Use NGINX as a Reverse Proxy

Updated , by Linode

Traducciones al Español
Estamos traduciendo nuestros guías y tutoriales al Español. Es posible que usted esté viendo una traducción generada automáticamente. Estamos trabajando con traductores profesionales para verificar las traducciones de nuestro sitio web. Este proyecto es un trabajo en curso.
Try this guide to receive $100 at signup on a new account.

What is a Reverse Proxy?

A reverse proxy is a server that sits between internal applications and external clients, forwarding client requests to the appropriate server. While many common applications, such as Node.js, are able to function as servers on their own, NGINX has a number of advanced load balancing, security, and acceleration features that most specialized applications lack. Using NGINX as a reverse proxy enables you to add these features to any application.

This guide uses a simple Node.js app to demonstrate how to configure NGINX as a reverse proxy.

Install NGINX

These steps install NGINX Mainline on Ubuntu from NGINX Inc’s official repository. For other distributions, see the NGINX admin guide. For information on configuring NGINX for production environments, see our Getting Started with NGINX series.

  1. Open /etc/apt/sources.list in a text editor and add the following line to the bottom. Replace CODENAME in this example with the codename of your Ubuntu release. For example, for Ubuntu 18.04, named Bionic Beaver, insert bionic in place of CODENAME below:

    File: /etc/apt/sources.list
    deb CODENAME nginx
  2. Import the repository’s package signing key and add it to apt:

    sudo wget
    sudo apt-key add nginx_signing.key
  3. Install NGINX:

    sudo apt update
    sudo apt install nginx
  4. Ensure NGINX is running and and enabled to start automatically on reboot:

    sudo systemctl start nginx
    sudo systemctl enable nginx

Create an Example App

Install Node.js

  1. Use curl to download the setup script provided by NodeSource. Replace the Node version in the curl command with the version you would like to install:

    curl -sL -o
  2. Run the script:

    sudo bash
  3. The setup script will run an apt-get update automatically, so you can install Node.js right away:

    sudo apt install nodejs npm

The Node Package Manager (NPM) will be installed alongside Node.js.

Configure the App

  1. Create a directory for the example app:

    mkdir nodeapp && cd nodeapp
  2. Initialize a Node.js app in the directory:

    npm init

    Accept all defaults when prompted.

  3. Install Express.js:

    npm install --save express
  4. Use a text editor to create app.js and add the following content:

    File: app.js
    const express = require('express')
    const app = express()
    app.get('/', (req, res) => res.send('Hello World!'))
    app.listen(3000, () => console.log('Node.js app listening on port 3000.'))
  5. Run the app:

    node app.js
  6. In a separate terminal window, use curl to verify that the app is running on localhost:

    curl localhost:3000
      Hello World!

Configure NGINX

At this point, you could configure Node.js to serve the example app on your Linode’s public IP address, which would expose the app to the internet. Instead, this section configures NGINX to forward all requests from the public IP address to the server already listening on localhost.

Basic Configuration for an NGINX Reverse Proxy

  1. Create a configuration file for the app in /etc/nginx/conf.d/. Replace in this example with your app’s domain or public IP address:

    File: /etc/nginx/conf.d/nodeapp.conf
    server {
      listen 80;
      listen [::]:80;
      location / {
          proxy_pass http://localhost:3000/;

    The proxy_pass directive is what makes this configuration a reverse proxy. It specifies that all requests which match the location block (in this case the root / path) should be forwarded to port 3000 on localhost, where the Node.js app is running.

  2. Disable or delete the default Welcome to NGINX page:

    sudo mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.disabled
  3. Test the configuration:

    sudo nginx -t
  4. If no errors are reported, reload the new configuration:

    sudo nginx -s reload
  5. In a browser, navigate to your Linode’s public IP address. You should see the “Hello World!” message displayed.

Advanced Options

For a simple app, the proxy_pass directive is sufficient. However, more complex apps may need additional directives. For example, Node.js is often used for apps that require a lot of real-time interactions. To accommodate, disable NGINX’s buffering feature:

File: /etc/nginx/conf.d/nodeapp.conf
location / {
    proxy_pass http://localhost:3000/;
    proxy_buffering off;

You can also modify or add the headers that are forwarded along with the proxied requests with proxy_set_header:

File: /etc/nginx/conf.d/nodeapp.conf
location / {
    proxy_pass http://localhost:3000/;
    proxy_set_header X-Real-IP $remote_addr;

This configuration uses the built-in $remote_addr variable to send the IP address of the original client to the proxy host.

Configure HTTPS with Certbot

One advantage of a reverse proxy is that it is easy to set up HTTPS using a TLS certificate. Certbot is a tool that allows you to quickly obtain free certificates from Let’s Encrypt. This guide will use Certbot on Ubuntu 16.04, but the official site maintains comprehensive installation and usage instructions for all major distros.

Follow these steps to get a certificate via Certbot. Certbot will automatically update your NGINX configuration files to use the new certificate:

  1. Install the Certbot and web server-specific packages, then run Certbot:

     sudo apt-get update
     sudo apt-get install software-properties-common
     sudo add-apt-repository ppa:certbot/certbot
     sudo apt-get update
     sudo apt-get install python-certbot-nginx
     sudo certbot --nginx
  2. Certbot will ask for information about the site. The responses will be saved as part of the certificate:

      # sudo certbot --nginx
    Saving debug log to /var/log/letsencrypt/letsencrypt.log
    Plugins selected: Authenticator nginx, Installer nginx
    Which names would you like to activate HTTPS for?
    Select the appropriate numbers separated by commas and/or spaces, or leave input
    blank to select all options shown (Enter 'c' to cancel):
  3. Certbot will also ask if you would like to automatically redirect HTTP traffic to HTTPS traffic. It is recommended that you select this option.

  4. When the tool completes, Certbot will store all generated keys and issued certificates in the /etc/letsencrypt/live/$domain directory, where $domain is the name of the domain entered during the Certbot certificate generation step.

    Certbot recommends pointing your web server configuration to the default certificates directory or creating symlinks. Keys and certificates should not be moved to a different directory.

    Finally, Certbot will update your web server configuration so that it uses the new certificate, and also redirects HTTP traffic to HTTPS if you chose that option.

  5. If you have a firewall configured on your Linode, you can add a firewall rule to allow incoming and outgoing connections to the HTTPS service. On Ubuntu, UFW is a commonly used and simple tool for managing firewall rules. Install and configure UFW for HTTP and HTTPS traffic:

     sudo apt install ufw
     sudo systemctl start ufw && sudo systemctl enable ufw
     sudo ufw allow http
     sudo ufw allow https
     sudo ufw enable

Next Steps

For more information about general NGINX configuration, see our NGINX series. For practical examples of NGINX used to reverse proxy applications, see our guides on RStudio Server and Thingsboard.

This page was originally published on

Your Feedback Is Important

Let us know if this guide helped you find the answer you were looking for.