Nginx Proxy Manager in Docker Returns 502 When Proxying to Windows Jellyfin

The important clue is that Jellyfin works from Windows and the LAN, while the container gets a connection refusal. That points more toward the path between Docker's Linux VM and the Windows host than toward DuckDNS or port forwarding. Try opening a shell inside the Nginx Proxy Manager container and testing the upstream directly, for example with `curl http://host.docker.internal:8096` or `curl http://192.168.x.x:8096`. If the first works, use `host.docker.internal` in the proxy host. If both fail, check whether Jellyfin is listening on an interface reachable from Docker rather than only on localhost, and review the Windows firewall rule for traffic arriving from the Docker or WSL2 network.

Make sure Jellyfin is already running before testing the proxy, then restart or reload Nginx Proxy Manager after confirming that. A refused connection means Nginx reached the target address but nothing accepted the connection there, so checking the upstream from inside the container is more useful than repeatedly checking public DNS or router forwarding.

Docker Desktop on Windows adds another networking layer, and WSL2 does not behave like a normal Linux host network. If direct connectivity tests from the container continue to fail, running both services in the same Docker setup, or moving the stack to a small Linux VM/server, avoids the Windows-host-to-container routing and firewall complications. Simply changing the public domain or port forwarding will not fix an internal upstream connection refusal.