Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To create a reverse proxy, run your application privately on the VPS (for example, 127.0.0.1:3000), point your domain’s DNS records at the VPS, and configure an Nginx server block that forwards public requests with proxy_pass. Nginx listens on ports 80 and 443, preserves the original host and client information in forwarded headers, and keeps the application port off the public internet. After the HTTP proxy works, issue a trusted certificate, redirect HTTP to HTTPS, and test WebSocket or streaming endpoints separately.
What a reverse proxy does
A reverse proxy is the public gateway in front of an application server. The browser connects to Nginx on your domain, Nginx sends the request to the configured upstream application, receives its response, and returns that response to the browser. The application can therefore listen on a private address while Nginx handles the public protocol, hostname, TLS certificate, access logging, and connection policy.
In Nginx, the upstream is selected by proxy_pass. The proxy should normally forward the original host and client address so the application can generate correct absolute URLs, apply host-based rules, and log the real visitor rather than only the VPS’s loopback address.
Before you configure Nginx
Use a supported, secured VPS
Start with a currently supported Linux distribution and apply its package updates. Create a non-root administrative account with sudo access, and use the provider’s security group plus the host firewall to allow only the services you need. For a normal web proxy, that means SSH for administration and TCP ports 80 and 443 for web traffic. Do not open the application port, such as 3000, to the internet unless the application explicitly requires direct public access.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Install Nginx from the distribution repository. On Debian or Ubuntu, the package is normally installed with:
sudo apt update
sudo apt install nginxOther distributions use their own package manager, but the configuration concepts and validation commands remain the same.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Choose the public hostname and upstream address
Decide which hostname will serve the application, such as example.com and optionally www.example.com. Record the address and port on which the application will listen. A common single-VPS arrangement is 127.0.0.1:3000. If the application and Nginx are on different private hosts, use the private network address instead and protect that network path.
Run and test the application privately
Start the backend before adding Nginx. Configure it to bind to 127.0.0.1 or an appropriate private interface, not to every public interface. Binding to loopback prevents unsolicited internet connections even if a firewall rule is later changed.
Test the service locally from the VPS:
curl http://127.0.0.1:3000/You should receive the application’s expected HTML, JSON, or other response. If this request fails, fix the application, its environment variables, its listening address, or its service manager first. Nginx cannot proxy a process that is stopped or listening on a different address or port.
For a production service, run the application under the system’s service manager or another supervisor so it starts after a reboot and is restarted according to your operational policy. Keep its logs separate from Nginx logs; you will often need both when diagnosing a failed request.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Point DNS at the VPS
Create an A record for the hostname that contains the VPS’s current public IPv4 address. Add an AAAA record only when IPv6 is correctly configured on the VPS, firewall, and Nginx. An AAAA record that points to an unreachable address can make some clients fail even while IPv4 appears healthy.
Allow time for the record to propagate, then verify from a shell:
dig +short example.com
getent hosts example.comThe returned address must be the VPS that will receive the request. The hostname in DNS must also match the server_name value in the intended Nginx server block. During testing, use the real hostname rather than only the server’s IP address, because Nginx selects a server block from the requested host.
Create the initial HTTP server block
On Debian and Ubuntu, create a file such as /etc/nginx/sites-available/your-app:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}
}This configuration accepts IPv4 and IPv6 HTTP connections, matches the two listed hostnames, and forwards every path to the local application. The headers have distinct purposes:
Hostpreserves the hostname requested by the browser. Applications commonly use it when constructing links, validating allowed hosts, or selecting a tenant.X-Real-IPcarries the immediate client address.X-Forwarded-Forappends the client address to any existing proxy chain, allowing the application to determine the original address when it trusts the proxy chain.X-Forwarded-Prototells the application whether the browser used HTTP or HTTPS at the public edge.
Enable the file and validate it before reloading:
sudo ln -s /etc/nginx/sites-available/your-app /etc/nginx/sites-enabled/your-app
sudo nginx -t
sudo systemctl reload nginxnginx -t must pass before every reload. If the test reports an error, the current running configuration remains in place; correct the reported file and test again. Check the service state when a reload does not complete:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
sudo systemctl status nginx
sudo tail -n 100 /var/log/nginx/error.logSome installations include a default server that answers unmatched hostnames. Disable or adjust that file only after you understand which other sites depend on it; an unintended default can make a correct proxy appear not to work.
Understand the proxy_pass path rule
The exact form of proxy_pass controls the URI sent upstream. With the configuration above, proxy_pass http://127.0.0.1:3000; has no URI component, so Nginx preserves the request URI. A request for /api/orders is sent upstream as /api/orders.
When a URI is included, Nginx replaces the part matched by the location prefix with that URI. For example:
location /service/ {
proxy_pass http://127.0.0.1:3000/;
}Here, a request for /service/orders is sent as /orders. This can be useful when the application is mounted at its root, but it can also break routes or asset URLs if the application expects the original prefix. Decide whether the backend understands the public path before adding a trailing slash, and test nested paths rather than only /.
Validate the proxy in layers
- Test the backend directly. Run
curl http://127.0.0.1:3000/(or the private address and port you configured). Confirm that the application returns a valid response. - Test Nginx locally. Use the public hostname in the request so the correct
server_nameis selected. If DNS is not propagated yet, resolve the hostname to the VPS while testing with an appropriate host override rather than changing the server block. - Test from outside the VPS. Run
curl -I http://example.com/and inspect the status code and headers. A successful response confirms that DNS, the firewall, Nginx, and the upstream are connected for that path. - Compare logs. Review
/var/log/nginx/access.logand/var/log/nginx/error.logalongside the application log. The timestamps and requested path usually identify which layer failed.
A 502 Bad Gateway generally means Nginx could not obtain a response from the configured upstream. Check that the process is running, the address and port in proxy_pass are correct, the service is listening on the interface Nginx uses, and local firewall policy is not blocking the connection.
Add HTTPS with a trusted certificate
For an internet-facing server, use a trusted certificate and redirect ordinary HTTP traffic to HTTPS. A common automated option is a certificate issued by Let’s Encrypt. Its HTTP-01 validation requires the certificate authority to reach port 80, so the VPS firewall, provider security group, DNS, and Nginx must leave port 80 reachable during issuance and renewal.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
On Debian or Ubuntu, install the Nginx integration and request certificates for every hostname you intend to serve:
sudo apt update
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com
sudo nginx -tThe Nginx plugin can identify the matching server block, add TLS directives, and reload Nginx. Read the changes it proposes rather than treating generated configuration as opaque. Confirm that the certificate names cover every hostname users will request, that the HTTPS server still contains the same proxy settings, and that private key files are readable only by the system accounts that require them.
Check the renewal timer installed by your distribution and perform a dry run supported by the installed Certbot client. Renewal failures are often caused by expired DNS records, blocked port 80, changed server names, or a stopped timer. Keep the VPS clock accurate because certificate validity checks depend on system time.
Redirect HTTP to HTTPS without breaking the proxy
After the certificate works, use a dedicated port-80 server block that returns a permanent redirect. The TLS server block on port 443 retains the proxy configuration:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
ssl_certificate /path/to/fullchain.pem;
ssl_certificate_key /path/to/privkey.pem;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}
}The certificate paths shown above are illustrative locations; use the paths created by your certificate client. Do not copy obsolete SSL directives from an old tutorial without checking the Nginx and OpenSSL versions installed on the VPS. Run sudo nginx -t and reload after every change.
Keep proxy_set_header X-Forwarded-Proto $scheme; in the HTTPS server. Without it, an application may believe the original request was HTTP and generate insecure links or redirect repeatedly.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Configure WebSockets and long-lived responses
The basic HTTP proxy is not enough for WebSockets. Nginx’s WebSocket support requires an HTTP/1.1 connection and explicit upgrade headers. Define a connection-upgrade map in the HTTP context (commonly in a file under /etc/nginx/conf.d/):
Free tools Windows power users keep installed
One-click scans. No signup required.
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}Then add the upgrade settings to the location that serves the WebSocket endpoint, not necessarily to every location:
location /socket/ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}Use the path and upstream expected by the application, then test an actual WebSocket connection. A normal page loading successfully does not prove that the upgrade handshake works. For server-sent events, downloads generated on demand, and other streaming responses, adjust proxy timeouts or buffering only in the affected location. Broad, indefinite timeout changes can consume connections and memory when an application stalls.
Proxy an HTTPS upstream when necessary
For an application on another host or across a trust boundary, the upstream itself may use HTTPS:
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass https://backend.example.internal;
}Configure trusted certificate material and verification for that upstream when required. Nginx provides directives such as proxy_ssl_trusted_certificate and related verification settings. Install the issuing CA chain in a controlled location, enable verification appropriate to the backend certificate, and ensure the upstream name used for verification matches the certificate. Disabling verification is not a safe default workaround; investigate an incomplete CA chain, wrong hostname, expired certificate, or clock error instead.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Choose a routing layout for more than one application
| Layout | How it works | Operational considerations |
|---|---|---|
| Separate hostnames | Each application gets a hostname and its own server block, such as app.example.com and api.example.com. |
Usually the simplest arrangement. Each application can keep root-relative URLs and independent TLS, logs, and deployment changes. |
| Path prefixes | One hostname routes prefixes such as /app/ and /api/ to different upstreams. |
Can reduce DNS names, but applications may need a configured base path. URI replacement and asset, redirect, cookie, and WebSocket paths require deliberate testing. |
| HTTP upstream | Nginx connects to a local or private HTTP listener. | Simplest on a trusted localhost link. Keep the listener private and protect any cross-host network path. |
| HTTPS upstream | Nginx connects with TLS to the backend. | Appropriate across hosts or trust boundaries. Configure certificate trust and verification instead of turning verification off. |
Hand-written configuration gives direct control and can be stored in version control. A graphical proxy manager may reduce initial typing, but it adds another management layer and does not remove the need to understand DNS, certificates, upstream health, and Nginx validation.
Troubleshoot common failures
| Symptom | Checks and corrective action |
|---|---|
| The domain does not reach the VPS | Verify the A record and, if present, AAAA record with dig or getent hosts. Confirm the result is the current VPS address and that provider security rules and the host firewall allow TCP 80 or 443. |
| Nginx reload fails | Run sudo nginx -t and fix the exact file and line reported. Then check sudo systemctl status nginx and the error log. Do not repeatedly reload an untested edit. |
| 502 Bad Gateway | Run the local curl command, verify the process is running and listening on the configured address and port, recheck proxy_pass, and inspect Nginx and application logs together. A local firewall policy can also block the upstream connection. |
| The wrong site responds | Check that the browser’s hostname exactly matches server_name, the intended file is linked in sites-enabled, and an older default server is not catching the request. |
| Routes or assets lose a prefix | Review whether proxy_pass includes a URI. A URI changes the matched location prefix; remove it when the backend must receive the original request path, or configure the application for its public base path. |
| WebSocket handshake fails | Use a location-specific upgrade configuration with proxy_http_version 1.1, Upgrade, and Connection headers. Test the real endpoint and check both logs. |
| 413, timeout, or buffering problems | Change the relevant directive only in the location that needs it, then run nginx -t and retest. Avoid global limits or timeouts when one endpoint is responsible. |
| Certificate issuance or renewal fails | Confirm certificate names, DNS, accurate system time, the renewal timer, and reachability of port 80 for HTTP-01 validation. Ensure the matching server block is enabled. |
| HTTPS redirects loop or links use HTTP | Keep the proxy settings in the 443 block and forward X-Forwarded-Proto $scheme. Configure the application to trust the proxy’s forwarded headers according to its own security model. |
Operational checklist
- DNS A records resolve to the VPS’s current public address; AAAA exists only when IPv6 is working end to end.
- The provider security group and VPS firewall allow SSH, TCP 80, and TCP 443, while the backend port remains private.
- The application responds on its configured private address before Nginx is involved.
- The enabled server block’s
server_namematches every hostname users request. sudo nginx -tpasses before every reload.- Nginx access and error logs are reviewed with the application log when a request fails.
- WebSocket, streaming, upload, and long-running endpoints receive only the location-specific settings they require.
- Certificates include all served names, renewal is monitored, private keys have restricted permissions, and port 80 remains reachable for HTTP-01 validation.
With this arrangement, Nginx is the controlled public entry point, while the application remains isolated on a local or private interface. That separation gives you a single place to manage hostnames, HTTPS, client-address forwarding, routing, and diagnostics without exposing each backend service directly.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
