Run Nginx on the VPS’s public interface and keep your application on a private address such as 127.0.0.1:3000. Nginx accepts requests for your domain, forwards them with proxy_pass, and returns the application’s response to the visitor. This guide covers an Ubuntu/Debian-style installation, DNS and firewall preparation, HTTP and HTTPS server blocks, WebSockets, validation, and the failure modes that most often produce 502 errors.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What a reverse proxy does
A reverse proxy is the public-facing HTTP server in front of an application server. The client connects to Nginx on ports 80 or 443; Nginx connects to the application on its private address and port. The application does not need to be exposed directly to the internet.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →For example, a Node, Python, Go, or game-service web dashboard can listen only on 127.0.0.1:3000. Nginx listens on the VPS’s public IPv4 and IPv6 interfaces, matches the requested hostname and path, and forwards the request upstream. The response travels back through Nginx, so the public URL remains https://example.com rather than http://server-address:3000.
- Public edge: Nginx handles DNS-facing traffic, TLS, redirects, request headers, and logs.
- Private application: Your service can bind to localhost, reducing its exposure and avoiding a public application port.
- Upstream connection:
proxy_passselects the address and port Nginx contacts.
Nginx’s documented request flow is straightforward: it sends the request to a specified proxy server, fetches the response, and sends that response to the client. A reverse proxy is therefore a routing and protocol boundary, not a replacement for keeping the application patched, authenticated, and correctly configured.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Requirements before you edit Nginx
VPS, DNS, and access
- A Linux VPS with a public IP address and administrative access through SSH or the provider console.
- A domain name whose DNS
Arecord points to the VPS’s IPv4 address. Add anAAAArecord only when IPv6 is configured and reachable on the VPS. - An application already running and listening on the address and port you intend to proxy, such as
127.0.0.1:3000. - Inbound TCP ports 80 and 443 allowed in both the VPS firewall and any cloud-provider firewall. Keep the application port private whenever possible.
Firewall commands differ by distribution and hosting provider, so use the provider’s current instructions rather than copying a command intended for another firewall system. Confirm DNS resolution with your normal DNS tools before requesting a certificate.
Choose the application bind address
Binding to 127.0.0.1 makes the service reachable only from the VPS itself. If Nginx and the application run in separate containers or machines, use the private network address instead and restrict that network path with firewall rules. Do not put a public application port in the configuration merely because it is convenient; direct exposure bypasses Nginx’s TLS and access controls.
Free tools Windows power users keep installed
One-click scans. No signup required.
Install Nginx
On a conventional Ubuntu or Debian installation, install the distribution package:
sudo apt update
sudo apt install nginxDistribution packages are the simplest option for a standard server. If you specifically require a newer vendor build, use the official Nginx repository instructions for your distribution and verify package guidance before a production rollout; repository names, package versions, and signing procedures change over time.
Check that the service is running:
sudo systemctl enable --now nginx
sudo systemctl status nginxIf the default page appears when you visit the VPS address, Nginx is listening. That page is not your application yet; the next step is a hostname-specific server block.
Create and enable a server block
Write the site configuration
Ubuntu and Debian commonly keep available virtual-host files in /etc/nginx/sites-available/ and enable them through symbolic links in /etc/nginx/sites-enabled/. Create a file named for the domain:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo nano /etc/nginx/sites-available/example.comReplace the domain names and upstream port in this minimal HTTP configuration:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}
}listen 80andlisten [::]:80accept IPv4 and IPv6 HTTP traffic.server_namedetermines which hostnames use this block. Include only names that resolve to this VPS.proxy_passsends the request to the application on localhost port 3000.Hostpreserves the requested hostname for applications that use virtual hosts or generate absolute URLs.X-Real-IPcarries the immediate client address, whileX-Forwarded-Forappends the client address to the forwarding chain.X-Forwarded-Prototells the application whether the original request used HTTP or HTTPS. Applications must be configured to trust these headers only from your Nginx proxy.
Enable the file
Create the normal Debian-style link, then remove or disable the default site if it would otherwise catch the hostname first:
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com
sudo rm -f /etc/nginx/sites-enabled/defaultDo not remove a default site that another service still needs. Multiple server blocks are fine; Nginx selects one by listening address, port, and server_name.
Understand proxy_pass paths before production
The URI portion of proxy_pass changes how Nginx constructs the upstream request. With:
location /api/ {
proxy_pass http://127.0.0.1:3000;
}a request for /api/players is sent upstream with the original path, /api/players. If you include a URI in the directive:
location /api/ {
proxy_pass http://127.0.0.1:3000/;
}Nginx replaces the matching /api/ location prefix, so the upstream receives /players. Decide which behavior your application expects. An unexpected prefix is a common cause of 404 responses even when the proxy itself is working.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Validate safely and reload
Always test the configuration before applying it:
sudo nginx -tThe test checks syntax and attempts to open files referenced by the configuration, including certificate files and included snippets. A successful result reports that the syntax is valid and the test is successful.
Only then perform a graceful reload:
sudo systemctl reload nginxA reload lets existing worker processes finish current requests while new workers use the updated configuration. If the new configuration cannot be applied, Nginx keeps the previous workers serving traffic. This is safer than editing a live file and assuming that a failed change has already taken effect.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteIf the test fails, read the filename and line number in the error, correct that file, and run nginx -t again. Typical causes include a missing semicolon, a misspelled directive, an unreadable certificate, or a broken include link.
Add HTTPS with an HTTP redirect
Issue the certificate after HTTP works
First confirm that the domain resolves to the VPS and that port 80 is reachable. Install Certbot using the current Ubuntu guidance, then request certificates for both names:
sudo certbot --nginx -d example.com -d www.example.comCertbot’s Nginx plugin finds matching server blocks, adds TLS directives, and reloads Nginx. It can also create the HTTP-to-HTTPS redirect. The exact prompts and renewal behavior depend on the current Certbot package and operating-system guidance, so read the proposed changes before accepting them.
What the resulting layout should do
Public traffic should have two clear paths:
- Port 80 accepts a request and redirects it to the equivalent HTTPS URL.
- Port 443 serves the application through the certificate and private key, then proxies to the application.
A typical TLS server block has the same proxy headers as the HTTP block, plus certificate directives generated by Certbot:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
ssl_certificate /path/from/certbot/fullchain.pem;
ssl_certificate_key /path/from/certbot/privkey.pem;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}
}
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}Use the certificate paths that your Certbot installation created; do not guess them. Keep the private key readable by Nginx but not by unrelated users, and renew certificates before they expire. After any certificate or configuration change, run sudo nginx -t and reload.
Proxy WebSockets correctly
WebSockets begin as HTTP requests and then switch protocols. Nginx does not pass the hop-by-hop Upgrade and Connection headers automatically, so a WebSocket location needs them explicitly:
location /socket/ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
proxy_read_timeout 3600s;
}The one-hour read timeout is an example for a long-lived connection, not a universal requirement. Choose a value appropriate to the application’s heartbeat and idle behavior. A timeout that is too short disconnects quiet clients; one that is too long can retain resources for abandoned connections.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use the same WebSocket location in the HTTPS server block that serves the public endpoint. If the application expects a different path, apply the proxy_pass URI rules deliberately. A failed handshake often results from missing upgrade headers, an incorrect path, or an application that is not listening on the configured upstream.
Test the complete request path
Check the upstream first
curl -I http://127.0.0.1:3000This isolates the application from DNS, TLS, and Nginx. A connection refusal means the process is stopped, bound to another address, or listening on another port. An application-specific status such as 401 or 404 proves that something answered, but you may need the correct path or authentication to obtain a useful response.
Check Nginx and the public endpoint
sudo nginx -t
sudo systemctl status nginx
sudo journalctl -u nginx
curl -I http://example.com
curl -Ik https://example.comThe HTTPS command uses -k to show the response even when certificate verification is deliberately bypassed for diagnosis. For a normal client test, omit -k; a valid public certificate should verify without it.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Inspect Nginx’s access and error logs while making a request. The access log shows what arrived and the returned status; the error log often identifies upstream connection failures, permission problems, timeout events, and TLS-file errors. Log locations can vary with the distribution, but the usual Nginx installation places them under /var/log/nginx/.
Troubleshoot by symptom
502 Bad Gateway
A 502 generally means Nginx could not obtain a valid response from the upstream. Check, in this order:
- Confirm the application process is running with the service manager or process supervisor that starts it.
- Run
curl -I http://127.0.0.1:3000on the VPS. - Verify the application is listening on the exact address and port in
proxy_pass. - Check that local firewall rules or container networking do not block Nginx’s connection.
- Read the Nginx error log for connection-refused, timeout, or malformed-response details.
If localhost works from an interactive shell but Nginx still receives a 502, compare the service account, network namespace, and address family. For example, an application bound only to IPv6 is not reachable through 127.0.0.1.
404 from the application
A 404 from the upstream is different from an Nginx routing failure. Recheck the location prefix and whether your proxy_pass includes a trailing URI. The upstream may be receiving /api/players when it expects /players, or vice versa.
Redirect loops or wrong absolute URLs
Ensure the HTTPS proxy sends X-Forwarded-Proto $scheme and configure the application to trust that header from Nginx. An application that does not know the original request was HTTPS may redirect an already secure request back to HTTPS indefinitely, or generate insecure links.
Recommended Free Tools
WebSocket handshake or disconnect failures
Confirm proxy_http_version 1.1, both upgrade headers, the endpoint path, and a read timeout suitable for the connection. Check the browser or client’s handshake status and compare it with Nginx’s access and error logs. A normal HTTP request working through the same location does not prove that the protocol upgrade is configured.
Certificate or reload errors
Run sudo nginx -t and read the exact certificate path and permission error. A missing file, an expired or mismatched certificate, or a private key that Nginx cannot read will prevent the new configuration from loading. Because a failed reload leaves the old workers running, restore a known-good configuration, test it, and reload again rather than repeatedly restarting the service.
Operational and security checks
- Expose only 80 and 443 publicly unless another port is genuinely required. Keep 3000, 8000, database ports, and administrative interfaces on private addresses or restricted firewall rules.
- Run the application under a dedicated, non-root account and supervise it with the service manager or an equivalent process supervisor.
- Keep Nginx, the operating system, Certbot, and the application updated through the distribution’s normal maintenance process.
- Preserve the original host and forwarding headers only when the application understands them; configure trusted proxy addresses so clients cannot spoof identity headers directly.
- Watch access and error logs for repeated authentication failures, unexpected paths, upstream timeouts, and certificate problems. Set retention and rotation so logs cannot fill the disk.
- Test certificate renewal and application restarts during a maintenance window. A proxy is useful only when the upstream also starts reliably after a reboot.
When Nginx is the right fit
Nginx combines a web server, reverse proxy, cache, load balancer, TCP/UDP proxy, and mail-proxy capabilities. Its server-block model is a good fit when you want explicit, reviewable configuration and predictable behavior for one or more VPS-hosted services. It supports WebSocket proxying, TLS termination, access and error logging, and conventional Linux service management.
Evaluate alternatives using the concerns that matter to your deployment: configuration model, TLS automation, WebSocket support, observability and logging, resource use, dynamic service discovery, and commercial support or training. A single VPS with a few stable services usually benefits from the simple file-based model shown here; a larger fleet may need a proxy with stronger dynamic discovery or centralized management.
Quick Recap
Reference configuration checklist
- DNS
Aand, when applicable,AAAArecords resolve to the VPS. - The application answers locally on the address and port in
proxy_pass. - Ports 80 and 443 are allowed; the application port is private.
- The server block is in
/etc/nginx/sites-available/and linked into/etc/nginx/sites-enabled/. server_nameexactly matches the requested domain.- Forwarding headers are present and the application trusts them only from Nginx.
- Any path prefix behavior is intentional, including a trailing URI in
proxy_pass. - WebSocket locations use HTTP/1.1 and explicit upgrade headers.
sudo nginx -tsucceeds before every reload.- HTTP redirects to HTTPS, the certificate files are readable, and
curl -Ik https://example.comreturns the expected endpoint.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
