Access to other local IP

Zero Trust Cloudflare Tunnel
1

I currently have some services connected to CF Tunnels (ex: service1.domain.com; service2.domain.com, etc.) on my Synology NAS

service1.domain.com points to 192.168.1.200:port1
service2.domain.com points to 192.168.1.200:port2
service3.domain.com points to 192.168.1.211
service4.domain.com points to 192.168.1.211:80

Services 1 and 2 work fine. But services 3 and 4 do not.
It seems the tunnel can only communicate with services running on the IP of the NAS (192.168.1.200) but not with services running on other IPs (e.g. 192.168.1.211).

More details: I have a pihole docker on the NAS that has a macvlan and hence has its own IP. When the same pihole docker is configured on the NAS using the NAS IP and a port, CF tunnel works fine.

Is it not possible to access other local IPs? Or do I need to set something up to achieve that?

The error log is as follows:
2023-05-11T20:49:12Z ERR error=“Incoming request ended abruptly: context canceled” cfRay=7c5d49c7de5b42f8-EWR event=1 ingressRule=3 originService=http://192.168.1.211
2023-05-11T20:49:12Z ERR Request failed error=“Incoming request ended abruptly: context canceled” connIndex=1 dest=https://service3.domain.com/admin event=0 ip=198.41.192.37 type=http
2023-05-11T20:49:13Z ERR error=“Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared: dial tcp 192.168.1.45:80: connect: no route to host” cfRay=7c5d49da2e1a3350-EWR event=1 ingressRule=3 originService=http://192.168.1.211
2023-05-11T20:49:13Z ERR Request failed error=“Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared: dial tcp 192.168.1.211:80: connect: no route to host” connIndex=1 dest=http://service3.domain.com/admin event=0 ip=198.41.192.37 type=http

3

Is it possible to access other IPs with tunnels. My first though is that something with the NAS networking in blocking the connections from the cloudflared container. You can look at the cloudflared logs to see what the error being returned is to verify.

4

Thanks. I figured it out (actually GTP4 did).

The pihole has a second IP on another subnet. From my laptop I can only access using http://192.168.1.211 and not the other IP.
But somehow, from the NAS, http://192.168.1.211 is not reachable, but the other IP on the other sebnet is reachable.
I put that other IP in CF tunnel, and all works now.

Weird…