{"record":{"id":"aa1ec193edc5a78b","repo":"nextcloud/all-in-one","slug":"the-domain-is-not-reachable-on-port-443-from-withi","errorCode":null,"errorMessage":"The domain is not reachable on Port 443 from within this container. Have you opened port 443/tcp in your router/firewall? If yes is the problem most likely that the router or firewall forbids local access to your domain. Or in other words: NAT loopback (Hairpinning) does not seem to work in your network. You can work around that by setting up a local DNS server and utilizing Split-Brain-DNS and configuring the daemon.json file of your docker daemon to use the local DNS server.","messagePattern":"The domain is not reachable on Port 443 from within this container\\. Have you opened port 443/tcp in your router/firewall\\? If yes is the problem most likely that the router or firewall forbids local access to your domain\\. Or in other words: NAT loopback \\(Hairpinning\\) does not seem to work in your network\\. You can work around that by setting up a local DNS server and utilizing Split-Brain-DNS and configuring the daemon\\.json file of your docker daemon to use the local DNS server\\.","errorType":"validation","errorClass":"InvalidSettingConfigurationException","httpStatus":422,"severity":"error","filePath":"php/src/Data/ConfigurationManager.php","lineNumber":659,"sourceCode":"            }\n\n            // Get the apache port\n            $port = $this->apachePort;\n\n            if (!filter_var($dnsRecordIP, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {\n                if ($port === '443') {\n                    throw new InvalidSettingConfigurationException(\"It seems like the ip-address of the domain is set to an internal or reserved ip-address. This is not supported by the domain validation. (It was found to be set to '\" . $dnsRecordIP . \"'). Please set it to a public ip-address so that the domain validation can work or skip the domain validation!\");\n                } else {\n                    error_log(\"Info: It seems like the ip-address of \" . $domain . \" is set to an internal or reserved ip-address. (It was found to be set to '\" . $dnsRecordIP . \"')\");\n                }\n            }\n\n            // Check if port 443 is open\n            $connection = @fsockopen($domain, 443, $errno, $errstr, 10);\n            if ($connection) {\n                fclose($connection);\n            } else {\n                throw new InvalidSettingConfigurationException(\"The domain is not reachable on Port 443 from within this container. Have you opened port 443/tcp in your router/firewall? If yes is the problem most likely that the router or firewall forbids local access to your domain. Or in other words: NAT loopback (Hairpinning) does not seem to work in your network. You can work around that by setting up a local DNS server and utilizing Split-Brain-DNS and configuring the daemon.json file of your docker daemon to use the local DNS server.\");\n            }\n\n            // Get Instance ID\n            $instanceID = $this->getAndGenerateSecret('INSTANCE_ID');\n\n            // set protocol\n            if ($port !== '443') {\n                $protocol = 'https://';\n            } else {\n                $protocol = 'http://';\n            }\n\n            // Check if response is correct\n            $testUrl = $protocol . $domain . ':443';\n            $errorMessage = '';\n            $guzzleClient = new Client(['connect_timeout' => 10, 'timeout' => 10, 'http_errors' => false]);\n            try {\n                $guzzleResponse = $guzzleClient->get($testUrl);","sourceCodeStart":641,"sourceCodeEnd":677,"githubUrl":"https://github.com/nextcloud/all-in-one/blob/6b788eec5e61733cf03ed380a3572e43ae3f11ce/php/src/Data/ConfigurationManager.php#L641-L677","documentation":"In ConfigurationManager::setDomain() (when validation is not skipped): the mastercontainer must be able to open a TCP connection to the domain on port 443 within 10 seconds (@fsockopen). Failure throws this exception → HTTP 422. DNS resolution already succeeded (earlier checks passed), so this is purely a connectivity failure: port 443 not forwarded or firewalled, nothing listening on 443, or NAT loopback (hairpinning) not working so the container cannot reach its own public IP from inside the LAN.","triggerScenarios":"Router/firewall has no 443/tcp forwarding to the host; the AIO apache container is stopped so nothing listens on 443; NAT loopback broken — connecting from inside the LAN to the own public IP is blocked by the router; outbound traffic on 443 blocked from the Docker network.","commonSituations":"First-time setup before port forwarding was configured; ISP routers without hairpinning support; cloud servers whose security group still blocks 443.","solutions":["Forward 443/tcp on the router/firewall to the host and confirm the AIO apache container is running and listening","Test reachability from the host and from inside the container: 'curl -sv telnet://cloud.example.com:443' or 'nc -vz cloud.example.com 443'","If 443 works from outside but not from inside your LAN, NAT loopback is broken — set up split-brain DNS and configure the Docker daemon.json to use the local DNS server, as the message suggests","As a workaround for unreachable-from-inside networks, use the 'skip domain validation' option"],"exampleFix":"# before\nrouter: no 443/tcp forwarding to the host\n# after\nrouter: forward 443/tcp -> <host-lan-ip>:443","handlingStrategy":"try-catch","validationCode":"// Probe reachability exactly like the mastercontainer will\n$probe = @fsockopen($domain, 443, $errno, $errstr, 10);\nif ($probe === false) {\n    $errors[] = \"Port 443 unreachable ($errstr) — fix forwarding/NAT loopback first\";\n} else {\n    fclose($probe);\n}","typeGuard":"function isInvalidSettingConfigurationException(\\Throwable $e): bool {\n    return $e instanceof \\AIO\\Data\\InvalidSettingConfigurationException;\n}","tryCatchPattern":"use AIO\\Data\\InvalidSettingConfigurationException;\n\ntry {\n    $configurationManager->setDomain($domain, $skipDomainValidation);\n} catch (InvalidSettingConfigurationException $e) {\n    // connectivity failure inside the container — guide the user to\n    // port forwarding / hairpinning docs or the skip option\n    $formErrors[] = $e->getMessage();\n}","preventionTips":["Forward 443/tcp on the router/firewall before starting domain validation","Verify hairpinning by connecting to the public domain:443 from inside the LAN","If hairpinning is impossible, deploy split-brain DNS + Docker daemon.json DNS or skip validation"],"tags":["php","nextcloud-aio","network","port-443","nat-loopback","domain-validation","firewall"],"backgroundTag":"connection-refused","analyzedSha":"6b788eec5e61733cf03ed380a3572e43ae3f11ce","analyzedAt":"2026-08-21T05:47:24.382Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}