iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
DNS cannot point a subdomain to port 3000, 8080, or any other application port. DNS maps a name to an IP address or another hostname. Nginx receives the request on public port 80 or 443, selects the matching server_name, and uses proxy_pass to send the request to the correct internal port.
For example, app1.example.com can proxy to 127.0.0.1:3000 while app2.example.com proxies to 127.0.0.1:8080. The applications can remain private; users see normal HTTP or HTTPS URLs without adding a port number.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The three layers involved
A working subdomain-to-port setup has three separate responsibilities. Keeping them separate makes configuration and troubleshooting much easier.
1. DNS resolves the hostname
Create an A record when the Nginx server has an IPv4 address, an AAAA record when it has an IPv6 address, or a CNAME when the subdomain should alias another fully qualified domain name. The record name is the subdomain label, such as app1 for app1.example.com.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
All subdomains in this pattern resolve to the public address of the Nginx host (or to a hostname that ultimately does so). DNS records do not contain the application port. A browser therefore reaches the same public HTTP or HTTPS listener regardless of which subdomain it requests.
2. Nginx selects a virtual server
Nginx listens on a public address and port, normally 80 for HTTP and 443 for HTTPS. The hostname sent in the request is matched against server_name. Nginx documentation describes this directive as determining which server block handles a request.
3. The reverse proxy selects the application port
Inside the selected location, proxy_pass specifies the upstream protocol, address, and port. Nginx sends the request to that upstream, receives the response, and returns it to the client.
| Layer | Directive or record | What it decides |
|---|---|---|
| DNS | A, AAAA, or CNAME | Which host receives the name |
| Nginx listener | listen |
Public IP, protocol, and port |
| Nginx virtual host | server_name |
Which server block handles the hostname |
| Reverse proxy | proxy_pass |
Which backend address and application port receives the request |
Before you configure Nginx
Confirm these prerequisites before changing configuration:
- You control the authoritative DNS zone for the domain.
- The Nginx server has a public IPv4 address, IPv6 address, or a reachable hostname.
- Each application is running and listening on the intended port, such as 3000 or 8080.
- Nginx is installed and allowed to bind to the public listener.
- Host or cloud firewalls allow public TCP 80 and, for HTTPS, TCP 443.
- The applications are reachable from Nginx over loopback or a private network.
- For production HTTPS, you have a certificate and private key covering each hostname.
Do not expose backend ports publicly just to make proxying work. When Nginx and the applications share a host or private network, the upstream ports can remain private.
Create the DNS records
A record for IPv4
At the authoritative DNS provider, create an A record with:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
- Name:
app1(or the complete name if the provider requires it) - Value: the Nginx server’s public IPv4 address
Repeat for app2. Both records can contain the same address because Nginx distinguishes requests by hostname.
AAAA record for IPv6
If the server accepts IPv6 traffic, add an AAAA record whose value is the Nginx server’s IPv6 address. Ensure Nginx is listening on IPv6 and that the IPv6 firewall permits the same public ports. An AAAA record pointing to an address that is not actually serving Nginx can cause clients to fail even when IPv4 works.
CNAME alias
Use a CNAME when the DNS provider’s recommended design is to alias the subdomain to another fully qualified domain name. The target name, not a port, is stored in the record. The target must ultimately resolve to the service that presents Nginx.
Verify DNS before debugging Nginx
Query each name from a machine that can reach your DNS service:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →dig app1.example.com
dig app2.example.comCheck that the returned A or AAAA answers are the intended Nginx addresses. If a name resolves directly to a private address or to a different server, Nginx on the expected host will never receive that request.
Configure one Nginx server block per subdomain
The clearest design is one server block for each hostname. The following HTTP configuration sends two subdomains to different local ports:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
server {
listen 80;
server_name app1.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:3000;
}
}
server {
listen 80;
server_name app2.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:8080;
}
}Replace the hostnames and ports with your own values. The two blocks may listen on the same public port because server_name determines which block handles each request.
What each directive does
listen 80;accepts HTTP connections on port 80.server_namematches the hostname supplied by the client.location /handles every path below the hostname.proxy_passsends the request to the selected application.proxy_set_header Host $host;preserves the original hostname for applications that use host-based routing, URL generation, or tenant selection.X-Real-IPcarries the client address in a simple header.X-Forwarded-Forpreserves the proxy chain, allowing an application configured to trust Nginx to determine the originating address.X-Forwarded-Prototells the application whether the client used HTTP or HTTPS.
Nginx otherwise changes the proxied Host header to $proxy_host and sets Connection to close by default. Forwarding headers is useful only when the upstream is configured to trust the proxy safely; never trust arbitrary client-supplied forwarding headers when Nginx is not the controlled proxy boundary.
Enable HTTPS at Nginx
For production, terminate TLS at Nginx and proxy plain HTTP over the private connection to the application unless the upstream specifically requires encryption. A 443 server block includes the certificate and key:
server {
listen 443 ssl;
server_name app1.example.com;
ssl_certificate /etc/letsencrypt/live/app1.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/app1.example.com/privkey.pem;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://127.0.0.1:3000;
}
}The ssl parameter on listen enables TLS for that virtual server. The certificate file and private-key file must exist, be readable by Nginx, and cover the hostname. Use either an individual certificate per subdomain or a certificate with appropriate Subject Alternative Names or a wildcard name.
Redirect HTTP to HTTPS
A common arrangement is a small port-80 block that redirects the hostname, plus the proxying block on 443:
server {
listen 80;
server_name app1.example.com;
return 301 https://$host$request_uri;
}Apply the same arrangement to each hostname, or use a carefully scoped block for a set of names. Keep the certificate-bearing proxy block on port 443. TLS Server Name Indication allows multiple HTTPS server blocks to share one IP, provided the certificate selection and server_name values are correct.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Understand proxy_pass path behavior
The exact spelling of proxy_pass matters when a location contains a path. With no URI in the directive, Nginx passes the full normalized request URI to the upstream:
location / {
proxy_pass http://127.0.0.1:3000;
}With a URI included, Nginx replaces the part of the normalized request URI that matched the location:
location /dashboard/ {
proxy_pass http://127.0.0.1:3000/;
}In this example, a request for /dashboard/reports is sent with the matching /dashboard/ prefix replaced by /, producing an upstream path of /reports. If the application expects the prefix to remain, omit the URI portion:
location /dashboard/ {
proxy_pass http://127.0.0.1:3000;
}Trailing slashes therefore are not cosmetic. Decide whether the upstream application is mounted at its root or expects the public prefix, then test links, redirects, static files, and API paths under that location.
Validate the configuration safely
Use this order so a failure is easy to localize:
- Check the backend listener. Run
ss -ltnpand confirm that the expected service is listening on port 3000, 8080, or your chosen port. Verify the service’s own status command as well. - Test Nginx syntax. Run
nginx -t. Do not reload until the test reports valid syntax and successful configuration loading. - Reload, do not stop, Nginx. Use the host’s service manager to reload the validated configuration so existing connections are not unnecessarily terminated.
- Test locally with the Host header. This bypasses DNS while exercising virtual-host selection:
curl -H 'Host: app1.example.com' http://127.0.0.1/ - Test each public hostname. Check both HTTP and HTTPS as applicable, including paths beyond
/. - Inspect logs. Nginx error logs distinguish an upstream connection failure from a certificate, listener, or server-name problem.
- Check firewalls. Public 80 and 443 must be reachable. Backend ports need reachability from Nginx, not necessarily from the Internet.
Troubleshoot the common failure modes
The request reaches the wrong site
Check the exact server_name, spelling, and DNS answer. When several blocks share a listen port, an unmatched Host header is handled by the default server for that port. A default block can therefore display a generic site when the requested name does not match.
502 Bad Gateway
A 502 generally means Nginx could not obtain a valid response from the configured upstream. Confirm that:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- The application is running and listening on the configured port.
- The address is correct.
127.0.0.1refers to the Nginx host; it will not reach a service on another machine. - The application is bound to an address reachable from Nginx, such as loopback for a same-host service or the correct private-network address for a separate host.
- A local firewall or container network policy allows the connection.
- The upstream protocol matches the service. Use
http://for an HTTP listener; do not assume an HTTPS upstream.
DNS resolves, but the browser cannot connect
Verify that the answer is the Nginx public address, that the server is listening on the correct interface, and that host and cloud firewalls allow TCP 80 or 443. An AAAA record can cause IPv6 clients to fail if IPv6 routing or firewall rules are incomplete, even while IPv4 tests succeed.
HTTPS shows a certificate warning
Inspect the certificate’s names and expiration, the path configured in ssl_certificate, and the private-key path. The certificate must include the exact subdomain, either directly, through a SAN entry, or through an applicable wildcard. Also verify that the request reaches the intended 443 server block; SNI and server_name must agree.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe application generates HTTP links behind HTTPS
Pass X-Forwarded-Proto https and configure the application framework to trust that header from Nginx. Without a trusted proxy configuration, the application may correctly believe its private connection is HTTP and produce insecure redirects or absolute links.
Paths lose or duplicate a prefix
Compare the location and proxy_pass forms. A directive with a URI replaces the matching location prefix; one without a URI passes the full request URI. Test a representative page, an asset, an API endpoint, and a redirect after every change.
Choose the right architecture
| Design | Public exposure | Port mapping | When it fits |
|---|---|---|---|
| One Nginx host, multiple subdomains | One public IP; ports 80/443 | Each server block proxies to a different private port | Several applications on one server |
| Nginx on a gateway, applications on private hosts | Gateway exposes 80/443 only | Each proxy target is a private address and port | Centralized TLS and ingress control |
| Applications expose their own ports directly | Each application port is public | Users include a nonstandard port in the URL | Testing or a case where a reverse proxy is not required |
| Path-based routing on one hostname | One hostname on 80/443 | Different locations proxy to different ports | Applications are designed to operate below path prefixes |
Subdomain routing is usually simpler than path routing because each application can operate at its own root path. Compare designs by the number of public IPs, whether backend ports remain private, where TLS terminates, certificate scope, required path rewriting, and whether an upstream needs the original Host and forwarding headers.
Security and operational checks
- Expose only the Nginx listener ports that users need; restrict backend ports to loopback or the private network whenever possible.
- Keep each upstream’s port and address explicit. Avoid sending an unrecognized hostname to a sensitive default application.
- Use HTTPS for credentials, sessions, and administrative interfaces.
- Protect private keys with appropriate filesystem permissions and renew certificates before expiration.
- Configure applications to trust forwarding headers only from the Nginx proxy, not from arbitrary Internet clients.
- Preserve separate access and error logs for diagnosing which hostname and upstream failed.
- After every edit, run
nginx -t, reload through the service manager, and perform a hostname-specific curl test.
Quick reference configuration
This compact example shows the essential mapping for two HTTPS subdomains. It assumes certificates already exist and that both applications speak HTTP on the local machine.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteserver {
listen 443 ssl;
server_name app1.example.com;
ssl_certificate /path/to/app1/fullchain.pem;
ssl_certificate_key /path/to/app1/privkey.pem;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://127.0.0.1:3000;
}
}
server {
listen 443 ssl;
server_name app2.example.com;
ssl_certificate /path/to/app2/fullchain.pem;
ssl_certificate_key /path/to/app2/privkey.pem;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://127.0.0.1:8080;
}
}In this pattern, DNS maps both names to the Nginx host, SNI and server_name select the correct certificate and block, and proxy_pass performs the actual port mapping. That is the complete distinction between pointing a subdomain at a host and routing it to a particular application.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
