Why a Service Can Work on the LAN but Fail Remotely
When an HTTPS service works from your LAN and fails from outside, run the same checks on both networks. Use a second connection such as a laptop tethered to a phone with Wi-Fi disabled on the phone. Replace app.example.com and /health with the hostname and path that fail.
1. Compare IPv4 and IPv6 DNS answers
dig +short app.example.com A
dig +short app.example.com AAAA
Run both queries from each network. An internal private address and a public external address can be intentional with split DNS. If an external client receives a private address, check the public DNS record. If the external answer includes an AAAA record, check the IPv6 path as well as IPv4.
2. Test HTTPS over each address family
curl -4 -sv --connect-timeout 5 --max-time 10 \
https://app.example.com/health
curl -6 -sv --connect-timeout 5 --max-time 10 \
https://app.example.com/health
Compare the IP curl tries, whether it connects, and whether it receives an HTTP status. An IPv6-only failure is useful evidence when the hostname publishes an AAAA record and the test client has working IPv6. A certificate error means the client got far enough to start TLS. An HTTP response means the request reached a web server, though it could still be the wrong one.
3. Test a known IP without changing DNS
If you know the intended public IPv4 address, test it directly while keeping the hostname for HTTPS. Replace the documentation address below with the service’s real public IP.
curl -sv --connect-timeout 5 --max-time 10 \
--resolve app.example.com:443:203.0.113.10 \
https://app.example.com/health
If this works while the normal request fails, compare the normal DNS answers and addresses curl tried. If both fail, correlate the external request time with the edge firewall and reverse-proxy logs. Check the WAN listener, any IPv4 port forwarding you rely on, and the IPv6 firewall rule if you publish IPv6. If the proxy logs the request, follow its response and upstream logs from there.
After a fix, rerun the normal hostname request from the external network with no address override. Confirm the response comes from the expected app.