Install NGINX on the VPS, point your domain to its public IP, and create a server block that listens on ports 80 and 443 while forwarding requests to an application bound to 127.0.0.1 (for example, port 3000). Validate every configuration change with sudo nginx -t before reloading, then use Certbot to add HTTPS and configure explicit upgrade headers for WebSockets.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What an NGINX reverse proxy does
A reverse proxy is the public entry point for an application that does not need to be exposed directly to the internet. The client connects to NGINX using your domain name. NGINX accepts the HTTP or HTTPS request, sends it to the application running on the VPS, receives the response, and returns that response to the client.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteIn a common arrangement, NGINX listens on the VPS’s public interfaces on TCP ports 80 and 443, while the application listens only on 127.0.0.1:3000. The application port remains unreachable from the public internet, and NGINX provides the domain, TLS termination, request forwarding, and access/error logging.
NGINX’s documented proxy sequence is to send a request to a specified proxy server, fetch the response, and send that response back to the client. The proxy_pass directive identifies the upstream address. Request headers such as the original host, client address, and protocol should be forwarded explicitly so the application can generate correct links, logs, redirects, and audit records.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prerequisites on the VPS
- A Linux VPS with a public IPv4 address, IPv6 address, or both.
- A domain whose DNS A and/or AAAA record points to the VPS address. DNS changes must resolve before certificate issuance.
- An application already running and listening on a known local address and port, such as
127.0.0.1:3000. - Permission to install packages and edit files under
/etc/nginx, normally throughsudo. - Inbound TCP 80 and 443 allowed in both the VPS firewall and any cloud-provider firewall. Keep the application’s port private whenever possible.
Firewall commands differ by Linux distribution and hosting provider, so use the controls supplied by your VPS provider and the distribution’s current firewall documentation. Do not expose the application port merely because NGINX needs to reach it locally.
Install NGINX
For a conventional Ubuntu or Debian deployment, install the distribution package. Distribution packages are the simplest choice for a stable, integrated service and systemd unit. If you need a newer vendor build, use the current instructions from the official NGINX repository instead; package names, repository keys, and supported releases change over time.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
After installation, confirm that the service is running and that the package created the expected configuration directories. Ubuntu-style installations normally use:
/etc/nginx/nginx.conffor the main configuration./etc/nginx/sites-available/for server-block files that are defined but not necessarily enabled./etc/nginx/sites-enabled/for symbolic links to the sites that NGINX should load.
Other distributions may use a different layout, so inspect the package’s main configuration if those directories are absent.
Point DNS and confirm the local application
Point the domain at the VPS
Create an A record for the domain’s IPv4 address and, if the VPS serves IPv6, an AAAA record for its IPv6 address. Include every hostname you intend to place in server_name, such as both example.com and www.example.com. Wait for the records to resolve publicly before requesting a certificate.
Test the upstream from the VPS
Before involving NGINX, verify that the application itself responds on its local address:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
curl -I http://127.0.0.1:3000A response confirms that a process is listening and returning HTTP. If the command reports “connection refused,” times out, or returns an application error, fix the application service, bind address, port, or local permissions first. NGINX cannot proxy a service that is not reachable from the VPS.
Create the first HTTP server block
Write the configuration file
Create a file named /etc/nginx/sites-available/example.com. Replace the domain names and local port with the values used by your deployment.
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}
}Understand each directive
| Directive | Purpose |
|---|---|
listen 80 |
Accepts IPv4 HTTP connections on the standard public web port. |
listen [::]:80 |
Accepts IPv6 HTTP connections when IPv6 is configured on the VPS. |
server_name |
Selects this server block for requests whose Host header matches the listed names. |
location / |
Applies the proxy rules to the site’s URL paths. |
proxy_set_header Host $host |
Passes the requested hostname to the application instead of allowing an upstream default. |
X-Real-IP |
Passes the direct client address in a simple header. |
X-Forwarded-For |
Maintains the forwarded client-address chain when more than one proxy is involved. |
X-Forwarded-Proto |
Tells the application whether the client used HTTP or HTTPS at NGINX. |
proxy_pass |
Connects the public location to the local application. |
Enable the site
On Ubuntu and Debian layouts, create a symbolic link in sites-enabled:
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.comIf the default site claims the same port and catches requests before your intended server block, disable that default link only after confirming that no required site depends on it. Do not delete configuration files blindly; remove or adjust the enabled link and keep a copy if you may need to restore it.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchChoose the correct proxy_pass path behavior
The trailing URI in proxy_pass changes how NGINX constructs the upstream request. With:
location / {
proxy_pass http://127.0.0.1:3000;
}NGINX forwards the original request path, so a request for /api/users reaches the application as /api/users. If you include a URI in the directive, NGINX replaces the portion matched by the location with that URI. For example:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
location /api/ {
proxy_pass http://127.0.0.1:3000/;
}Here the /api/ prefix is replaced by /, so a client request for /api/users is sent upstream as /users. Decide whether the application expects the public prefix and keep the slash placement intentional. Unexpected 404 responses are often caused by forwarding a different path than the application routes.
Validate the configuration and reload safely
Always test before applying a change:
sudo nginx -tThe -t test checks configuration syntax and attempts to open files referenced by the configuration, including certificate files and included snippets. Correct any reported filename, permission, directive, or syntax error before continuing.
When the test succeeds, perform a graceful reload:
sudo systemctl reload nginxA reload starts workers with the new configuration while existing workers finish active requests. If NGINX cannot apply the new configuration, the previous workers continue serving traffic rather than being replaced by a broken configuration. This behavior is why testing and reloading are safer than stopping the service for every edit.
After the reload, test the domain over HTTP. If the request reaches the wrong server block, check the spelling of server_name, DNS resolution, and whether another enabled site is acting as the default.
Add HTTPS with Certbot
Use the NGINX plugin after HTTP works
Once DNS resolves to the VPS and the HTTP server block responds correctly, install Certbot using the current Ubuntu instructions. Request certificates for every hostname the site serves:
sudo certbot --nginx -d example.com -d www.example.comThe NGINX plugin finds matching server blocks, adds the TLS directives and certificate paths, and reloads NGINX. It can configure the certificate for the names supplied with -d; a certificate for one hostname does not automatically cover a different hostname.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Redirect HTTP to HTTPS
Public traffic should normally end on HTTPS. The port-80 server block can be reduced to a redirect while the port-443 block serves the application:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}Certbot commonly adds or updates the port-443 server block with the certificate and private-key directives. Let the tool write the exact certificate paths for the issued names rather than guessing them. Keep port 80 reachable so certificate validation and HTTP-to-HTTPS redirects can work, but do not send application data over the unencrypted listener.
Check the public TLS endpoint
After issuance and reload, inspect the endpoint from the VPS or another machine:
curl -Ik https://example.comLook for a successful TLS handshake and the expected HTTP status or redirect. If the certificate name does not match, confirm that the requested hostname appears in the certificate command and that DNS is not still pointing at an older server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Proxy WebSockets correctly
WebSockets begin as HTTP requests and then switch protocols. NGINX does not pass the hop-by-hop Upgrade and Connection headers automatically, so a WebSocket location needs explicit directives:
location /socket/ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_pass http://127.0.0.1:3000;
proxy_read_timeout 3600s;
}The endpoint path, upstream port, and timeout are application-specific. The one-hour timeout above is an example for a connection expected to remain idle for a long period; choose a value that matches the application’s heartbeat and reconnect design. A short timeout can disconnect quiet clients, while an unnecessarily long timeout can retain idle resources.
Keep the WebSocket location more specific than a catch-all location when both exist. Confirm that the application recognizes the path, accepts HTTP/1.1, and is prepared to trust the forwarded host and client headers. A failed protocol switch commonly appears as a handshake error, an immediate disconnect, or an HTTP 400/426 response.
Recommended Free Tools
Troubleshoot in a reliable order
| Symptom | Likely cause | Checks and corrective action |
|---|---|---|
| NGINX will not reload | Syntax error, missing include, unreadable certificate, or invalid referenced file. | Run sudo nginx -t; follow the reported file and line, correct permissions or syntax, test again, then reload. |
| 502 Bad Gateway | NGINX cannot obtain a valid response from the upstream. | Check that the application is running, listening on the configured address and port, and reachable with curl -I http://127.0.0.1:3000. Review NGINX’s error log for connection or protocol details. |
| Connection refused locally | The application stopped, listens on another port, or binds only to a different address. | Inspect the application’s service status and listening sockets; update proxy_pass or the application bind setting only after confirming the intended private address. |
| Domain shows the wrong site | DNS points elsewhere, the hostname is absent from server_name, or an enabled default site matches first. |
Verify A/AAAA resolution, the exact Hostname spelling, and the links under /etc/nginx/sites-enabled/. |
| 404 appears only after adding a prefix | The URI form of proxy_pass rewrote the path unexpectedly. |
Compare the public location and the upstream route. Remove the URI from proxy_pass to preserve the original path, or keep it and adjust the application’s expected prefix. |
| HTTPS redirects repeatedly | The application does not know that the original client connection was HTTPS, or a redirect is configured on both sides with conflicting assumptions. | Keep proxy_set_header X-Forwarded-Proto $scheme, configure the application to honor its trusted proxy, and inspect both NGINX and application redirect settings. |
| WebSocket handshake fails | Upgrade headers are missing, HTTP/1.1 is not enabled, the location does not match, or the upstream path is wrong. | Add the explicit Upgrade and Connection headers, set proxy_http_version 1.1, verify the endpoint path, and inspect the error log. |
| Certificate issuance fails | DNS has not reached this VPS, port 80 is blocked, or the requested name does not match a server block. | Resolve each hostname publicly, allow TCP 80, confirm the HTTP response, and rerun Certbot with the exact names in server_name. |
Inspect service state and logs
When a reload or startup fails, inspect systemd and its journal:
sudo systemctl status nginx
sudo journalctl -u nginxFor requests that reach NGINX but behave unexpectedly, inspect the configured access and error logs. The access log shows what NGINX received and returned; the error log is particularly useful for upstream connection failures, permission problems, and protocol errors. Check the application logs at the same time so you can distinguish a proxy failure from an application response.
Operational practices after the first deployment
Keep the application private
Bind the application to localhost or another private interface when only NGINX needs to reach it. Exposing the application port publicly bypasses the proxy’s TLS, hostname routing, and logging controls. If another internal service must connect, use a private network interface and restrict the provider firewall to the required sources.
Make one configuration change at a time
Store each site’s file under sites-available, enable it with a deliberate symbolic link, run sudo nginx -t, and reload only after a successful test. This sequence makes it clear which edit caused a failure and preserves the last working worker processes when a test rejects a change.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Plan certificate and package maintenance
Certificate files, package versions, and repository procedures change. Keep track of the hostnames covered by the certificate, verify that automated renewal remains configured according to the current Certbot and Ubuntu guidance, and test a renewal path before a certificate approaches expiration. Apply NGINX package updates through the distribution or official repository you selected, then repeat the syntax test and a controlled reload.
End-to-end deployment checklist
- Create the VPS and record its public IPv4 and IPv6 addresses.
- Point every required DNS A/AAAA record at those addresses.
- Allow inbound TCP 80 and 443 in the VPS and cloud firewalls; leave the application port private.
- Install NGINX from the distribution package or the current official repository instructions.
- Confirm the application responds locally with
curl -I http://127.0.0.1:3000. - Create
/etc/nginx/sites-available/example.comwith the server block and forwarded headers. - Enable the file through
/etc/nginx/sites-enabled/and resolve any default-site conflict. - Run
sudo nginx -t, thensudo systemctl reload nginx. - Test the domain over HTTP and inspect NGINX access/error logs if the response is unexpected.
- Run
sudo certbot --nginx -d example.com -d www.example.comafter DNS and HTTP validation succeed. - Confirm HTTPS with
curl -Ik https://example.comand retain an HTTP-to-HTTPS redirect. - If the application uses WebSockets, add HTTP/1.1 plus explicit
UpgradeandConnectionheaders and choose an appropriate read timeout.
This arrangement gives the public domain a controlled NGINX front end while the application remains on a private local port. The two safeguards that prevent most outages are simple: verify the upstream independently, and never reload an untested configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
