UniFi local HTTPS through OpenClash — proxy bypass contract

Symptom

OpenClash on gfw.windy.lan can log:

[TCP] dial DIRECT (match IPCIDR/127.0.0.0/8) 192.168.66.46:<port> --> localhost:8443
error: dial tcp 127.0.0.1:8443: connect: connection refused

This does not mean OpenClash should listen on port 8443. The gateway's loopback interface has no UniFi service.

Cause

ubnt runs the UniFi controller locally on *:8443. Its container also uses HTTP/HTTPS proxy variables. If NO_PROXY / no_proxy omit loopback addresses, a request for its own localhost:8443 is sent to the OpenClash HTTP proxy. OpenClash correctly applies its loopback direct rule, but that direct request is then made from the gateway, where port 8443 is not open.

Required configuration

In /home/windy/unifi-9/compose.yml, keep both environment entries enabled:

environment:
  - NO_PROXY=localhost,127.0.0.1,::1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12
  - no_proxy=localhost,127.0.0.1,::1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12

Keep the upper- and lowercase forms because different processes and libraries consult different spellings.

Apply and verify

cd /home/windy/unifi-9
docker compose config -q
docker compose up -d --force-recreate unifi
docker inspect --format '{{.State.Health.Status}}' unifi-controller
curl -k -sS -o /dev/null -w '%{http_code}\n' https://127.0.0.1:8443/

Expected result: Docker health is healthy and the local HTTPS request returns an HTTP success or redirect response. Recheck OpenClash logs afterwards; the localhost:8443 connection-refused entries should stop.

Safety

Do not add a dummy listener on the gateway's 127.0.0.1:8443.
Do not solve this with a router redirect rule; that would hide a client-side proxy error and could send local controller traffic to the wrong host.
Back up compose.yml before changing it and avoid docker compose down -v.

2.0 KiB Raw Blame History