Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →A reverse proxy puts Nginx at your VPS’s public edge and forwards requests to an application that listens privately, commonly on 127.0.0.1:3000. Point your domain’s DNS record at the VPS, allow TCP ports 80 and 443, create an Nginx server block with proxy_pass, test it with nginx -t, and then issue a Let’s Encrypt certificate with Certbot. The result is a single HTTPS hostname for your app without exposing the application port to the internet.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What an Nginx reverse proxy does
When a browser requests https://example.com/, Nginx accepts the public connection, selects a matching server block, and sends the request to the configured upstream application. It then returns the application’s response to the browser. In Nginx’s own description, a proxy sends the request to a specified proxy server, fetches the response, and sends that response back to the client.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
This arrangement gives you one controlled public entry point while the application remains on a loopback or private-network address. Nginx can terminate TLS, redirect HTTP, preserve the original host and client address, and route different hostnames to different services.
Before you configure anything
Use a supported, updated VPS
Start with a currently supported Linux distribution and apply security updates. Create a normal administrative account with sudo instead of administering the server as root for routine work. Install Nginx from the distribution repository so its service files, log locations, and update mechanism match the operating system.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Restrict inbound traffic at both layers that apply to your provider:
- Allow SSH only from the addresses or network you use to administer the server, where practical.
- Allow TCP port 80 for HTTP and certificate validation.
- Allow TCP port 443 for HTTPS.
- Do not open the application port, such as 3000, unless the application explicitly needs direct public access.
A cloud security group or provider firewall can block a port even when the VPS’s local firewall allows it, so check both.
Know the request path
| Layer | Typical address | Purpose |
|---|---|---|
| Browser | https://example.com |
Connects to the public hostname. |
| DNS | A record to the VPS public IPv4 address | Maps the hostname to the server. |
| Nginx | VPS ports 80 and 443 | Accepts HTTP/HTTPS and proxies requests. |
| Application | 127.0.0.1:3000 or a private address |
Handles the request without being internet-facing. |
Prepare and verify the backend application
Bind the application privately
Configure the app to listen on a loopback address such as 127.0.0.1:3000, or on a private network address when Nginx and the app are on separate hosts. Binding to loopback prevents unsolicited internet connections to the service. If the application is containerized, make sure the address and port are reachable from the Nginx host rather than assuming that localhost inside one container means the VPS host.
Start the app with the process manager or service definition you normally use, then test it locally before adding Nginx:
curl -i http://127.0.0.1:3000/You should receive an application response, such as an HTTP status and headers. If this command fails, fix the application’s process, bind address, port, or local firewall policy first. Nginx cannot repair a backend that is stopped or listening elsewhere.
Point DNS to the VPS
Create the correct records
Create an A record for the hostname you will publish, pointing to the VPS’s current public IPv4 address. Add an AAAA record only when IPv6 is correctly configured on the VPS, including routing and firewall rules. An AAAA record that points to an unreachable address can make some clients fail even though IPv4 works.
Free tools Windows power users keep installed
One-click scans. No signup required.
If you want both the apex name and a www name, create records for both and list both names in Nginx and in the certificate request. DNS changes may take time to appear according to the record’s TTL. Check what public resolvers return:
dig +short example.com A
dig +short example.com AAAA
getent hosts example.comThe returned address must be the VPS you are configuring. The Nginx server_name must match the hostname sent by the browser; otherwise a different enabled server block may answer.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Install Nginx and create the first server block
Install the package
On a Debian- or Ubuntu-based VPS, update package metadata and install Nginx:
sudo apt update
sudo apt install nginxConfirm that the service is running:
sudo systemctl status nginxOther distributions use different package commands and may organize virtual-host files differently, but the Nginx directives are the same.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWrite a minimal HTTP proxy
On Debian and Ubuntu, create /etc/nginx/sites-available/your-app with a server block like this. Replace the hostnames and upstream port with your values:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}
}proxy_pass tells Nginx where to send the request. The header directives preserve information that would otherwise be lost at the proxy boundary:
Hostlets the application select the correct virtual host and construct links for the requested domain.X-Real-IPcarries the immediate client address.X-Forwarded-Forappends the client address to the forwarding chain, preserving earlier proxies.X-Forwarded-Prototells the application whether the browser used HTTP or HTTPS, which matters for secure redirects and generated URLs.
Understand the trailing-slash behavior
With proxy_pass http://127.0.0.1:3000; and no URI after the port, Nginx passes the original request URI unchanged. A request for /images/logo.png reaches the upstream as /images/logo.png.
If you include a URI, Nginx replaces the part of the request that matched the location prefix. For example:
location /app/ {
proxy_pass http://127.0.0.1:3000/;
}Here, the matched /app/ prefix is replaced by / before forwarding. This distinction is important for path-prefix deployments: the backend may need to generate links as though it is mounted at the root, or it may need an application base-path setting. Decide the desired upstream URI before choosing whether the proxy_pass value ends with a slash.
Enable the site
Create the conventional symlink, then validate the complete Nginx configuration before reloading:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo ln -s /etc/nginx/sites-available/your-app /etc/nginx/sites-enabled/your-app
sudo nginx -t
sudo systemctl reload nginxThe test must report that the syntax is successful and the configuration test is successful. A reload applies the new configuration without unnecessarily stopping existing connections. If the test fails, do not reload; correct the reported file and line first.
Test the proxy before adding TLS
Test each layer separately
- Run
curl -i http://127.0.0.1:3000/on the VPS to verify the application itself. - Run
sudo nginx -tto verify syntax and included files. - Check
sudo systemctl status nginxif Nginx did not start or reload. - From a client that resolves the public DNS record, run
curl -I http://example.com/. - Watch the Nginx error log and the application log together when a request fails. A common Nginx log path is
/var/log/nginx/error.log, although distribution packaging can vary.
A successful local curl but a failed public request usually indicates DNS, a cloud security group, the host firewall, an incorrect server_name, or a request reaching a different server block. A failed local curl is an application or local connectivity problem, not a reverse-proxy problem.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Add HTTPS with Let’s Encrypt and Certbot
Meet the HTTP-01 prerequisites
For an internet-facing Nginx server, a trusted Let’s Encrypt certificate is a practical default. The HTTP-01 challenge requires the certificate authority to reach your hostname on TCP port 80. Keep DNS pointed at the VPS and leave port 80 reachable while requesting and renewing the certificate.
Install Certbot and its Nginx integration on Debian or Ubuntu:
sudo apt update
sudo apt install certbot python3-certbot-nginxRequest certificates for every hostname that should be covered:
sudo certbot --nginx -d example.com -d www.example.comThe Nginx plugin can identify the matching server block, add TLS directives, and reload Nginx. Review the generated configuration rather than treating it as opaque. Confirm that the certificate names match the hostnames users will request, and run:
sudo nginx -tVerify renewal and protect the key
Most distribution packages install a systemd timer or another scheduled renewal mechanism. Inspect the timer and use the installed client’s supported dry-run option to verify that renewal can complete before the first certificate expires. Renewal still needs DNS to resolve correctly and port 80 to remain reachable for HTTP-01 validation.
Private key files should be readable only by the system accounts that need them. Do not copy keys into application directories, source repositories, backups with broad permissions, or chat messages.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Redirect HTTP to HTTPS without breaking the proxy
After the certificate works, use a dedicated port-80 server block to send a permanent redirect, while keeping the proxy configuration in the TLS-enabled server block. A typical port-80 block is:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}The HTTPS block must listen on 443 with the certificate directives and retain the same location proxy settings, including the forwarding headers and upstream address. Redirecting only the root path or omitting the original URI can break deep links.
Do not copy old SSL directives from an unrelated tutorial without checking the Nginx and OpenSSL versions installed on the VPS. Cipher defaults, protocol support, and directive names change over time; use the generated configuration and current distribution guidance as the baseline.
Support WebSockets and long-lived responses
WebSockets need an upgrade handshake
The basic HTTP proxy block is not sufficient for WebSockets. Nginx’s WebSocket proxying support requires special configuration, available since Nginx 1.3.13. Add the HTTP/1.1 and connection-upgrade handling recommended for your installed Nginx release, usually through a mapping in the http context and headers in the affected location:
http {
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
# other http-level configuration...
}
server {
# listen, server_name, and TLS settings...
location /socket/ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}
}Use the actual WebSocket endpoint in the location. Test the application’s handshake and an active connection after every change; a normal page load does not prove that WebSockets work.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Streaming, uploads, and timeouts
Streaming responses and long-lived connections can require different read timeouts or buffering behavior. Large uploads may produce a 413 response when the request-body limit is too small. Change only the relevant location, make one controlled adjustment at a time, run nginx -t, reload, and retest the affected endpoint. Global timeout or buffering changes can increase memory use and keep stalled connections open unnecessarily.
Proxy to an HTTPS upstream
An application on the same VPS is commonly reached over HTTP on loopback. If Nginx connects to an HTTPS service on another host or across a trust boundary, use an HTTPS upstream:
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass https://backend.example.com;
}Configure trusted certificate material and verification when the upstream certificate must be authenticated. Nginx provides directives such as proxy_ssl_trusted_certificate for this purpose. Disabling upstream verification is not a sound default workaround: it removes assurance that Nginx is talking to the intended service.
Host several applications
Separate hostnames
The simplest multi-application design gives each service its own hostname and server block:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute| Hostname | Upstream example | Operational characteristic |
|---|---|---|
app.example.com |
127.0.0.1:3000 |
Independent configuration, logs, and certificate name. |
api.example.com |
127.0.0.1:4000 |
API can use separate limits and WebSocket rules. |
Each block must have the correct server_name, and each hostname must resolve to the VPS. This model avoids most path-rewriting surprises.
Path-prefix routing
Routing example.com/app/ and example.com/api/ to different processes reduces the number of hostnames but introduces URI-prefix decisions. The applications may need base-path configuration, and static assets or redirects can break if an app assumes it owns the domain root. Use explicit locations and verify the exact URI that reaches each upstream.
Choosing between common deployment approaches
| Decision | Direct-control choice | Alternative | Trade-off |
|---|---|---|---|
| One app or many | Separate hostnames and server blocks | Path-prefix routing | Hostnames are simpler; prefixes may require application base-path changes. |
| Upstream transport | HTTP on localhost | HTTPS to a remote or separately trusted host | Local HTTP is simpler; HTTPS protects traffic across hosts and requires certificate verification. |
| Certificate authority | Let’s Encrypt | Commercial or managed certificate authority | Let’s Encrypt is free and automatable; paid or managed services can offer organizational validation, support, or centralized fleet controls. |
| Configuration method | Hand-written Nginx files | Graphical proxy manager | Files are versionable and expose every directive; a GUI can reduce initial friction but adds another management layer. |
Troubleshoot the errors you are most likely to see
502 Bad Gateway
A 502 generally means Nginx could not obtain a valid response from the configured upstream. Check these causes in order:
- The application process is stopped or crashed.
proxy_passuses the wrong address or port.- The application listens on a different interface, such as a private address instead of
127.0.0.1. - A local firewall or security policy blocks Nginx from reaching the upstream.
- The upstream closes the connection or speaks a protocol different from the one in
proxy_pass.
Run the local curl command, inspect the application log and /var/log/nginx/error.log at the same time, and verify the listening socket with the operating system’s service or socket tools.
Wrong site or unexpected redirect
Confirm that DNS resolves to the intended VPS, the requested hostname appears in server_name, and the file is enabled under /etc/nginx/sites-enabled/. Another enabled default block can answer when the hostname does not match. Check the complete loaded configuration after every edit with sudo nginx -t.
Certificate or renewal failure
Verify that the certificate includes every requested hostname, the VPS clock is correct, DNS still points to this server, and TCP port 80 is reachable from the internet. A firewall rule, stale DNS record, or an unreachable AAAA address can prevent the HTTP-01 challenge. Inspect the renewal timer and the Certbot output rather than deleting certificate files and starting over.
WebSocket disconnects
Check that the WebSocket location sends an HTTP/1.1 request and the Upgrade and Connection headers, and that the endpoint path matches the application. Then test an actual WebSocket session. Ordinary HTTP requests can continue to work while the upgrade handshake is misconfigured.
413, timeouts, or incomplete streams
Identify whether the failure is a request-size limit, an upstream read timeout, response buffering, or an application timeout. Adjust the smallest relevant location rather than changing every server globally. Validate and reload Nginx after each change, then repeat the same upload or streaming test that originally failed.
Safe operating routine
- Keep application listeners private and expose only Nginx’s web ports.
- Make one configuration change at a time and save the file in version control.
- Run
sudo nginx -tbefore every reload. - Use
sudo systemctl reload nginxfor valid changes; investigate a failed test before attempting a restart. - Monitor Nginx and application logs together, especially after changing upstream addresses, timeouts, buffering, or TLS.
- Keep DNS, certificate names, firewall rules, and enabled server blocks aligned when adding or removing hostnames.
With those controls in place, Nginx remains the public, inspectable boundary while your Linux VPS applications stay reachable only through the routes you intentionally publish.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
