Install Webmin from its official package repository, allow its management port through both VPS firewalls, and open https://your-server.example:10000. Webmin initially uses a certificate that browsers may not trust. After a DNS record points your hostname to the VPS, request a trusted Let’s Encrypt certificate in Webmin. If you do not want the management port exposed publicly, terminate HTTPS on port 443 with Nginx or Apache and proxy privately to Webmin on 127.0.0.1:10000.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide covers Debian-family and RHEL-family VPSs, direct access, reverse-proxy layouts, certificate validation, firewall rules, WebSocket support for Terminal, and recovery when the port or proxy configuration is wrong.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →What the finished setup looks like
Webmin is a browser-based administration service running on your Linux VPS. The standard installation listens for HTTPS on TCP port 10000. You can use that endpoint directly or place a web server in front of it.
| Layout | Browser endpoint | Webmin endpoint | Best fit | Important trade-off |
|---|---|---|---|---|
| Direct Webmin | https://hostname:10000 |
Public VPS address on port 10000 | A single VPS where the simplest setup matters most | You must expose and filter a non-standard public port. |
| Nginx reverse proxy | https://hostname on port 443 |
https://127.0.0.1:10000 |
Standard HTTPS, hostname routing, or several web services | WebSocket upgrade headers and proxy trust settings must be correct. |
| Apache reverse proxy | https://hostname on port 443 |
https://127.0.0.1:10000 |
VPSs already using Apache virtual hosts | Proxy, SSL, and WebSocket rewrite modules need to be enabled. |
| Virtualmin installer | Hostname-based HTTPS managed by the installer | Webmin as part of a larger hosting stack | Mail, DNS, websites, and multiple virtual servers | It installs more components than a Webmin-only deployment. |
For a one-server administration panel, install Webmin alone first. Choose a reverse proxy when port 443 is already your firewall and monitoring standard, or when you want Webmin hidden from the public network.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Prerequisites and DNS planning
Choose a supported VPS distribution
Webmin’s supported operating-system list includes Debian, Ubuntu, Kali, RHEL, AlmaLinux, Rocky Linux, Oracle Linux, CentOS Stream, and Fedora. Use a currently maintained release of one of those distributions and keep an administrative account with sudo access. The commands below assume a Debian derivative uses APT and a RHEL derivative uses DNF.
Prepare a hostname
For a trusted certificate, choose a fully qualified hostname such as panel.example.com. Create an A or AAAA record that resolves to the VPS before starting certificate validation. If an AAAA record exists but the VPS is not reachable over IPv6, validation can fail even when the A record is correct; remove the unusable record or make IPv6 work first.
Plan network access
Your VPS provider normally has a network firewall or security-group screen, separate from the Linux firewall inside the VM. Decide whether the management port is reachable from the whole internet, from your office or VPN addresses only, or only from a reverse proxy. A reverse-proxy design normally exposes TCP 443 and keeps Webmin’s listener reachable only on localhost.
Install Webmin from the official repository
Webmin recommends repository installation instead of downloading an individual package. Its installation page states: “Manual installation isn’t recommended—follow the instructions above to set up repositories.” Follow the current procedure at Webmin’s downloading and installing documentation.
1. Add the Webmin repository
Log in over SSH, become an administrator, and run the repository bootstrap supplied by Webmin:
curl -o webmin-setup-repo.sh https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh
sudo sh webmin-setup-repo.shThe script configures the repository and signing information for the distribution. Read any package-manager prompt and allow it to finish before installing Webmin.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
2. Install on Debian or Ubuntu
sudo apt-get install webmin --install-recommendsThe --install-recommends option installs packages Webmin expects for a complete setup. If APT reports an unavailable package, confirm that the VPS release is supported and that the repository script completed without an error.
3. Install on RHEL, Alma, Rocky, Oracle, CentOS Stream, or Fedora
sudo dnf install webminOn older systems that still provide YUM as the front end, use the distribution’s supported DNF/YUM compatibility command, but keep the Webmin repository enabled so updates arrive through the package manager.
4. Confirm the service locally
Before troubleshooting a browser connection, verify that the package created a listening service:
sudo ss -lntp | grep 10000A listener bound to Webmin’s port confirms that the application is running. A blank result means the installation or service startup needs attention before changing firewall rules.
Recommended Free Tools
Open the management port safely
Allow the port at the VPS provider
In the provider’s firewall or security-group panel, add an inbound TCP rule for port 10000 from the addresses that should administer the VPS. For a temporary first login, you can allow your current public IP; a broad “anywhere” rule is easier but increases exposure. If you later move to a reverse proxy, remove the public 10000 rule and retain only local or trusted-proxy access.
Allow the port in Linux
Use the firewall actually enabled on the VPS. For UFW:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
sudo ufw allow 10000/tcp
sudo ufw statusFor firewalld:
sudo firewall-cmd --permanent --add-port=10000/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-portsThese rules affect the operating system only; they do not replace the provider-level rule. If you are using a different firewall manager, create the equivalent inbound TCP rule and verify that no earlier deny rule overrides it.
Make the first HTTPS connection
Open https://your-server.example:10000 or use the VPS IP address temporarily. Webmin’s FAQ specifically warns that SSL connections must use an https:// URL rather than http://; see the Webmin FAQ. An IP-based URL may show a certificate-name warning because the certificate is issued for a hostname, not for the numeric address.
The initial certificate is commonly not trusted by a public browser. That warning does not mean the Webmin service is unencrypted; it means your browser cannot verify the signer or hostname. Confirm that the address is your VPS, sign in with an administrative Webmin account, and replace the certificate before using the panel routinely.
Replace the initial certificate with Let’s Encrypt
Verify the conditions before requesting a certificate
- The hostname’s A and, if used, AAAA records resolve to the VPS.
- The hostname you enter in Webmin matches the name users will enter in the browser.
- DNS changes have propagated to the public resolvers used by the certificate authority.
- Any validation path required by the certificate request is reachable through the provider firewall, the VPS firewall, and any reverse proxy.
- No other service is returning a different site or certificate for the same hostname.
Webmin’s FAQ identifies Let’s Encrypt as a free certificate-authority option. Virtualmin’s installer documentation likewise requires a correctly resolving hostname and reachable validation ports when it requests a real hostname certificate.
Request the certificate in Webmin
- Sign in to Webmin over HTTPS.
- Open the Webmin configuration area and select the SSL or SSL Encryption page. Menu wording can differ slightly between Webmin releases.
- Choose the Let’s Encrypt certificate option, enter the fully qualified hostname, and select the certificate’s requested names if the interface offers that choice.
- Submit the request and wait for the validation result. A successful request installs a certificate whose names include the hostname.
- Reconnect using the hostname, not the IP address, and confirm that the browser shows a trusted certificate.
If the request fails, fix DNS and reachability first. A certificate authority cannot validate a name that resolves elsewhere, is blocked by a firewall, or is intercepted by a proxy that does not pass the challenge through. Do not repeatedly retry until those conditions are correct.
Decide where TLS should terminate
With direct access, Webmin itself presents the certificate on port 10000. With a reverse proxy, Nginx or Apache presents the public certificate on port 443 and encrypts the proxy hop to Webmin as well. The certificate on the proxy and the certificate configured in Webmin are separate settings; changing one does not automatically change the other.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Option A: keep direct Webmin access
Direct access is the shortest path from installation to a working panel. Keep TCP 10000 restricted to trusted administrator networks where possible, use a hostname whose certificate matches the URL, and remove any temporary “allow from anywhere” rule after testing.
Use this arrangement when no other service needs port 443 and you are comfortable maintaining a dedicated management-port rule. If your organization requires all browser administration to use standard HTTPS, use a reverse proxy instead.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Option B: proxy Webmin through Nginx on port 443
Webmin provides an Nginx proxy tutorial at Proxying to Webmin with Nginx. The pattern below shows the essential relationship: Nginx listens publicly on 443, while Webmin remains on localhost at its normal HTTPS port.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute1. Install and enable Nginx
Install Nginx from your distribution’s package repositories, then enable its service using the distribution’s normal service manager. Keep the existing Webmin listener running while you test the proxy.
2. Create a TLS virtual host
Use a server block for the real hostname. The certificate paths below are the conventional Let’s Encrypt paths for panel.example.com; substitute the paths created on your VPS.
server {
listen 443 ssl;
server_name panel.example.com;
ssl_certificate /etc/letsencrypt/live/panel.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/panel.example.com/privkey.pem;
location / {
proxy_pass https://127.0.0.1:10000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}The Upgrade and Connection headers preserve WebSocket connections used by Webmin Terminal and similar interactive features. Without them, the login page may work while terminal sessions fail or disconnect.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
3. Validate, reload, and test
- Run Nginx’s configuration test command for your distribution.
- Correct every syntax or certificate-path error before reloading.
- Reload Nginx, then browse to
https://panel.example.comwithout appending:10000. - Open Webmin Terminal and verify that an interactive session remains connected.
4. Restrict direct access after testing
Once the proxy works, remove public access to port 10000 at the provider firewall and in the host firewall, or bind Webmin to localhost according to the Webmin configuration available on your release. Keep the proxy-to-Webmin connection on the loopback interface and allow public TCP 443.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Trusted proxy headers
Forwarded headers tell Webmin which host, scheme, and client address the proxy observed. Webmin’s Nginx documentation cautions: “Be careful with trusted proxy headers.” Trust them only when direct access to Webmin is blocked or limited to known proxy IP addresses. If an untrusted client can reach Webmin directly and submit arbitrary forwarded headers, logs and security decisions can reflect spoofed values.
Option C: proxy Webmin through Apache on port 443
Apache follows the same network design: terminate TLS in a name-based virtual host on 443 and proxy to https://127.0.0.1:10000. Enable the SSL, proxy, HTTP-proxy, and WebSocket-proxy modules supplied by your distribution before enabling the virtual host.
Representative virtual-host structure
<VirtualHost *:443>
ServerName panel.example.com
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/panel.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/panel.example.com/privkey.pem
ProxyPreserveHost On
ProxyPass / https://127.0.0.1:10000/
ProxyPassReverse / https://127.0.0.1:10000/
RewriteEngine On
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteCond %{HTTP:Connection} upgrade [NC]
RewriteRule /(.*) wss://127.0.0.1:10000/$1 [P,L]
</VirtualHost>The exact module-enabling command differs between Debian-family and RHEL-family systems. The essential requirements are an SSL virtual host, proxy directives targeting Webmin’s HTTPS listener, and WebSocket rewrite handling. Test the Apache configuration before reloading it, then verify both normal navigation and Webmin Terminal.
Change Webmin’s port or recover from a bad setting
For scripted recovery or a planned port change, run the Webmin CLI as root. To set the listener back to the default:
sudo webmin set-config --option port --value 10000This command edits Webmin’s configuration and restarts the service. If you choose another port, replace 10000 with that value, open the new TCP port at both firewall layers, and update the Nginx or Apache proxy_pass or ProxyPass target. Test the new URL before closing your existing SSH session so a mistaken rule does not remove your only administrative path.
Quick Recap
Troubleshooting by symptom
| Symptom | Likely cause | What to check |
|---|---|---|
| Browser times out | Provider firewall, host firewall, wrong address, or no listener | Confirm the VPS rule, the Linux rule, DNS resolution, and ss -lntp | grep 10000. |
| Connection is refused | Webmin is stopped, listening on another port, or bound only to localhost | Inspect the Webmin service status and its configured port; use the root CLI if you need to restore the port. |
| Certificate warning on the hostname | The initial certificate is still installed, the name does not match, or the certificate chain is incomplete | Request the Let’s Encrypt certificate after DNS resolves correctly, then reconnect with the exact certificate name. |
| Let’s Encrypt validation fails | DNS points elsewhere, an AAAA record is unreachable, or a validation path is blocked | Check A/AAAA answers from outside the VPS and review provider, host, and proxy rules. |
| Nginx or Apache returns 502/503 | The proxy cannot reach Webmin on localhost, or the upstream protocol is wrong | Confirm Webmin is listening on HTTPS at 127.0.0.1:10000, use an HTTPS upstream, and inspect the proxy error log. |
| Login works but Terminal does not | WebSocket upgrade headers or rewrite rules are missing | Add the Nginx upgrade headers or Apache WebSocket rewrite, reload the proxy, and test again. |
| Webmin sees the wrong client address or scheme | Forwarded headers are trusted from an untrusted path | Block direct Webmin access or restrict trusted proxy addresses before accepting forwarded headers. |
| Proxy works, but direct port access remains open | The temporary firewall exception was never removed | Delete the public 10000 rule at the provider and on the VPS, retaining only the access path you intend to support. |
Operational checklist
- Use a supported Linux distribution and install Webmin from its official repository.
- Record the hostname users will use and make its DNS records resolve to the VPS.
- Permit only the required ports at both the provider firewall and the operating-system firewall.
- Use an HTTPS URL for every Webmin session.
- Replace the initial certificate with a trusted certificate after DNS and validation reachability are correct.
- If using Nginx or Apache, proxy to Webmin’s HTTPS listener on localhost and preserve WebSocket upgrades.
- Trust proxy headers only across a controlled proxy path.
- When changing the port, run the Webmin CLI as root and update every matching firewall and proxy rule.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
