correction. In this video he uses nginx proxy manager and DNS-01 challenges:
https://www.youtube.com/watch?v=XEltHEZU6aE
Big respect for doing that.
wow super, I’m more familiar with NPM so that would be great. Thanks for the update!!
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CA (SSL) Certificate Authority DNS Domain Name Service/System ISP Internet Service Provider NAT Network Address Translation TLS Transport Layer Security, supersedes SSL ULA Unique Local Address (non-routable local address, IPv6) nginx Popular HTTP server
[Thread #52 for this comm, first seen 12th Jul 2026, 06:30] [FAQ] [Full list] [Contact] [Source code]
What is the absolute simplest way to accomplish this?
< gets on soap box>
The absolute simplest way is to use IPv6: on your Debian machine, assign multiple IPv6 addresses, one for each service you want to expose to your LAN. There’s no penalty with having a dozen v6 addresses.
Although you have those addresses, your machine generally uses just a single one for its own outbound and inbound traffic. For each service, you would edit their config so that they bind to a specific IPv6 address. Finally, you would configure an AAAA entry in DNS so that your chosen subdomain will point to the IPv6 address in question.
As an example, suppose you had three different web servers running Nginx, currently on port 80, 8081, and 42069. What you would change is the server config for each server instance, adidng the IPv6 address as part of the “listen” directive. Since each instance is now bound to a different IP address, nginx can now listen to the conventional port 80 and n’ary will the three collide. In other software, the configuration option you’re looking for is the “bind address”. By binding each app to its own IP, it will only respond if you send a request to that IP (or DNS name, which translates to an IP); this conveniently makes debugging really easy.
For a home network, you might have a single /64 IPv6 subnet. But that still means you literally have billions upon billions of addresses to use before you ever run out. And as you’ve recognized, using DNS names to identify services is a lot easier and intuitive than using port numbers. It also neatly avoids the need to memorize IPv6 addresses, because that’s never been necessary: we have DNS.
If your ISP won’t give you IPv6, you can still use locally-assigned private ranges, known as ULA, and this works because your services are contained to your LAN. Best practice is to randomly generate a subnet then use it.
< gets off soap box>
If your ISP won’t give you IPv6
how can my ISP influence this on my home network that has no external access?
Do you not have internet access?
Yes but all my services work in my LAN even if I am not connected to the outside world. Obviously not fully functional, but everything runs.
You are getting confused by NAT
In IPv6 there is no NAT. NAT makes things more complicated and adds overhead that isn’t needed. In the old (pre Nat) internet IPs worked like it was suppose to and each device had its own routable address. IPv6 fixes this by both using a massive address space and allowing hosts to get infinite IPs. You can assign a IP address to each service since there is so much space.
In general NAT is the enemy of peer to peer networks which is what IP as a protocol is designed to do
Web browsers look for either port :80 or port :443 by default, your reverse proxy sits on those ports, hence why you don’t need to input a port at the end of the domain.
Get yourself a load balancer like Traefik or SWAG, buy a domain, setup ACME certificates for SSL/TLS and start pointing your load balancer to your services.
