Introduction
In 2025, the self-hosted community has moved aggressively toward containerization and secure remote access. Synology's DiskStation Manager (DSM) 7.x has evolved to meet this demand by refining its built-in reverse proxy capabilities. A reverse proxy acts as a gateway, sitting in front of your internal web services. When a user requests a resource, the proxy intercepts the request and forwards it to the appropriate backend service. This is essential for network security, SSL termination, and accessing services behind a single router port.
Unlike DSM 6, which relied heavily on the nginx config files located in /etc/nginx, DSM 7 abstracts much of this into the GUI. However, for advanced users, understanding the underlying Nginx structure is still vital for troubleshooting when the "Synology reverse proxy not working" scenario arises.
---
Prerequisites
Before diving into the configuration, ensure you have the following:
1. Public IP & Static IP: Your router must have a public IP. If you have a dynamic IP, use a DDNS service (like DuckDNS or Synology's own DDNS). 2. DNS Records: You need an A Record pointing your domain (e.g., example.com) or subdomain (nas.example.com) to your public IP address. 3. Router Port Forwarding: You must forward Port 80 (HTTP) and Port 443 (HTTPS) from your router to your Synology NAS's local IP address. 4. Valid SSL Certificate: HTTPS is mandatory for modern reverse proxies. We recommend using Let's Encrypt.
---
Step-by-Step Guide to Reverse Proxy in DSM 7
Step 1: Securing Your Connection (SSL/HTTPS)
Traffic flowing through a reverse proxy should always be encrypted.
1. Open Control Panel > Security > Certificate. 2. Click Add > Get a certificate from Let's Encrypt. 3. Enter your domain name (e.g., home.mydomain.com). 4. Ensure port 80 is forwarded on your router so Let's Encrypt can validate your domain. 5. Click Configure. Once obtained, set this as the default certificate for your system.
Step 2: Configuring the Reverse Proxy Rules
DSM 7 provides a streamlined interface for Nginx routing. Here is how to configure a standard service, such as a Home Assistant instance running on port 8123.
1. Navigate to Control Panel > Login Portal > Reverse Proxy. 2. Click Create. 3. Source Settings (The 'Front Door'): * Protocol: HTTPS * Hostname: home.mydomain.com * Port: 443 (Default) 4. Destination Settings (The 'Service'): * Protocol: HTTP * Hostname: localhost (or the internal LAN IP of the service container/VM) * Port: 8123
Step 3: Essential Headers and WebSocket Support
This is the step where most users fail. By default, the Synology GUI does not expose all Nginx headers. If you are setting up a reverse proxy for Home Assistant, Radarr, or Sonarr, Websockets and specific Headers are required.
In the 'Reverse Proxy' creation window:
1. Enable Custom Header: Check this box. This adds the X-Forwarded-Host and X-Forwarded-For headers automatically. This tells the backend application that the visitor is coming from the proxy, not locally. 2. Enable WebSocket: If your application uses real-time updates (like dashboards or chat), you must check this.
---
Advanced Use Case: Reverse Proxying Docker Containers
Many users run services in Docker (Container Manager) on their Synology. The setup is identical, but you must ensure the Docker container's port is published and not conflicting with DSM ports.
Example Configuration:
- Service: Nginx Proxy Manager (Docker)
- Docker Port: 8080 (Mapped to container port 80)
- Reverse Proxy Source:
proxy.mydomain.com(HTTPS) - Reverse Proxy Destination:
localhost:8080(HTTP)
Python Scraper Check: If you are scraping data from a service hosted on your Synology, the reverse proxy ensures that your scraper hits the HTTPS endpoint. If you encounter SSL Verification Errors in your Python code because the internal container uses a self-signed cert, you might need to route it through the proxy which handles the valid Let's Encrypt cert.
Example Python Script hitting your new Proxy
import requests
The URL is now your public HTTPS domain handled by Synology Reverse Proxy
url = 'https://home.mydomain.com/api/status'
response = requests.get(url, verify=True) print(response.status_code)
---
Troubleshooting Common Issues
1. 502 Bad Gateway
This is the most common error message ('Synology reverse proxy not working'). It means Nginx cannot reach the backend service.
localhost or 0.0.0.0? If it listens on 127.0.0.1, Nginx might struggle to connect if running in a different network namespace. Try using the LAN IP (e.g., 192.168.1.50:8123) as the destination hostname.2. HSTS Issues (HTTP Strict Transport Security)
Users often search for 'synology reverse proxy hsts' because they accidentally enable HSTS on a subdomain they cannot access later.
3. Too Many Redirects
This usually occurs if the backend application (e.g., WordPress or Nextcloud) is configured to force HTTPS, but the Reverse Proxy is also handling SSL. The application sees HTTPS traffic, but thinks it is coming via HTTP (Port 80) internally, gets confused, and redirects.
config.php for Nextcloud), set overwrite.cli.url, overwriteprotocol, and overwritehost to match the Reverse Proxy settings, or enable 'Trust Proxy' settings if available.---
Synology Reverse Proxy vs. Nginx Proxy Manager (Docker)
Why use the built-in DSM 7 proxy versus installing Nginx Proxy Manager (NPM) in Docker?
| Feature | Synology DSM 7 Reverse Proxy | Nginx Proxy Manager (Docker) | | :--- | :--- | :--- | | Ease of Use | Very High (Native GUI) | High (Web UI) | | Flexibility | Medium (Limited GUI options) | Very High (Full Nginx access) | | Performance | High (Native integration) | Medium (Container overhead) | | Security Updates | Patched via DSM updates | Manual Container updates | | Custom Configs | Difficult (Requires Console) | Easy (Supports snippets) |
Recommendation: For standard protocols like HTTP/Websockets, use the Synology DSM 7 Reverse Proxy. It consumes fewer resources and updates automatically with the system. If you need complex routing, TCP/UDP streaming, or Access Control Lists (ACLs), use Nginx Proxy Manager in Docker.
---
Conclusion
Setting up a reverse proxy on Synology DSM 7 is a straightforward process that significantly enhances the security and accessibility of your home lab. By leveraging the built-in Nginx service via the 'Login Portal' tab, you can expose Docker containers and VMs to the internet safely. Always ensure you have valid Let's Encrypt certificates configured and verify your headers are set correctly for the specific application you are proxying.