To configure NGINX as an HTTP reverse proxy, have a server block accept client requests with listen, then use proxy_pass inside a matching location to send them to the backend. The two ports do different jobs: listen 80 accepts incoming traffic on port 80, while a destination such as 127.0.0.1:8080 tells NGINX where the application is listening.
A minimal reverse proxy configuration
This example defines a named backend group with one server, then directs requests for example.com to it:
As an Amazon Associate I earn from qualifying purchases.
http {
upstream app_backend {
server 127.0.0.1:8080;
}
server {
listen 80;
server_name example.com;
location / {
proxy_pass http://app_backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}
}The example illustrates documented NGINX directives; it is not a tested deployment recipe. Put the upstream group and server block inside the appropriate http context in your NGINX configuration. NGINX’s Beginner’s Guide also demonstrates proxying to a local service at http://localhost:8080.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How the public and backend ports differ
listen specifies the local address and port on which a server accepts client connections. proxy_pass specifies the destination NGINX connects to after a request matches a location. For example, clients can connect to NGINX on port 80 while the application listens on port 8080; the backend port does not change the public listening port.
#1 Best Overall
The NGINX core module reference documents port 80 as the default when listen specifies only an address. If listen is omitted, the default depends on whether NGINX runs with superuser privileges, so define the directive explicitly rather than relying on an implicit port.
Choosing a backend address or an upstream group
Use a direct address for one backend
For a single backend, a location can point directly to its address, for example proxy_pass http://127.0.0.1:8080;. The destination may use HTTP or HTTPS and can identify a domain or IP address with an optional port, or a UNIX-domain socket. See the proxy module reference for the supported proxy_pass forms.
Use a named upstream group for a backend pool
A named upstream group gives one reusable name to one or more backend servers. A location can refer to that group with proxy_pass http://app_backend;. The group is useful when you have multiple backend servers or want the destination to be clearly named in the configuration. NGINX’s HTTP load-balancing guide documents round-robin distribution when no other balancing method is configured.
Check virtual-host selection before debugging the backend
NGINX first matches the connection’s IP address and port against configured listen directives. Among the servers that match, it uses the request’s Host header and server_name values to select a server block. If no name matches, NGINX uses the default server for that listen address and port. The request-processing guide describes this selection order.
- Confirm the client is connecting to the address and port that your intended server block listens on.
- Check that the requested hostname matches the block’s
server_name. - If the hostname does not match, check which server is the default for that listen address and port.
Understand URI handling in proxy_pass
Whether proxy_pass includes a URI changes how NGINX maps a request path. When the directive includes a URI, NGINX replaces the part of the normalized request URI that matched the location with that URI. When it has no URI component, NGINX follows different documented rules for forwarding the original or normalized request URI. The difference is significant for path-based routing, so choose the form based on the path the backend is expected to receive.
For instance, compare proxy_pass http://app_backend; with proxy_pass http://app_backend/service/; in a location that matches a path prefix. The second form includes a URI and therefore applies the documented replacement behavior; a trailing slash is not merely formatting. Consult the proxy module reference when the exact URI transformation matters.
Set the request headers your application expects
For HTTP/1.0 and HTTP/1.1 proxying, NGINX does not pass the original Host and Connection fields through unchanged by default. Use proxy_set_header to set header values the backend needs. The example sets Host to $host and sends the connecting client address as X-Real-IP; verify that these are the values your application expects. Header behavior and available variables are documented in the proxy module reference.
Quick Recap
Best Value
Troubleshoot by following the request path
- NGINX is not accepting connections: Check the configured
listenaddress and port, then verify that the client is connecting to them. - The wrong virtual host responds: Check the listen address and port,
server_name, Host header, and default-server selection. - The backend is unreachable: Check that the destination host, socket, and port in
proxy_passor the upstream group identify a backend NGINX can reach. - The application receives an unexpected path: Check whether
proxy_passincludes a URI and compare the location prefix with the path the backend needs. - The application sees the wrong host or client address: Review the configured
proxy_set_headervalues and the backend’s expectations.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
