The applications only matter because the network connects everything together. This is how packets move, services get exposed, names resolve, and failures actually get traced.
Maps human-readable domain names to IP addresses.
Without DNS, users would need to remember raw addresses.
IN MY ENVIRONMENT / DNS is also used for network-level filtering and local service resolution.
CONNECTED TO / AdGuard Home, local clients, domains and exposed services.Conceptual trace only. The exact route depends on the service and exposure model.
Clients send a DNS query to a network-level handler that can filter it and forward the request for resolution. Doing it this way centralizes the behavior instead of having to configure every single device separately.
Local DNS handles internal systems and controlled names; public DNS resolves domains out on the wider internet. Both are just part of the path a service ends up depending on.
Nginx takes a hostname-based request and routes it to the right internal application. (The names below are just illustrative, not published domains.)
photos.example.test → IMMICH
cloud.example.test → NEXTCLOUD
ai.example.test → OPENWEBUI
An IP identifies a machine; a port identifies a service on that machine. Containerization adds one more boundary on top: host port to container port.
Private addresses live inside a local network. A router is what translates traffic between those internal devices and the public internet.
An inbound request can be forwarded toward an internal server, but whether it actually gets there depends on the internal address, the listener, the firewall, the router, and the upstream network, any of which can block it.
A firewall checks source, destination, port and protocol against its rules. This is just a conceptual example, not a claim about the lab's full rule set.
Management interfaces, dashboards, and other infrastructure tools can just stay reachable inside the local environment when there's no real need for public access.
A public service should have an actual reason to be reachable, a clear proxy path, HTTPS where it makes sense, and an attack surface you understand.
Do not guess. Isolate the layer that failed.
A realistic diagnostic sequence: passing locally just narrows the problem down, it doesn't prove the public path is fine.
REMAINING AREAS / PORT FORWARDING · DOUBLE NAT · CGNAT · ISP FILTERING · WRONG WAN ADDRESS
A lightweight layer model helps narrow down a failure without turning the whole thing into a textbook exercise.
PRIVATE IP — inside the LAN.
PUBLIC IP — wider internet boundary.
LOCALHOST — this machine.
GATEWAY — route beyond the subnet.
SUBNET — local address range.
Clients reach a host port, which maps through a Docker network to a container and its application port. Services can also talk to each other over internal container networks directly.
These commands are shown as diagnostic vocabulary, not live output.
The protocols and tools used to reason about names, routes, boundaries and web delivery.