webtest.abuscom.cloud

This page came through the tunnel.

It is served by a Hetzner server with no public address, on a private network that accepts nothing from the internet. Reaching it any other way is not possible, so the fact that you are reading this is the test result.

What answered

Requested host

—

Protocol

—

Served by

webtest (10.0.0.11), no public IP

Relayed by

frp

The path it took

1. Public DNS pointed webtest.abuscom.cloud at the tunnel server.
2. The tunnel server matched the SNI field and forwarded the stream encrypted.
3. It travelled down a connection frpc opened outwards from inside the VPC.
4. Caddy decrypted it here, on this machine, and proxied to nginx.

One thing worth checking by hand: the certificate. It has to be issued by Let's Encrypt for this hostname, not the bought wildcard for the internal zone. That is the proof TLS was terminated inside the VPC rather than on the relay — and that Caddy answered an ACME challenge through the same tunnel your request just used.