# Local controller on Proxmox - reverse proxy issue **URL:** \ **Category:** Alta Control\ **Tags:** controller\ **Created:** [January 13, 2025, 4:57pm UTC](https://forum.alta.inc/t/local-controller-on-proxmox-reverse-proxy-issue/4287 "2025-01-13T16:57:16Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Jos](https://forum.alta.inc/letter_avatar_proxy/v4/letter/j/2bfe46/32.png) [@Jos](https://forum.alta.inc/u/Jos)\ **Post date:** [January 13, 2025, 4:57pm UTC](https://forum.alta.inc/t/local-controller-on-proxmox-reverse-proxy-issue/4287/1 "2025-01-13T16:57:16Z")
Setup a local controller in Proxmox, version 1.0r. Everything works fine in my LAN. Created a DNS entry so I can use [https://random.ddns.manage.alta.inc](https://random.ddns.manage.alta.inc) in my internal network (without the local in front). Now I want to have external access to my controller. But: I only have one external fixed IP, so I use a reverse proxy (Microsoft IIS with ARR) to get access to several servers. Created a server farm and rewrite rule for the Alta FQDN [https://random.ddns.manage.alta.inc](https://random.ddns.manage.alta.inc). Due to the Letsencrypt certificate the Alta controller uses, I got a certificate error from outside my network (since the ARR replaces the Let’s Encrypt certificate with my own wildcard certificate, this is expected behavior). This is no issue for my other internal servers, since they all use my official wildcard certificate, the same one the ARR uses. So instead of using [random.ddns.manage.alta.inc](http://random.ddns.manage.alta.inc) I created a new public DNS record [alta.mydomain.com](http://alta.mydomain.com) and the ARR does a rewrite from [https://alta.mydomain.com](https://alta.mydomain.com) to [https://random.ddns.manage.alta.inc](https://random.ddns.manage.alta.inc) to go to the internal controller. When I browse from an external computer to [https://alta.mydomain.com](https://alta.mydomain.com), I get the controller login page and no certificate error. The certificate is my official wildcard certificate. But I can’t login: Incorrect username or password. I added the FQDN [https://alta.mydomain.com](https://alta.mydomain.com) to Allowed Origins, but this does not solve the problem. So I tried it another way. I did a port forward of port 8443 to 443 and added port 8443 to Allowed Ports in the controller. When I go to [https://random.ddns.manage.alta.inc:8443](https://random.ddns.manage.alta.inc:8443), I get the controller login page and can login without any problem. If I don’t add port 8443 to Allowed Ports, I get the login page but cannot login. But I would prefer to use my ARR and [https://alta.mydomain.com](https://alta.mydomain.com). What am I missing this is not working? ---
**Author:** ![Alta-Matt\_v2](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-matt_v2/32/2456_2.png) [@Alta-Matt\_v2](https://forum.alta.inc/u/Alta-Matt_v2)\ **Post date:** [January 13, 2025, 7:31pm UTC](https://forum.alta.inc/t/local-controller-on-proxmox-reverse-proxy-issue/4287/2 "2025-01-13T19:31:16Z")
Do you get a console error when attempting to login? Does the proxy have network access to the Proxmox system? Thinking about the flow of traffic: 1. External comes in 2. Hits the port forward 3. Goes to the reverse proxy 4. Proxy talks to controller The reverse proxy could and arguably should be talking to the local.\* domain since the proxy itself is local to the controller. I’m not saying that would work, but it would be the next thing I’d try. I don’t know much about the Microsoft IIS but I have worked with Nginx and Traefik. ---
**Author:** ![system](https://forum.alta.inc/uploads/default/original/1X/087669c3d7c0a6495087b41d6f385a6771f2231c.png) [@system](https://forum.alta.inc/u/system)\ **Post date:** [June 11, 2026, 6:25am UTC](https://forum.alta.inc/t/local-controller-on-proxmox-reverse-proxy-issue/4287/3 "2026-06-11T06:25:40Z")