Git SSH over Custom Port (2424) Not Working Behind Cloudflare Tunnel & Nginx Reverse Proxy

Hi everyone,

I'm having an issue with Git SSH cloning from outside my home network. Inside my local network, everything works perfectly using a local hosts file entry mapping to the LXC IP. However, it gets stuck (timeouts) when I try to access it from the outside internet.

My Architecture:

• Edge: Cloudflare Tunnel (gitlab.example.com) ➔ VM 1 (Cloudflared + Nginx Reverse Proxy) ➔ VM 2 (Proxmox LXC running GitLab CE in Docker).
• Docker Port Mapping: 0.0.0.0:2424->22/tcp and 0.0.0.0:8080->80/tcp.

My GitLab web UI works flawlessly from anywhere via the Cloudflare Tunnel, but Git SSH over the custom port 2424 fails entirely from outside. I know that Cloudflare Free Proxy only supports Layer 7 (HTTP/HTTPS) and blocks custom TCP ports like 2424.

Here is my current Nginx config on VM 1:

nginx

server { listen 80; server_name gitlab.example.com; client_max_body_size 250M; location / { proxy_pass http://10.10.20.11:8080; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Ssl on; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_read_timeout 300; proxy_connect_timeout 300; } } 

How do you guys usually handle Git SSH in this kind of architecture?

1. Should I bypass Cloudflare using a "DNS Only" subdomain (e.g., ssh.example.com) and use Nginx stream {} block with port forwarding on my router?
2. Or should I configure Cloudflare Zero Trust / Access SSH (which requires installing cloudflared on my client laptop)?
3. Or is it just better to give up on SSH and switch entirely to HTTPS clone with Git Credential Helper?