Trouble reaching backend hosts

[DragonPi]

Hello,

As the title suggest I'm having trouble setting up NPM in my environment.

• Dynamic Public IP registered at dyn.com so the host resolves to public side of my router
• Public IP NAT'ed to 192.168.1.1 (Router's IP on the LAN side)
• Raspberry PI where I have the NPM running (192.168.1.xxx network)
• Another Raspberry PI where I have a Nextcloud instance (192.168.1.xxx network)
• Another Raspberry PI serving as internal DNS/DHCP (192.168.1.xxx network)
• Raspberry PI cluster with K3S running (192.168.1.xxx network)
• Few client machines running both linux and windows (192.168.1.xxx network)

NPM is going to replace my "old" nginx reverse proxy I used to contact the Nextcloud instance. which worked previously without an issue. This to illustrate that the port forwarding on the provider side etc... are working as expected.

• External DNS resolves nextcloud.mydomain.com to my public IP
• Internal DNS resolves nextcloud.mydomain.com to my host_A local IP where NPM resides
• Internal DNS resolves host_B.mydomain.com to the local IP where the nextcloud instance runs

My proxy host config for nextcloud forwards to host_B.mydomain.com

When contacting nextcloud.mydomain.com from an internal client machine I can reach the nextcloud instance. However when coming from the outside, so via the public IP, the connection times out.
However:
When I add network_mode: host to the docker-compose.yaml I can connect from both the outside AS the inside.
You would guess problem solved but in this scenario the login into NPM doesn't work... (I can get to the login page, but when I login it always returns back to the login page)

To rule out a config/compatibility issue on the Nextcloud side, I started a test container on the K3S cluster and the behavior is the same.

Basically two questions:

Is the network_mode: host the way to go or shouldn't that be necessary,
If not, what am I missing?
If yes: How can I make the login from NPM work?

Thanks for the assistance!

kind regards.

[DragonPi]

Additional info I discovered:
When running in network_mode: host I randomly get a 404 host not found.
This is not happening when not activating the network_mode: host (but then services can never be reached from the outside)