Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Pointing api.example.com at a Node.js app requires two separate configurations: DNS must resolve the subdomain to your VPS, and a reverse proxy such as NGINX must forward web requests from ports 80 and 443 to the Node.js process listening on an internal port such as 127.0.0.1:3000. DNS records do not contain port numbers, so creating an A, AAAA, or CNAME record alone cannot connect visitors to port 3000.
The reliable sequence is: create the DNS record, bind Node.js locally, configure and enable an NGINX server block for the hostname, test and reload NGINX, obtain a TLS certificate, redirect HTTP to HTTPS, and then verify each layer independently.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How the connection works
A browser request passes through several components before it reaches your application:
- DNS translates the subdomain into an IPv4 address, IPv6 address, or another hostname.
- TCP ports 80 and 443 receive ordinary HTTP and HTTPS traffic on the VPS.
- NGINX selects the virtual server whose
server_namematches the requested hostname. - Proxying forwards the request over the VPS’s local interface to the Node.js port.
- Node.js returns the application response, which NGINX sends back to the client.
DNS communicates where an application can be reached; SSL/TLS is the separate layer that makes the connection encrypted. This distinction is also reflected in Cloudflare’s DNS documentation.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
What DNS can and cannot do
An A record maps a name to an IPv4 address. An AAAA record maps it to an IPv6 address. A CNAME maps it to another hostname. None of these records stores a destination port, process name, or NGINX configuration. A request for https://api.example.com reaches port 443 by convention; NGINX then decides whether to send it to port 3000, 8080, or another local service.
Why a reverse proxy is preferable to exposing Node.js directly
Keeping Node.js on a loopback address means the public Internet reaches only the web server. NGINX can terminate TLS, redirect HTTP, select virtual hosts, preserve forwarding headers, serve multiple subdomains, and handle WebSocket upgrades while the application remains on a private port.
Before you begin
Have the following information ready:
- The VPS public IPv4 address, and its public IPv6 address if IPv6 is configured.
- Access to the authoritative DNS dashboard for
example.com. - Administrative access to the VPS.
- The exact local address and port on which the Node.js application listens.
- NGINX installed or permission to install it.
- A process supervisor or service definition that restarts the Node.js process after a crash and starts it after a reboot.
- Firewall rules allowing inbound TCP traffic on ports 80 and 443. The internal Node.js port normally does not need to be publicly open.
Replace api.example.com and 3000 in the examples with your actual hostname and application port.
Step 1: Create the subdomain DNS record
Open the DNS dashboard for the domain and add a record whose name is the subdomain label, such as api. The target depends on the address supplied by your VPS provider.
| Record | Use it when | Example | Important detail |
|---|---|---|---|
| A | The VPS has a public IPv4 address. | api → 203.0.113.25 |
Resolves the hostname to IPv4; it does not specify a port. |
| AAAA | The VPS has a configured public IPv6 address. | api → 2001:db8::25 |
Only add this when IPv6 routing and firewall rules work on the VPS. |
| CNAME | Your provider gives a stable hostname instead of an address. | api → vps-25.provider.example |
The DNS resolver follows the target hostname; a CNAME still cannot encode port 3000. |
Use the provider’s documented target exactly. Do not put http://, a path, or :3000 in the record value. If your DNS provider offers a proxy toggle, decide whether the record should be DNS-only or proxied; either choice must be compatible with your origin ports, TLS setup, and certificate-validation method.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Check the authoritative answer
After saving the record, query DNS from a shell or use a DNS diagnostic service:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutedig +short A api.example.com
dig +short AAAA api.example.com
dig +short CNAME api.example.comUse the query that matches the record you created. The result should be the VPS address or the intended CNAME target. A resolver may continue returning an old answer until the record’s TTL expires, so a successful save in the dashboard does not guarantee that every network sees the new value immediately.
Step 2: Bind Node.js to a local interface
Configure the application to listen on the port NGINX will proxy to. A typical secure arrangement is 127.0.0.1:3000, which accepts connections only from the VPS itself. Use the address and port your application actually supports; changing NGINX to port 3000 will not help if Node.js is listening on another port.
// Illustrative Node.js binding
app.listen(3000, '127.0.0.1');Frameworks expose this setting differently, so use the framework’s normal host and port configuration. If the application must accept traffic from another private machine, bind to the appropriate private interface instead and restrict access with a firewall. Avoid binding publicly to 0.0.0.0 unless you have a specific reason and have secured the application port.
Confirm that the process is listening
ss -ltnp | grep :3000You should see a listening socket on the expected address and port. Test the application locally before involving DNS or NGINX:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
curl http://127.0.0.1:3000/An application response proves that Node.js is running and reachable locally. A connection refusal means the process is stopped, bound to a different address, or using a different port. A timeout usually indicates a filtering or routing problem.
Step 3: Allow only the public web ports
Permit inbound TCP 80 for HTTP and TCP 443 for HTTPS in the VPS firewall and any provider-level firewall. Keep port 3000 closed to the public when Node.js is bound to loopback. If you add an AAAA record, verify that IPv6 firewall rules permit the same web traffic; otherwise some users may receive an IPv6 address and fail while IPv4 users succeed.
Step 4: Configure NGINX for the hostname
Create a server block in the NGINX configuration location used by your distribution. This HTTP configuration matches the subdomain and forwards every path to the local Node.js service:
server {
listen 80;
server_name api.example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}What each directive does
listen 80accepts HTTP traffic on the standard web port.server_namemakes this block the match forapi.example.com. The name must match the DNS hostname and the browser’s Host header.proxy_passdefines the local upstream destination. It is not a public DNS setting.proxy_http_version 1.1allows features such as persistent connections and WebSocket upgrades.Host,X-Real-IP, andX-Forwarded-Forpreserve the original hostname and client-address information for the application.X-Forwarded-Prototells the application whether the client used HTTP or HTTPS at the proxy.
Enable the server block safely
- Save the file in the distribution’s available-sites or server-configuration directory.
- Enable it using the distribution’s normal mechanism. On systems that use separate available and enabled directories, this is commonly a symbolic link; other distributions load files directly from an included directory.
- Run the NGINX syntax check:
sudo nginx -t- Reload only if the test reports that the configuration is successful:
sudo systemctl reload nginxA reload applies the new configuration without unnecessarily terminating existing connections. If the syntax test fails, correct the reported file and line before trying again.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Keep Node.js supervised
NGINX cannot restart an application that has exited. Run Node.js under the service manager or process supervisor selected for your VPS, and configure it to start on boot and restart after failure. The exact unit or supervisor commands vary by operating system and deployment method, so verify the service’s status and logs with that tool before debugging NGINX.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Step 5: Obtain a TLS certificate
Wait until the subdomain resolves publicly before requesting a certificate. An ACME certificate authority must be able to prove control of the hostname.
HTTP-01 validation
For HTTP-01, the ACME client places a token at a URL in the form:
http://api.example.com/.well-known/acme-challenge/<TOKEN>The certificate authority retrieves that token over HTTP. Port 80 must reach the correct NGINX server block, and an access rule must not block the challenge path. During validation, confirm that the challenge can be fetched publicly and that a blanket redirect or authentication rule is not preventing retrieval.
DNS-01 validation
DNS-01 proves control by publishing a TXT record below _acme-challenge.api.example.com. It can issue wildcard certificates, but the ACME client needs carefully scoped access to change DNS records. TXT data may take time to propagate; Let’s Encrypt notes that propagation can take as much as an hour depending on the DNS provider.
| Method | Proof location | Strength | Operational concern |
|---|---|---|---|
| HTTP-01 | Public HTTP challenge URL | Simple for a single hostname with working port 80. | Port 80 and the correct virtual host must remain reachable during issuance and renewal. |
| DNS-01 | TXT record under _acme-challenge |
Supports wildcard certificates and does not require the application itself to serve the token. | DNS propagation can delay validation, and DNS API credentials must be protected. |
Use the certificate paths printed by your ACME client. Paths differ by client and operating system; do not assume that every installation uses the same directory.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Step 6: Redirect HTTP and serve HTTPS
After the certificate is installed, separate the HTTP redirect server from the HTTPS proxy server:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →server {
listen 80;
server_name api.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name api.example.com;
ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Replace the certificate paths with the locations reported by your ACME client. Test the configuration with sudo nginx -t and reload NGINX after a successful test. The HTTP block performs only the permanent redirect; the HTTPS block terminates TLS and proxies the request.
Step 7: Add WebSocket support when the app needs it
Ordinary HTTP proxying does not automatically complete a WebSocket upgrade. NGINX’s WebSocket guidance requires HTTP/1.1 plus the Upgrade and Connection headers. Add them to the relevant location:
location /socket.io/ {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}Use the path used by your WebSocket endpoint. If the entire application uses upgraded connections, place the directives in the general location / block instead. Reload only after the syntax test succeeds.
Verify every layer
Test from the outside in so that one failure does not mask another.
Recommended Free Tools
- DNS: Query the authoritative result and confirm the A, AAAA, or CNAME value is intended.
- Application: Confirm the Node.js service is running and responds on its local port.
- NGINX configuration: Run
sudo nginx -tbefore each reload. - Hostname routing: Request the server with its Host header to distinguish your block from the default site:
curl -i -H 'Host: api.example.com' http://127.0.0.1/- Public HTTP: Check that
http://api.example.comreturns a 301 response whose Location points to HTTPS. - Public HTTPS: Open
https://api.example.comand verify both the certificate hostname and the expected application response. - Challenge path: During HTTP-01 issuance, confirm the
.well-known/acme-challengepath is publicly reachable. During DNS-01 issuance, query the TXT record and wait for propagation. - WebSockets: Use the application’s WebSocket client or a protocol-aware test tool and inspect NGINX and application logs if the connection closes immediately.
Troubleshoot by layer
| Symptom | Likely layer | What to check | Correction |
|---|---|---|---|
| NXDOMAIN | DNS | The record name, zone, and authoritative nameservers. | Create or correct the A, AAAA, or CNAME record and allow resolver caches to expire. |
| An old VPS address appears | DNS caching | Authoritative answer versus the resolver you are using. | Confirm the authoritative record first; wait for the previous TTL to expire before assuming the VPS configuration is wrong. |
| The NGINX welcome or default page appears | Virtual-host selection | The exact server_name, whether the file is enabled, and whether another block is shadowing it. |
Correct the hostname, enable the intended block, disable conflicting defaults where appropriate, test, and reload. |
| 502 Bad Gateway | Proxy-to-Node connection | Node.js process status, bind address, configured port, and local firewall rules. | Start the service, make proxy_pass match the listening socket, and permit the local connection. |
| Connection refused on the local curl test | Application | Process logs and the output of ss -ltnp. |
Fix the application startup error or change NGINX to the port the process actually uses. |
| Certificate challenge fails | ACME validation | For HTTP-01, port 80, the matching server block, and challenge access. For DNS-01, the exact TXT name and propagation. | Remove blocking rules for the challenge, correct the TXT value, or wait for DNS propagation before retrying. |
| HTTPS works but redirects loop | Proxy scheme handling | Whether NGINX sends X-Forwarded-Proto and whether the application trusts the proxy correctly. |
Pass the original scheme and configure the application to interpret the forwarding header according to its framework’s security guidance. |
| WebSocket disconnects immediately | Upgrade handling | HTTP/1.1, Upgrade, and Connection headers in the WebSocket location. | Add the required headers and reload after an NGINX syntax test. |
| IPv4 works but IPv6 fails | AAAA or IPv6 network path | Whether the AAAA address belongs to the VPS and whether IPv6 firewall rules allow 80 and 443. | Fix IPv6 routing and firewall settings, or remove the AAAA record until IPv6 is ready. |
Choosing records and proxy designs
The correct design depends on how your infrastructure is addressed and whether another proxy sits in front of the VPS.
| Decision | Choose this when | Trade-off |
|---|---|---|
| A versus AAAA | Use A for IPv4, AAAA for working IPv6; publish both when both paths are correctly configured. | Publishing an unusable AAAA record can make some clients fail before trying IPv4. |
| A versus CNAME | Use A/AAAA for a stable VPS address; use CNAME when the provider supplies a hostname that may track address changes. | A CNAME adds a DNS lookup and cannot be used to encode a port. |
| DNS-only versus proxied DNS | DNS-only sends clients toward the origin address; a provider proxy can add an intermediary layer. | A proxy changes the network path and must support your ports, TLS mode, WebSockets, and certificate-validation method. |
| One backend versus an upstream group | One proxy_pass target is enough for a single Node.js process; an NGINX upstream group suits multiple backend processes or servers. |
Multiple backends require health, session, deployment, and logging decisions that a single process does not. |
Using an upstream group for more than one Node.js process
When you run multiple instances, define a named upstream group and refer to it from proxy_pass:
upstream node_app {
server 127.0.0.1:3000;
server 127.0.0.1:3001;
}
server {
listen 443 ssl;
server_name api.example.com;
location / {
proxy_pass http://node_app;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}NGINX describes this pattern as creating a named upstream group that lists backend servers and then referring to that group in one or more proxy_pass directives. Ensure every listed process is healthy and that your application can tolerate requests reaching different instances.
Quick Recap
Operational checklist after launch
- Record the DNS names, addresses, and intended TTL in your deployment documentation.
- Keep Node.js bound to the intended local or private interface and document the internal port.
- Monitor the supervised process, NGINX error log, and application log separately so failures can be assigned to the right layer.
- Renew the TLS certificate before expiry and verify that the renewal method can still reach HTTP-01 or update DNS-01 records.
- Repeat
nginx -tbefore every configuration reload. - Test both the redirect and the final HTTPS endpoint after changes to DNS, NGINX, firewall rules, or the application.
- If you add a second subdomain, create a separate DNS record and a matching
server_name; do not assume that an existing virtual host will route it correctly.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
