Firewall / Ports?

[sjau]

Hi there

I'm having a bit of an issue to access the web client through NAT Firewall.

For the setup:

On my home server I use nginx as Web/Proxy server with the following config:

    user nginx nginx;
    error_log stderr;
    daemon off;
    events {
    }
    http {
            include /nix/store/ch46d8j7wzv1m03sc93gxrx3g22w0x5w-nginx-1.14.2/conf/mime.types;
            include /nix/store/ch46d8j7wzv1m03sc93gxrx3g22w0x5w-nginx-1.14.2/conf/fastcgi.conf;
            include /nix/store/ch46d8j7wzv1m03sc93gxrx3g22w0x5w-nginx-1.14.2/conf/uwsgi_params;
            ssl_protocols TLSv1.2 TLSv1.3;
            ssl_ciphers EECDH+aRSA+AESGCM:EDH+aRSA:EECDH+aRSA:+AES256:+AES128:+SHA1:!CAMELLIA:!SEED:!3DES:!DES:!RC4:!eNULL;
            # $connection_upgrade is used for websocket proxying
            map $http_upgrade $connection_upgrade {
                    default upgrade;
                    ''      close;
            }
            client_max_body_size 10m;
            server_tokens off;
            server {
                    server_name sub.domain.tld ;
                    location / {
                            return 301 https://$host$request_uri;
                    }
            }
            server {
                    listen *:45000 ssl http2 ;
                    server_name sub.domain.tld ;
                    root /var/www/kvm;
                    ssl_certificate /https-cert.pem;
                    ssl_certificate_key /https-key.pem;
                    location /spice-web-client/ {
                            index index.php index.html index.htm vnc.html;
                            auth_basic "Restricted Content";
                            auth_basic_user_file /var/www/.htpasswd;
                    }
                    location /websockify/ {
                            proxy_pass https://127.0.0.1:5959;
                            proxy_http_version 1.1;
                            proxy_set_header Upgrade $http_upgrade;
                            proxy_set_header Connection $connection_upgrade;
                            # VNC connection timeout
                            proxy_read_timeout 61s;
                            # Disable cache
                            proxy_buffering off;
                    }
            }
    }

Websockify is from 5959 to 5900
and the VM SPICE port is 5900

So, in the lan, I can just open a browser, type: https://sub.domain.tld:45000/spice-web-client/index.html?host=sub.domain.tld&port=5959, it will prompt me for http basic auth and then display it.

On the firewall I did forward port 45000, 5959 and 5900 to the home server:

When I try to access it from outside the lan (aka the internet) and type in https://sub.domain.tld:45000/spice-web-client/index.html?host=sub.domain.tld&port=5959 it also prompts me for username and password for http basic auth but then only a black screen appears.

What did I forget?