Certificate for nodes on lan

Installing and Using OpenWrt
1

Any help would be appreciated!
I have a node is in a lan called DMZ, NOT fronted by a VPN
I added port forwarding for HTTP on port 80 forwards to the node on port 8080
Also added port forwarding for HTTPS on port 443 to the node on any port
HTTP connections are working correctly either by fqdn host name on on the external ip of the router
HTTPs is not working getting Unable to connect
The node has a Let's encrypt SSL certificate installed
If I use nginx proxy manager to resolve the ssl certificate I get the default OpenWRT certificate

Configs
System

config system
	option hostname 'OpenWrt'
	option timezone 'UTC'
	option ttylogin '0'
	option log_size '128'
	option urandom_seed '0'

config timeserver 'ntp'
	option enabled '1'
	option enable_server '0'
	list server '0.openwrt.pool.ntp.org'
	list server '1.openwrt.pool.ntp.org'
	list server '2.openwrt.pool.ntp.org'
	list server '3.openwrt.pool.ntp.org'

uhttpd

config uhttpd 'main'
	list listen_http '0.0.0.0:80'
	list listen_http '[::]:80'
	list listen_https '0.0.0.0:443'
	list listen_https '[::]:443'
	option redirect_https '0'
	option home '/www'
	option rfc1918_filter '1'
	option max_requests '3'
	option max_connections '100'
	option cert '/etc/uhttpd.crt'
	option key '/etc/uhttpd.key'
	option cgi_prefix '/cgi-bin'
	list lua_prefix '/cgi-bin/luci=/usr/lib/lua/luci/sgi/uhttpd.lua'
	option script_timeout '60'
	option network_timeout '30'
	option http_keepalive '20'
	option tcp_keepalive '1'
	option ubus_prefix '/ubus'

config cert 'defaults'
	option days '397'
	option key_type 'ec'
	option bits '2048'
	option ec_curve 'P-256'
	option country 'ZZ'
	option state 'Somewhere'
	option location 'Unknown'
	option commonname 'OpenWrt'

network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd9f:e77e:5ee4::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '10.0.7.1'
	option netmask '255.255.255.0'

config interface 'wan'
	option proto 'dhcp'
	option device 'eth1'

config interface 'dmz'
	option proto 'static'
	option device 'eth2'
	option ipaddr '10.20.7.1'
	option netmask '255.255.255.0'

config interface 'nord_chi'
	option proto 'wireguard'
	option private_key '***************************'
	list addresses '10.5.0.2/32'
	option mtu '1420'
	list dns '103.86.96.100'
	list dns '103.86.99.100'
	option delegate '0'

config wireguard_nord_chi
	option description 'Imported peer configuration'
	option public_key '*********************'
	list allowed_ips '0.0.0.0/0'
	option persistent_keepalive '25'
	option endpoint_host 'us10576.nordvpn.com'
	option endpoint_port '51820'

firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'wan6'
	list network 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config include 'pbr'
	option fw4_compatible '1'
	option type 'script'
	option path '/usr/share/pbr/firewall.include'

config zone
	option name 'dmz'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option mtu_fix '1'
	list network 'dmz'

config forwarding
	option src 'dmz'
	option dest 'wan'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'
	option mtu_fix '1'

config zone
	option name 'nord'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'nord_chi'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'nord'

config redirect
	option dest 'dmz'
	option target 'DNAT'
	option name '3333'
	option family 'ipv4'
	list proto 'tcp'
	option src 'wan'
	option src_dport '3333'
	option dest_ip '10.20.7.69'

config redirect
	option dest 'dmz'
	option target 'DNAT'
	option name '37889'
	option family 'ipv4'
	list proto 'tcp'
	option src 'wan'
	option src_dport '37889'
	option dest_ip '10.20.7.69'

config redirect
	option dest 'dmz'
	option target 'DNAT'
	option name 'sip5060'
	option family 'ipv4'
	option src 'wan'
	option src_dport '5060'
	option dest_ip '10.20.7.50'

config redirect
	option dest 'dmz'
	option target 'DNAT'
	option name 'sip6060'
	option family 'ipv4'
	option src 'wan'
	option src_dport '6060'
	option dest_ip '10.20.7.50'

config redirect
	option dest 'dmz'
	option target 'DNAT'
	option name 'rtp1'
	option family 'ipv4'
	list proto 'udp'
	option src 'wan'
	option src_dport '10000-10800'
	option dest_ip '10.20.7.50'

config redirect
	option dest 'dmz'
	option target 'DNAT'
	option name 'rtp2'
	option family 'ipv4'
	list proto 'udp'
	option src 'wan'
	option src_dport '20000-20800'
	option dest_ip '10.20.7.50'

config redirect
	option dest 'dmz'
	option target 'DNAT'
	option name 'sip-https'
	option family 'ipv4'
	list proto 'tcp'
	option src 'wan'
	option src_dport '443'
	option dest_ip '10.20.7.50'

config redirect
	option dest 'dmz'
	option target 'DNAT'
	option name 'sip-http'
	option family 'ipv4'
	list proto 'tcp'
	option src 'wan'
	option src_dport '80'
	option dest_ip '10.20.7.50'
	option dest_port '8080'

dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'
	option start '100'
	option limit '150'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'dmz'
	option interface 'dmz'
	option start '50'
	option limit '45'
	option leasetime '12h'

luci

config core 'main'
	option lang 'auto'
	option mediaurlbase '/luci-static/bootstrap'
	option resourcebase '/luci-static/resources'
	option ubuspath '/ubus/'

config extern 'flash_keep'
	option uci '/etc/config/'
	option dropbear '/etc/dropbear/'
	option openvpn '/etc/openvpn/'
	option passwd '/etc/passwd'
	option opkg '/etc/opkg.conf'
	option firewall '/etc/firewall.user'
	option uploads '/lib/uci/upload/'

config internal 'languages'

config internal 'sauth'
	option sessionpath '/tmp/luci-sessions'
	option sessiontime '3600'

config internal 'ccache'
	option enable '1'

config internal 'themes'
	option Bootstrap '/luci-static/bootstrap'
	option BootstrapDark '/luci-static/bootstrap-dark'
	option BootstrapLight '/luci-static/bootstrap-light'

config internal 'apply'
	option rollback '90'
	option holdoff '4'
	option timeout '5'
	option display '1.5'

config internal 'diag'
	option dns 'openwrt.org'
	option ping 'openwrt.org'
	option route 'openwrt.org'
2

Youll nerd certbot or some other acme client on https server itself. Firewall forward does not decrypt connections.

3

Thanks for your reply
I tested 2 scenarios
1 SSL is installed on the server I got Unable to connect
2 Using nginx proxy manager openWrt overwrite the certificate with it's ownSSL

4

1 internally or externally
2 if you put nginx in between, you don't really need https on the backend?