I have struggled with this too and read a lot of different confusing advice.
With DuckDNS & LE I’m using:
default_config:
external_url: "https://mysubdomain.duckdns.org"
internal_url: "http://ip-of-HA:8123"
In my modem/router I have only forwarded 443 external to internal.
@vchkhr: this is a helpful guide Remote access for Home Assistant