Support intro
Sorry to hear you’re facing problems. 
The community help forum (help.nextcloud.com) is for home and non-enterprise users. Support is provided by other community members on a best effort / “as available” basis. All of those responding are volunteering their time to help you.
If you’re using Nextcloud in a business/critical setting, paid and SLA-based support services can be accessed via portal.nextcloud.com where Nextcloud engineers can help ensure your business keeps running smoothly.
Getting help
In order to help you as efficiently (and quickly!) as possible, please fill in as much of the below requested information as you can.
Before clicking submit: Please check if your query is already addressed via the following resources:
- Official documentation (searchable and regularly updated)
- How to topics and FAQs
- Forum search
(Utilizing these existing resources is typically faster. It also helps reduce the load on our generous volunteers while elevating the signal to noise ratio of the forums otherwise arising from the same queries being posted repeatedly).
Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can. 
The Basics
- Nextcloud Server version (e.g., 29.x.x):
- Nextcloud AIO v12.8.0
- Operating system and version (e.g., Ubuntu 24.04):
- Alpine Linux v3.23 x86_64
- Web server and version (e.g, Apache 2.4.25):
N/A
- Reverse proxy and version _(e.g. nginx 1.27.2)
none
- PHP version (e.g, 8.3):
N/A
- Is this the first time you’ve seen this error? (Yes / No):
yes
- When did this problem seem to first start?
installation
- Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
AIO
- Are you using CloudfIare, mod_security, or similar? (Yes / No)
no
Summary of the issue you are facing:
I am trying to install Nextcloud using AIO, however when I enter the domain name, I get the error message.
The domain is not reachable on Port 443 from within this container. Have you opened port 443/tcp in your router/firewall? If yes is the problem most likely that the router or firewall forbids local access to your domain. Or in other words: NAT loopback (Hairpinning) does not seem to work in your network. You can work around that by setting up a local DNS server and utilizing Split-Brain-DNS and configuring the daemon.json file of your docker daemon to use the local DNS server.
I am using iptables to whitelist ports on the server for security reasons. Here is my configuration. I’m, sorry for the mess, I only exported these out of iptables and I’m not using any abstraction on top of it, so docker has created most of these rules. My intention is to only allow ports 22,80,443,8443 and to have a NAT for my Wireguard VPN network (wg0, UDP/51820, 192.168.61.0/24). Note that I am already opening the setup using my domain name on port 8443.
# Generated by iptables-save v1.8.11 (nf_tables) on Sun Apr 5 20:25:05 2026
*raw
:PREROUTING ACCEPT [3149:826003]
:OUTPUT ACCEPT [0:0]
[0:0] -A PREROUTING -d 172.19.0.2/32 ! -i br-3530f247a230 -j DROP
[0:0] -A PREROUTING -d 172.19.0.3/32 ! -i br-3530f247a230 -j DROP
COMMIT
# Completed on Sun Apr 5 20:25:05 2026
# Generated by iptables-save v1.8.11 (nf_tables) on Sun Apr 5 20:25:05 2026
*filter
:INPUT DROP [576:59436]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [251:44783]
:DOCKER - [0:0]
:DOCKER-BRIDGE - [0:0]
:DOCKER-CT - [0:0]
:DOCKER-FORWARD - [0:0]
:DOCKER-INTERNAL - [0:0]
:DOCKER-USER - [0:0]
[154:13274] -A INPUT -i lo -j ACCEPT
[4246:668181] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[419:24304] -A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443,8443 -j ACCEPT
[0:0] -A INPUT -i eth0 -p udp -m udp --dport 51820 -j ACCEPT
[4:200] -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
[192:40708] -A FORWARD -j DOCKER-USER
[192:40708] -A FORWARD -j DOCKER-FORWARD
[0:0] -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -i wg0 -o eth0 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[1:60] -A DOCKER -d 172.19.0.3/32 ! -i br-3530f247a230 -o br-3530f247a230 -p tcp -m tcp --dport 443 -j ACCEPT
[0:0] -A DOCKER -d 172.19.0.2/32 ! -i br-3530f247a230 -o br-3530f247a230 -p tcp -m tcp --dport 8443 -j ACCEPT
[6:312] -A DOCKER -d 172.19.0.2/32 ! -i br-3530f247a230 -o br-3530f247a230 -p tcp -m tcp --dport 8080 -j ACCEPT
[7:348] -A DOCKER -d 172.19.0.2/32 ! -i br-3530f247a230 -o br-3530f247a230 -p tcp -m tcp --dport 80 -j ACCEPT
[0:0] -A DOCKER ! -i br-25f773566921 -o br-25f773566921 -j DROP
[0:0] -A DOCKER ! -i docker0 -o docker0 -j DROP
[0:0] -A DOCKER ! -i br-3530f247a230 -o br-3530f247a230 -j DROP
[0:0] -A DOCKER-BRIDGE -o br-25f773566921 -j DOCKER
[0:0] -A DOCKER-BRIDGE -o docker0 -j DOCKER
[14:720] -A DOCKER-BRIDGE -o br-3530f247a230 -j DOCKER
[14:7017] -A DOCKER-CT -o br-25f773566921 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A DOCKER-CT -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[69:18996] -A DOCKER-CT -o br-3530f247a230 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[192:40708] -A DOCKER-FORWARD -j DOCKER-CT
[109:14695] -A DOCKER-FORWARD -j DOCKER-INTERNAL
[109:14695] -A DOCKER-FORWARD -j DOCKER-BRIDGE
[16:2653] -A DOCKER-FORWARD -i br-25f773566921 -j ACCEPT
[0:0] -A DOCKER-FORWARD -i docker0 -j ACCEPT
[79:11322] -A DOCKER-FORWARD -i br-3530f247a230 -j ACCEPT
COMMIT
# Completed on Sun Apr 5 20:25:05 2026
# Generated by iptables-save v1.8.11 (nf_tables) on Sun Apr 5 20:25:05 2026
*nat
:PREROUTING ACCEPT [8266:2250104]
:INPUT ACCEPT [17:1004]
:OUTPUT ACCEPT [24:1566]
:POSTROUTING ACCEPT [38:2286]
:DOCKER - [0:0]
[535:41542] -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
[0:0] -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
[2:120] -A POSTROUTING -s 172.19.0.0/16 ! -o br-3530f247a230 -j MASQUERADE
[0:0] -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
[1:60] -A POSTROUTING -s 172.18.0.0/16 ! -o br-25f773566921 -j MASQUERADE
[0:0] -A POSTROUTING -s 192.168.61.0/24 -o eth0 -j MASQUERADE
[7:348] -A DOCKER ! -i br-3530f247a230 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.19.0.2:80
[6:312] -A DOCKER ! -i br-3530f247a230 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.19.0.2:8080
[0:0] -A DOCKER ! -i br-3530f247a230 -p tcp -m tcp --dport 8443 -j DNAT --to-destination 172.19.0.2:8443
[1:60] -A DOCKER ! -i br-3530f247a230 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.19.0.3:443
COMMIT
# Completed on Sun Apr 5 20:25:05 2026
Steps to replicate it (hint: details matter!):
-
Setup Alpine Virtual
-
Configure IP-Tables
-
Start the default docker-compose from the git repository
Log entries
The installation did not start yet, thus there are no logs.
Configuration
The AIO setup fails before any configuration could be done.
Tips for increasing the likelihood of a response
- Use the
preformatted textformatting option in the editor for all log entries and configuration output. - If screenshots are useful, feel free to include them.
- If possible, also include key error output in text form so it can be searched for.
- Try to edit log output only minimally (if at all) so that it can be ran through analyzers / formatters by those trying to help you.