Network Setup

Your PCS needs a stable internet connection to serve apps to users. This guide explains how networking works and how to troubleshoot common network issues.

How Your PCS Connects

Your PCS uses several networking layers:

1. Your internet connection — The PCS connects through your ISP.
2. NSL.SH routing — Yundera's mesh network routes yourdomain.nsl.sh to your PCS's public IP.
3. Caddy reverse proxy — Caddy runs on the PCS and routes incoming requests to the correct app container based on the subdomain.
4. Docker networking — Each app runs in its own Docker container with isolated networking.

Port Requirements

Your PCS needs these ports accessible from the internet:

Port	Purpose	Required?
443	HTTPS — all web traffic	Yes
80	HTTP — redirects to HTTPS	Recommended
22	SSH — remote admin access	Optional (only for remote SSH)

How to Check if Ports Are Open

From the Admin Panel → Terminal:

# Check if port 443 is listening
sudo ss -tlnp | grep 443

# Test external access (from another machine)
curl -I https://yourdomain.nsl.sh

Port Forwarding (Home Network)

If your PCS is behind a home router, you need to forward ports to it:

Step-by-Step

1. Find your PCS's local IP — From Terminal: ip addr show | grep inet
2. Log into your router — Usually at 192.168.1.1 or 192.168.0.1
3. Find Port Forwarding settings — Often under "Advanced", "NAT", or "Virtual Servers"
4. Add rules:
   • External port 443 → Internal IP <PCS local IP> port 443
   • External port 80 → Internal IP <PCS local IP> port 80
5. Save and apply

Static IP / DHCP Reservation

To prevent your router from assigning a different IP to your PCS:

1. Find the PCS's MAC address from Terminal: ip link show
2. In your router's DHCP settings, create a reservation binding that MAC address to a fixed local IP.

ISP Restrictions

Some ISPs restrict or block hosting on residential connections.

Common ISP Issues

Issue	Symptom	Solution
Port 443 blocked	Can't access PCS externally	Use Cloudflare proxy (hides your real port)
Port 80 blocked	Let's Encrypt can't issue certificates	Use Cloudflare for HTTPS termination
CGNAT (Carrier-Grade NAT)	No public IP assigned	Contact ISP for a public IP, or use Cloudflare Tunnel
Dynamic IP	PCS becomes unreachable after IP change	PCS self-check detects new IP automatically. Runs nightly and on reboot.

How to Detect CGNAT

From Terminal:

# Check your public IP
curl -s ifconfig.me

# Check your router's WAN IP
# If these are different, you're behind CGNAT

If your router's WAN IP is in the 100.64.x.x range, you're behind CGNAT and need to contact your ISP or use a tunnel.

Cloudflare as a Network Solution

Cloudflare can solve most ISP-related networking issues:

Cloudflare Proxy Mode

When you set up a custom domain with Cloudflare proxy mode (see Custom Domain):

• Traffic goes: User → Cloudflare → Your PCS
• Your real IP is hidden
• Cloudflare handles DDoS protection
• Works even if your ISP blocks port 80 (Cloudflare connects on 443)

Cloudflare Tunnel (Advanced)

If you're behind CGNAT or have severe ISP restrictions, Cloudflare Tunnel creates an outbound connection from your PCS to Cloudflare, eliminating the need for any port forwarding:

1. Sign up for Cloudflare Zero Trust (free plan available)
2. Install cloudflared on your PCS
3. Create a tunnel that maps your domain to localhost:443
4. No port forwarding or public IP needed

Dynamic IP Handling

Most home internet connections have dynamic IPs that change periodically. Your PCS handles this automatically:

1. Nightly self-check detects the current public IP.
2. If the IP changed, the PCS updates the NSL.SH routing.
3. The sslip.io domain also updates automatically since it's IP-based.

If you need faster detection:

• Go to Admin Panel → Health and click Run now to trigger an immediate self-check.
• After a reboot, the @reboot self-check runs automatically.

Bandwidth Considerations

How Much Bandwidth Do You Need?

Depends on your usage:

Use Case	Recommended Bandwidth
Documentation site / blog	5 Mbps upload
Personal cloud (files, notes)	10 Mbps upload
Photo gallery (Immich)	20 Mbps upload
Media streaming (Jellyfin)	30+ Mbps upload per concurrent stream

Checking Your Bandwidth

Use the built-in speed test:

1. Go to Admin Panel → Resources → Network tab.
2. Click Run network speed test.
3. Review download and upload speeds.

DNS Configuration

NSL.SH Domains

For .nsl.sh domains, DNS is managed automatically by Yundera. You don't need to configure anything.

SSLIP.IO Domains

The <ip>.sslip.io domain is an IP-based wildcard DNS service. It resolves automatically based on the IP in the domain name. No configuration needed.

Custom Domains

For custom domains, see the detailed setup in Custom Domain and Admin Panel → Domain.

Network Troubleshooting

Quick Checks from Terminal

# Check internet connectivity
ping -c 3 8.8.8.8

# Check DNS resolution
nslookup yourdomain.nsl.sh

# Check if Caddy is running
docker ps | grep caddy

# Check Caddy logs for errors
docker logs caddy --tail 50

# Check current public IP
curl -s ifconfig.me

# Check listening ports
sudo ss -tlnp | grep -E '(80|443)'

For more network issues, see Troubleshooting.