Accessing services externally - having trouble

I'm new to self hosting and home labs in general and I'm trying to understand how I can make some of my services accessible outside my network. At the moment I'm just experimenting with my Synology NAS (I know they have QuickConnect), but eventually I want to do it with JellyFin, Game Servers, NextCloud and various other things. My main priority is security.

I know there's multiple ways of doing this and I've watched a bunch of different videos but I'm struggling to get it working so I'm trying to understand the steps a little better. Here I'm attempting to use NGINX as a reverse proxy with Cloudflare.

1. I have my own domain name. I purchased it from Namecheap and I've set it up to use Cloudflare nameservers (for this, i'll just use example.net)

2. In Cloudflare DNS settings, I have two records:
   (To my understanding, this should point my domain name plus any subdomains to my router)

   1. Type: A
      Name: @ (acts as root, so my root domain name e.g. example.net)
      IPv4: My public IP address
      Proxied: Yes
      TTL: Auto
   2. Type: CNAME
      Name * (acts as wildcard)
      Target: My domain name (e.g. example.net)
      Proxied: Yes
      TTL: Auto

3. Now, I believe this will route all traffic to my router but my router won't let it in, so I need to forward the correct ports.. I think this might be where I'm getting things mixed up.
   NGINX is running in a docker container on 192.168.0.15 with published ports:
   40080:80
   40081:81
   40443:443
   So on my router, I'm allowing all inbound traffic on 40080 and 40443 and directing to 192.168.0.15.
   Which I "think" routes traffic to my home network to NGINX? Though I might have misunderstood how that works.

4. In NGINX I've set up a Let's Encrypt SSL certificate for domains example.net and *.example.net and I've set "Use a DNS Challenge" using Cloudflare and the token I copied earlier. That adds successfully so I assume that worked.

5. Finally I go to "Add Proxy Host" and add a domain called nas.example.net and forward it to http 192.168.0.2 (my nas) with port 5000. This is what I can use to access the interface locally.

So that's what I'm doing, and what I'm getting as a Cloudflare Connection Timed out Error 522 so something's not working somewhere but I'm not sure where.

I also tried opening ports 80 and 443 on my firewall and directing traffic to 192.168.0.15 and I get a 521 server down error which I'm not sure whether is an improvement or not?

I imagine it's just my misunderstanding one of the steps, likely around which ports I need to forward but I've tried all sorts and I'm not getting anywhere.

Apologies for the long post.

Any help?