I have multiple subnets. The network is all routing correctly. I can ping the HA server form other subnets but HA does not accepts any connections unless they are on the local network to the HA server.
It is my impression that HassIO or Docker is only accepting connections that are on the local network.
From the local network I can access the Web UI, SSH, MQTT. But any attempts from other subnets fail even though I can ping the server.
When I try to access the web UI from another subnet to the HA server as an example https://ha.mydomain.com the web browser redirects to https://ha.mydomain.com/lovelace so the browser is making a connection to the server but then the lovelace authentication login page fails to load and the browser responds with a connection error. If I do this from the same IP network then it redirects correctly and the login screen appears or the lovelace page is displayed if I am already authenticated.
I can access the HA server from the internet as my NAT device is on the same network to the HA server so the connection works. I have a DNS entry internally and externally to correctly resolve the FQDN to the HA server.
Is there something in HassIO or Docker that is only allowing local network connections?
Some ISP routers still don’t like IPv6, and 2024.5 added WAN / LAN detection with additional hardening. The full Guard page and Drop connection features were rolled-back at the last minute as WAN detection was triggering in some circumstances on the LAN, but I only have a link to the HASS podcast created before the rollback. As the feature was pulled from 2024.5, I’d concentrate on IPv4 verses IPv6 routing and DNS.
I’ve seen IPv6 connect, when IPv4 fails due to DHCP or other routing issues - the complexity here is a dual-stack client device might automatically choose IPv6 (LLA or ULA) masking a failure and thoroughly confusing you.
There’s a few threads on here with more detailed examples (I deliberately use HAOS to avoid container routing), but ping -4 xxxx and ping -6 xxxx are your friend.
(Aside - my least favourite recent issue was an intermittent uplink that broke IPv4 DHCP but allowed just enough IPv6 to confuse my tracing. 4h to find a bad SFP! Grr!)
OK; very strange. I ended up backing up my config. Wrote the HA image to a new HD. Restored the backup and now everything is working as expected. I’m using a rPi4, SSD on USB3, no SD card.
I also noticed my storage usage went from about 80GB down to 17GB. My backups are 4.1GB.