Fixing 'Site Can't Be Reached

The 'Site Can't Be Reached - Refused Connect' error in Unraid with SWAG usually stems from incorrect container network configurations or missing port mappings. Ensuring your WordPress and Nextcloud containers are on the same bridge network as SWAG, and verifying that host ports are correctly forwarded to the internal container ports, resolves the connection refusal immediately.

Understanding the Network Architecture

Before diving into fixes, it is crucial to understand how Docker networking works within Unraid, specifically when using the LinuxServer.io SWAG (Secure Web Access Gateway) container. SWAG acts as a reverse proxy, sitting between the internet and your local applications like WordPress and Nextcloud. If the proxy cannot reach these applications, it results in a refusal of connection because the traffic has nowhere to go.

Docker containers are isolated by default. For SWAG to proxy requests to your other services, they must be able to communicate via DNS names or IP addresses on the same virtual network. A common mistake is leaving containers on the default bridge network while SWAG uses a custom frontier or swag network. This isolation prevents the necessary handshake, leading to the "Refused Connect" error.

Verify Container Network Settings

The most frequent cause of this issue is a mismatch in Docker networks. You need to ensure that both your WordPress and Nextcloud containers are attached to the same network as your SWAG container. In Unraid, this is typically managed through the Docker template settings or via command line.

1. Identify the SWAG Network: Check the network name assigned to your SWAG container. It is often named frontier or swag_net. You can verify this by looking at the Docker tab in the Unraid web UI.
2. Update Application Networks: Go to the settings for your WordPress and Nextcloud containers. Locate the network field and change it from bridge to match the SWAG network name exactly.
3. Restart Containers: After changing the network, restart both the application containers and the SWAG container. Docker needs to re-establish the DNS resolution links between the containers.

If you are unsure about the network name, you can inspect the running containers using the terminal. Run docker inspect swag (replace swag with your actual container name) and look for the Networks section. Ensure your other containers list the same network name there.

Check Port Mappings and Host Connectivity

Even if the internal Docker network is correct, the external connection might fail if port mappings are misconfigured. The "Refused Connect" error can sometimes occur if the host machine is not listening on the expected ports, or if there is a conflict with other services.

Ensure that your WordPress and Nextcloud containers have their internal ports mapped to available host ports. For example, if WordPress runs internally on port 80, map it to a unique host port like 8080. Then, configure SWAG to proxy to host:port rather than just the container name if you are using non-standard ports.

Additionally, check for any firewall rules on the Unraid host itself. While Unraid generally allows all internal Docker traffic, external access requires proper port forwarding on your router. If you are testing locally, try accessing the application directly via http://unraid-ip:port to rule out router issues. If direct access works but the proxy fails, the issue is definitely within the SWAG configuration or Docker networking.

Review SWAG Configuration Files

SWAG uses Nginx under the hood, and its configuration files dictate how traffic is routed. Incorrect server block definitions can lead to connection refusals. Navigate to the /config/nginx/proxy-confs directory inside your SWAG container volume on the Unraid array.

For Nextcloud, ensure that the nextcloud.subdomain.conf.sample file is copied to nextcloud.subdomain.conf (removing the .sample extension). Similarly, for WordPress, use the appropriate subdomain or subfolder configuration file. These sample files contain pre-configured Nginx directives optimized for these applications.

Open the active configuration file and verify the proxy_pass directive. It should point to the correct internal IP or container name and port. For instance, it might look like proxy_pass http://nextcloud:80;. If you changed the internal port of the Nextcloud container, update this line accordingly. Save the file and reload the SWAG container configuration by restarting it.

Validate SSL and DNS Resolution

While the primary error is a connection refusal, SSL certificate issues can sometimes manifest as connectivity problems if the proxy fails to initialize properly. SWAG handles Let's Encrypt certificates automatically, but if the initial request fails due to network issues, the certificate won't generate.

Check the logs of the SWAG container for errors related to DNS resolution. If SWAG cannot resolve the hostname of your WordPress or Nextcloud container, it will refuse the connection. Ensure that the Docker DNS service is functioning correctly. You can test this by executing a ping command from within the SWAG container to the application container name.

If DNS resolution is failing, it reinforces the need to check the network attachment step. Containers on different networks cannot resolve each other's names by default. Once they are on the same network, Docker's embedded DNS server will handle the resolution seamlessly.

Frequently Asked Questions

Why does my SWAG container show "Connection Refused" even after fixing networks?

This often happens if the target application container is not fully started before SWAG attempts to connect. Restarting the SWAG container after ensuring all dependent apps are running usually resolves the timing issue. Additionally, check if the application is listening on IPv6 instead of IPv4, which SWAG might not prioritize by default.

Can I use the default bridge network for SWAG and my apps?

No, using the default bridge network makes inter-container communication difficult because DNS resolution between containers on the bridge network is not reliable without explicit linking. Using a custom user-defined bridge network, such as frontier, ensures that containers can find each other by name easily.

How do I check if my ports are conflicting on Unraid?

You can check for port conflicts by attempting to start the container; Docker will throw an error if the port is already in use. Alternatively, use the command netstat -tulpn | grep :port_number to see which process is holding the port. Ensure no other service, like the Unraid web UI or another Docker container, is using the same host port.

What if I want to access my site via a subdomain instead of a subfolder?

SWAG supports both subdomains and subfolders. For subdomains, ensure you have a wildcard DNS record pointing to your Unraid IP address. Then, create a separate configuration file in the proxy-confs directory with the naming convention subdomain.domain.com.conf. Subfolders require a single configuration file where you define the path matching rules explicitly.

Is it safe to expose WordPress and Nextcloud directly to the internet?

It is never recommended to expose these applications directly without a reverse proxy. SWAG provides essential security features like rate limiting, SSL termination, and protection against common web vulnerabilities. Always route traffic through SWAG to ensure your data remains secure and accessible only through encrypted connections.