I ran into an issue doing this a few years ago where my ISP was blocking ports 80 and 443. I could port forward from my router on non-standard ports like host1.

I ran into an issue doing this a few years ago where my ISP was blocking ports 80 and 443. I could port forward from my router on non-standard ports like host1.domain.tld:10080 (wan) -> 80 (lan), but LetsEncrypt didn't really like this and it was a pain to manually enter port numbers. My solution was to use a VPS that was doing other stuff to also act as a nginx proxy to the internal machine on a non-blocked port. So it's now host2.domain.tld:443/80 (vps/nginx) -> host1.domain.tld:10080 (wan/host1.domain.tld) -> 80 (lan).