iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Install Webmin from its official package repository, allow its management port through both firewalls, and then replace the initial certificate with a hostname certificate. The default endpoint is https://your-hostname:10000/. For a public-facing administration service, you can instead keep Webmin on localhost:10000 and terminate HTTPS on port 443 with Nginx or Apache.
This guide covers a Webmin-only installation on a supported Linux VPS, trusted Let’s Encrypt certificates, reverse-proxy layouts, firewall rules, and recovery when the panel or certificate is unreachable.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches
Choose how Webmin will be exposed
Webmin is a browser-based administration service. A repository installation starts the webmin service and listens on TCP port 10000 by default. The first certificate is normally self-signed, so a browser warning is expected until you install a certificate issued for the hostname you use.
| Layout | Public listener | Advantages | Important requirements |
|---|---|---|---|
| Direct Webmin | Webmin on 10000 | Fewest moving parts and the quickest setup | Expose and filter TCP 10000 at the VPS provider and on the operating system |
| Nginx reverse proxy | Nginx on 443, Webmin on 127.0.0.1:10000 | Standard HTTPS port, flexible host routing, and a small public attack surface | Proxy HTTPS, preserve websocket upgrade headers, and configure trusted proxy headers carefully |
| Apache reverse proxy | Apache on 443, Webmin on 127.0.0.1:10000 | Uses an existing Apache virtual-host and certificate setup | Enable proxy, SSL, and websocket rewrite support; preserve upgrade requests |
| Virtualmin installer | Usually a complete hosting stack | Can request a real hostname certificate as part of a broader hosting deployment | Installs substantially more components than a Webmin-only server |
Choose direct access when you administer a private server and can restrict port 10000 to your office or VPN addresses. Choose a reverse proxy when users must reach the panel at a normal HTTPS URL or when another service already owns port 443. The proxy does not remove the need to secure Webmin itself; it changes where TLS is terminated and which network paths remain open.
#1 Best Overall
Prerequisites
- A new or recoverable Linux VPS with a working SSH session and an account that can run commands as root.
- A supported distribution. Webmin lists Debian, Ubuntu, Kali, RHEL, Alma Linux, Rocky Linux, Oracle Linux, CentOS Stream, and Fedora among its supported systems. Check the current support list before choosing an image.
- A fully qualified hostname such as
admin.example.com. Create its DNS A record (and an AAAA record only if IPv6 is correctly routed) before requesting a public certificate. - Access to the VPS provider’s network firewall as well as the VPS operating-system firewall. Opening only one of them is not sufficient.
- A decision about direct port 10000 versus a reverse proxy on 443. Do not publish both paths unless you have a specific administrative reason.
- A backup or console path. Firewall and proxy mistakes can otherwise lock you out of the panel.
Install Webmin from the official repository
Webmin recommends repository installation rather than downloading a package manually. Its documentation explicitly says, “Manual installation isn’t recommended—follow the instructions above to set up repositories.” Follow the distribution family that matches the VPS.
Debian, Ubuntu, and other APT-based systems
- Log in over SSH and update the package index.
- Download Webmin’s repository setup script:
curl -o webmin-setup-repo.sh https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh - Run it as root:
sudo sh webmin-setup-repo.sh - Install Webmin and its recommended dependencies:
sudo apt-get install webmin --install-recommends
The script configures the signed Webmin repository; the package manager then handles dependencies and future updates. The commands and repository approach are documented in Webmin’s downloading and installing documentation.
RHEL, Alma, Rocky, Oracle, CentOS Stream, and Fedora systems
- Download and run the same repository setup script as root:
curl -o webmin-setup-repo.sh https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.shsudo sh webmin-setup-repo.sh - Install the package with DNF:
sudo dnf install webmin
If the setup script reports a repository or signing problem, stop and correct the distribution image or package-manager configuration rather than installing an unrelated package. Mixing repositories from different distribution families can leave Webmin or its dependencies in an unsupported state.
Confirm the service before changing networking
Check that the service is running and listening locally:
sudo systemctl status webmin
sudo ss -ltnp | grep 10000A listening socket on port 10000 confirms that the daemon started. A service that is stopped or listening on a different port must be fixed before firewall or proxy troubleshooting will be meaningful. Use the service log shown by systemctl status and your distribution’s journal if startup fails.
Allow access through both firewalls
The VPS provider may drop traffic before it reaches Linux, while UFW, firewalld, or another host firewall may drop it after arrival. Permit the port in both layers, and restrict the source to your administration network when possible.
Free tools Windows power users keep installed
One-click scans. No signup required.
Direct access on port 10000
For UFW, an example rule is:
sudo ufw allow 10000/tcp
sudo ufw statusFor firewalld, use:
sudo firewall-cmd --permanent --add-port=10000/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-portsThese commands are examples; use the firewall tool enabled on your image. At the provider, add an inbound TCP rule for 10000, preferably limited to your fixed office, VPN, or bastion IP address. If you later move public access to a reverse proxy, remove the broad 10000 rule and allow it only from localhost or the proxy host.
Open the first session
With the service and firewall ready, browse to:
https://your-server-ip-or-hostname:10000/Webmin’s FAQ specifically advises using an https:// URL when SSL is enabled, for example https://myhost:10000/; do not silently downgrade to HTTP. An IP address will normally produce a name-mismatch warning even after you install a certificate for a hostname, so use the DNS name that the certificate covers. Authenticate with an account Webmin accepts on that operating system and that has the administrative rights required for the tasks you intend to perform.
Replace the initial certificate with Let’s Encrypt
A trusted certificate must match the hostname in the browser and the certificate authority must be able to validate control of that name. Webmin’s FAQ identifies Let’s Encrypt as a free certificate-authority option. The exact Webmin menu wording can vary by release, but the workflow is consistent.
Prepare DNS and validation reachability
- Point the hostname’s A record to the VPS public IPv4 address. Publish an AAAA record only when the VPS accepts and routes IPv6; an incorrect AAAA record can send validation to the wrong machine.
- Wait for the hostname to resolve from outside your network. Test both the name and the address family you intend to use.
- Ensure the validation path required by the selected ACME challenge can reach the VPS. Provider rules, the Linux firewall, and any existing web server must permit that path.
- Use the same hostname in the certificate request and in the URL you will bookmark. A certificate for
admin.example.comdoes not validatevps.example.comor a raw IP address.
Request and apply the certificate in Webmin
- Open Webmin’s SSL or certificate-management page from the administration interface.
- Choose the Let’s Encrypt option, enter the fully qualified hostname, and select the Webmin service certificate rather than a certificate intended only for another virtual host.
- Start the request and wait for the authority to complete validation. Do not close the only SSH or console session while changing the certificate.
- When Webmin reloads its service, reconnect with
https://admin.example.com:10000/and inspect the browser certificate details. Confirm the subject or SAN contains the exact hostname and that the chain is trusted. - Enable or verify renewal. ACME certificates are short-lived; a one-time successful request is not proof that future renewals will work.
If you use a hosting-stack installer instead, its documented hostname-certificate automation still depends on correct DNS resolution and reachable validation ports. The same prerequisites apply even when the installer hides the individual certificate steps.
Common certificate failures
| Symptom | Likely cause | Correction |
|---|---|---|
| DNS or name-resolution error | A or AAAA record is missing, stale, or points elsewhere | Correct the record, wait for propagation, and test from an external resolver |
| Validation timeout | Provider firewall, host firewall, NAT, or another server blocks the challenge path | Permit the required inbound path and remove conflicting listeners or routing rules |
| Browser still warns after issuance | You opened the IP, an old hostname, or a cached certificate | Use the exact certificate hostname and inspect the served chain in a private window |
| Renewal succeeds once but fails later | Temporary firewall opening, changed DNS, or a challenge route that no longer exists | Test the renewal path before expiry and keep the necessary DNS and firewall configuration stable |
Expose Webmin through Nginx on port 443
Nginx can present the public certificate on 443 and proxy requests to Webmin’s HTTPS listener on loopback. This keeps the management daemon off the public interface, but it introduces a second configuration that must be maintained.
Install and prepare Nginx
Install Nginx with your distribution package manager, obtain a certificate for admin.example.com through your ACME workflow, and make sure the certificate and private key are readable by Nginx. The following server block illustrates the important directives; replace the example hostname and certificate paths with the values on your VPS.
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name admin.example.com;
ssl_certificate /etc/letsencrypt/live/admin.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/admin.example.com/privkey.pem;
location / {
proxy_pass https://127.0.0.1:10000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_ssl_verify off;
}
}The Upgrade, Connection, and HTTP/1.1 directives preserve websocket traffic used by Webmin Terminal and similar features. The example disables verification of Webmin’s loopback certificate because a new installation commonly uses a self-signed certificate there. Keep that hop on loopback, or replace it with a certificate and trust configuration that Nginx can verify; never use the setting to proxy an untrusted remote server.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →After placing the block in your enabled Nginx configuration, test and reload it:
sudo nginx -t
sudo systemctl reload nginxAllow TCP 443 at the provider and host firewalls. Once the proxy works, restrict direct port 10000 to loopback or trusted source addresses. Webmin’s official Nginx proxy guidance warns to be careful with trusted proxy headers. Enable Webmin’s proxy-awareness setting only when direct access is blocked or limited to trusted proxy IPs; otherwise an attacker could send forged forwarded headers and make Webmin treat an untrusted request as if it came from the proxy.
Rank #4
Expose Webmin through Apache on port 443
Apache is appropriate when it already terminates TLS for your VPS. Enable the proxy, HTTP proxy, SSL, rewrite, and websocket-related modules supplied by your distribution. A representative virtual host is:
<VirtualHost *:443>
ServerName admin.example.com
SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/admin.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/admin.example.com/privkey.pem
ProxyPreserveHost On
SSLProxyEngine On
RewriteEngine On
RewriteCond %{HTTP:Upgrade} websocket [NC]
RewriteCond %{HTTP:Connection} upgrade [NC]
RewriteRule ^/(.*) ws://127.0.0.1:10000/$1 [P,L]
ProxyPass / https://127.0.0.1:10000/
ProxyPassReverse / https://127.0.0.1:10000/
</VirtualHost>Use your distribution’s module commands to enable the directives, then run apachectl configtest (or the equivalent) before reloading Apache. The websocket rewrite must be retained; without it, the normal panel may load while Terminal connections fail. As with Nginx, keep the backend on loopback, decide how Apache verifies its certificate, and do not trust forwarded headers from arbitrary clients. Open 443 at both firewall layers and close broad public access to 10000 after confirming the virtual host works.
Change Webmin’s port safely
Port 10000 is the default, not a requirement. For scripted recovery or a planned change, run Webmin’s CLI as root:
sudo -i
webmin set-config --option port --value 10000The command edits Webmin’s configuration and restarts the service. Replace 10000 with the new port when changing it. Before running the change, prepare the matching provider and host-firewall rules and update any Nginx or Apache proxy_pass target. Keep an existing SSH or console session open until you have tested the new URL. A port change does not issue a certificate; the certificate hostname and reverse-proxy configuration remain separate concerns.
Troubleshoot by symptom
Browser timeout
- Verify Webmin is running with
systemctl status webmin. - Check the listening address and port with
ss -ltnp. - Confirm the provider firewall and the Linux firewall both allow the selected public port.
- If using a proxy, test locally from the VPS and inspect the proxy error log before changing Webmin.
Connection refused
The packet reached the VPS but no process is accepting it, or Webmin is bound only to a different address. Check the service state, listening socket, and recent journal entries. A reverse proxy aimed at 127.0.0.1:10000 also reports refusal when Webmin is stopped or its port was changed.
Best Value
502 or 503 from Nginx or Apache
Confirm the backend scheme is HTTPS, the target port matches Webmin, and the proxy process can reach 127.0.0.1. If the backend certificate is self-signed, use a deliberate loopback trust configuration rather than exposing the backend publicly. Check proxy and Webmin logs for the exact handshake error.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Panel loads but Terminal does not
Missing websocket upgrade headers are the usual cause. In Nginx, verify HTTP/1.1 plus Upgrade and Connection headers. In Apache, verify the websocket rewrite rule and required modules. Reload only after a configuration test passes.
Redirect loop or wrong hostname
Use one canonical hostname, set the forwarded protocol to HTTPS at the proxy, and ensure Webmin is configured to recognize the proxy only when requests can actually come from that trusted proxy. Remove conflicting redirects in other virtual hosts.
Post-install security and maintenance checklist
- Bookmark the HTTPS hostname, not an IP address or an HTTP URL.
- Limit provider and host firewall rules to the smallest source range and public port required by your chosen layout.
- If Nginx or Apache fronts Webmin, remove broad public access to port 10000 and leave the backend on loopback.
- Keep the Webmin repository enabled so package-manager updates can be applied through the supported channel.
- Monitor certificate expiry and test renewal before the current certificate expires.
- Retain SSH or provider-console access while changing ports, certificates, firewall rules, or proxy configuration.
- When a proxy is used, preserve websocket headers and treat forwarded-header trust as a security boundary, not a cosmetic setting.
Which setup should you use?
Use direct Webmin access when simplicity matters and port 10000 can be tightly restricted. Use Nginx or Apache when a normal 443 URL, centralized certificates, or an existing web-server policy is more important than having one fewer component. In either design, the reliable sequence is the same: install from the official repository, verify the service locally, open only the required firewall path, issue a certificate for a correctly resolving hostname, and test the final HTTPS URL before closing your recovery session.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
