iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Put Nginx in front of iRedMail as the public HTTPS endpoint, then forward web requests to the private iRedMail web service. Point your mail hostname at the Nginx server, terminate TLS on port 443, redirect port 80 to HTTPS, and proxy the documented iRedMail web paths such as /mail (Roundcube), /SOGo, /netdata and /iredadmin. Keep SMTP, IMAP and POP3 separate: an HTTP location block cannot proxy mail protocols. If email clients must also connect through Nginx, configure Nginx’s separate mail {} context and its authentication service.
What the finished setup looks like
The usual design has three layers:
- DNS: a name such as
mail.example.comresolves to the public IP address of the Nginx edge. - Nginx: listens publicly on TCP 80 and 443, redirects HTTP to HTTPS, presents the public certificate, and forwards web requests.
- iRedMail: serves Roundcube, SOGo and administration applications on a private address and port.
Only the web applications use the HTTP reverse proxy. iRedMail’s normal mail ports remain independent: 25 for server-to-server SMTP, 587 for authenticated submission, 993 for encrypted IMAP and 995 for encrypted POP3. Databases, LDAP and other application services are normally localhost-only and should stay that way unless your design specifically requires otherwise.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThis separation matters operationally. A successful Roundcube login proves that the web path works; it does not prove that SMTP submission or IMAP access is reachable. Test each protocol on its own.
Choose the topology before changing configuration
| Decision | Same host | Separate Nginx host | What to check |
|---|---|---|---|
| Where Nginx runs | On the iRedMail server | On a dedicated edge or another server | Confirm that the backend has a private listener; do not send traffic back to the public 443 socket. |
| Backend connection | Usually loopback, such as a private high port | Private network address and firewall rule | Permit only the edge-to-backend port, preferably from the Nginx address. |
| Certificate ownership | Nginx obtains and renews the public certificate | The edge obtains and renews it; the iRedMail host can use an internal certificate | Clients must see a certificate matching the public hostname. |
| Upgrade compatibility | Use iRedMail’s generated templates where possible | Maintain an explicit proxy configuration and preserve the public headers | Recheck configuration after iRedMail or distribution upgrades. |
| Failure domain | One machine contains the edge and mail service | The edge and mail service can fail independently, but the private network becomes another dependency | Monitor both the public listener and the backend. |
For routing, you can keep one hostname and use paths, or assign separate names to applications. The documented iRedMail paths are /mail, /SOGo, /netdata and /iredadmin. A subdomain design, such as a dedicated webmail name, can be cleaner for cookies and redirects, but it requires another DNS name and a matching server block.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Prerequisites and a safe change plan
- Administrative access to the Nginx host and the iRedMail host.
- A DNS A record and, if you use IPv6, an AAAA record for the public name.
- A certificate and private key for that name. iRedMail’s default
ssl.tmpluses a self-signed certificate; a publicly trusted certificate is strongly recommended for browser and mail-client compatibility. - The actual iRedMail backend address and port. Do not guess this value from a sample configuration.
- A maintenance window or rollback copy of the current Nginx configuration.
Record the current listeners before editing:
ss -ltnp
nginx -TThe first command shows listening TCP sockets. The second prints the effective Nginx configuration and helps reveal an existing 443 server, included template, or conflicting server_name. Save a copy of the active site configuration so you can restore it if the new server block prevents Nginx from starting.
1. Create DNS for the edge hostname
Choose a public name such as mail.example.com or webmail.example.com. Create an A record pointing to the Nginx edge. Create an AAAA record only when IPv6 is actually routed and filtered correctly; an incorrect AAAA record can make some clients fail even when IPv4 works.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →If Nginx is on a different machine from iRedMail, do not point the public name directly at the mail server. The public address should be the edge address, while the edge reaches iRedMail over a private route. Wait for DNS to resolve as expected before requesting a certificate or testing redirects.
2. Identify the private iRedMail web listener
Determine whether iRedMail serves HTTP through Nginx, Apache or another local service, and which address and port it uses. The reverse proxy must target that private listener. A common deployment pattern uses a loopback port such as 127.0.0.1:8080, but that value is only an example; use the port shown by your installed configuration.
On a separate edge host, verify reachability from the edge itself:
curl -I http://10.0.0.20:8080/Replace the address and port with the actual private endpoint. A connection refusal means the service is not listening there or a firewall is blocking it. A response with an unexpected virtual host usually means the request needs the correct Host header or the backend’s own server block must be adjusted.
Do not proxy from an Nginx 443 listener to the same host’s public 443 listener. That creates a loop or a TLS mismatch. Move the backend to a private port, bind it to a separate private address, or place the proxy on another host.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
3. Configure HTTP-to-HTTPS redirection and the HTTPS proxy
Create a dedicated server block for the hostname. This pattern terminates TLS at Nginx and sends ordinary HTTP to the private backend:
server {
listen 80;
listen [::]:80;
server_name mail.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name mail.example.com;
ssl_certificate /etc/letsencrypt/live/mail.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mail.example.com/privkey.pem;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Change the hostname, certificate paths and backend address to match your installation. The trailing slash behavior of proxy_pass affects URI rewriting, so preserve the form that matches your backend’s expected paths. If the backend itself listens with HTTPS, use an HTTPS upstream deliberately and configure certificate verification appropriate to that private connection; do not add HTTPS merely because the public side uses HTTPS.
The forwarded headers preserve the original hostname, client address and public scheme. They allow backend redirects and logs to identify the request as HTTPS even though the edge-to-backend hop is HTTP. Verify the exact header expectations against your installed iRedMail templates rather than assuming every release uses the same proxy settings.
4. Use iRedMail’s generated templates when Nginx is on the mail host
When Nginx runs on the iRedMail machine, the project’s generated templates are often safer than replacing the complete site with a hand-written proxy. The documented subdomain pattern includes:
misc.tmplfor common settings;ssl.tmplfor TLS settings;- an application template such as
roundcube-subdomain.tmpl, or the corresponding SOGo or iRedAdmin template.
The resulting server block is then enabled through the distribution’s normal sites-enabled link or equivalent include mechanism. Follow the layout already present on your host; do not create a second 443 block with the same server_name if the generated configuration already owns it.
The generated files also explain why a trusted certificate matters. The default SSL template uses a self-signed certificate. That is acceptable for an isolated test, but browsers and mail clients will warn or reject it unless the issuing certificate authority is trusted. Request a free publicly trusted certificate for the hostname and renew it before expiration. One certificate can cover multiple names when its subject names or wildcard scope are appropriate.
5. Decide between paths and subdomains
Path-based access
With one hostname, users reach Roundcube at https://mail.example.com/mail, SOGo at https://mail.example.com/SOGo, Netdata at https://mail.example.com/netdata and iRedAdmin at https://mail.example.com/iredadmin. This keeps certificate and DNS management simple. Preserve the path exactly, including capitalization for /SOGo, and make sure a catch-all location does not rewrite an application path unexpectedly.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Subdomain access
A subdomain such as webmail.example.com can route directly to one application. Create DNS for that name, request a certificate covering it, and use the application-specific generated template or a server block whose server_name matches it. Subdomains reduce path-prefix edge cases, but each additional name must be included in DNS, certificates, redirects and monitoring.
Do not mix incompatible ownership
Choose one component to own each public hostname and port. If an existing iRedMail catch-all HTTPS server already listens on 443, either modify that configuration or move the backend listener before adding a new edge block. Two unrelated configurations claiming the same name can result in Nginx selecting the wrong server block without an obvious error.
6. Validate the configuration and reload Nginx
- Run the syntax check for your distribution, normally
nginx -t. Fix every error before reloading. - Reload rather than stop Nginx so existing connections have a chance to finish:
systemctl reload nginx. - Confirm that port 80 returns a 301 redirect to the HTTPS URL.
- Open the HTTPS hostname and test each path you intentionally publish:
/mail,/SOGo,/netdataand/iredadmin. - Inspect the certificate name, chain and expiry from a client that does not trust your internal CA.
- Check both Nginx’s error log and the iRedMail backend log while making a request.
Test by hostname, not only by IP address. TLS certificate selection and virtual-host routing depend on the name sent by the client.
Web reverse proxy versus mail-protocol proxy
An HTTP location block handles HTTP requests only. It cannot carry SMTP, IMAP or POP3 sessions. If Nginx must be the public endpoint for those protocols, use its separate mail-proxy feature:
Recommended Free Tools
- Enable Nginx mail modules; the build needs
--with-mail, and TLS support requires--with-mail_ssl_module. - Define a top-level
mail {}context, not a nested HTTP location. - Provide an HTTP authentication service that tells Nginx which upstream mail server and credentials to use.
- Create protocol-specific
serverblocks for SMTP, IMAP and POP3, with explicit listen ports and TLS settings. - Install certificates and configure the TLS versions and policies required by your clients; the documented Nginx examples use TLS 1.2 and TLS 1.3.
Keep the iRedMail port model in view when mapping these listeners:
| Port | Protocol or purpose | Typical exposure | Reverse-proxy implication |
|---|---|---|---|
| 80 | HTTP | Public only for redirect or ACME validation | Handled by the HTTP server block. |
| 443 | HTTPS web applications | Public | Handled by the HTTP reverse proxy and TLS certificate. |
| 25 | Server-to-server SMTP | Public when receiving mail | Requires mail proxying or direct forwarding, not an HTTP location. |
| 587 | Authenticated SMTP submission | Public for mail clients | Use a mail-proxy listener or expose the submission service directly. |
| 993 | Encrypted IMAP | Public for mail clients | Requires the mail proxy’s IMAP protocol handling or direct service exposure. |
| 995 | Encrypted POP3 | Public only if POP3 is offered | Requires POP3 protocol handling or direct service exposure. |
| 465 | SMTP over SSL | Not recommended for new configurations | iRedMail marks it deprecated; use 587 for submission. |
Do not expose database, LDAP or other localhost-only services simply because Nginx is now public. A working webmail proxy does not require those services to be reachable from the Internet.
Security and operational controls
- Limit firewall exposure: allow 80 and 443 at the edge, and allow only the mail ports your deployment actually uses. On a separate edge, permit the backend web port from the edge’s private address only.
- Use a trusted certificate: renew it automatically where possible and monitor its expiry. A self-signed default is unsuitable for a general public service.
- Preserve identity headers: pass
Host,X-Real-IP,X-Forwarded-ForandX-Forwarded-Proto; verify that the installed templates do not define conflicting values. - Protect administration paths: publish
/iredadminonly if needed, and add network restrictions or an additional access-control layer appropriate to your organization. - Separate logs: retain Nginx access and error logs alongside iRedMail application and mail logs so you can distinguish an edge failure from an authentication or backend failure.
- Test renewals: a certificate that works today can still fail after renewal if the full chain, file permissions or reload hook is wrong.
- Plan upgrades: generated iRedMail templates may change. Compare local customizations with the regenerated files after upgrades instead of blindly overwriting them.
Troubleshooting by symptom
502 Bad Gateway
Nginx cannot establish a usable connection to the configured backend. Check that the service is running, the address and port are correct, and a host firewall allows the connection. If the backend speaks HTTPS while proxy_pass uses HTTP, correct the protocol deliberately.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
The browser shows the wrong site or a certificate warning
Verify DNS, the requested hostname, the certificate names and the order of Nginx server blocks. An old catch-all 443 block may be receiving the request. A self-signed certificate will also trigger a warning even when proxying works.
Free tools Windows power users keep installed
One-click scans. No signup required.
Redirects return to HTTP or to an internal name
Ensure the backend receives Host $host and X-Forwarded-Proto $scheme. Check the application’s configured public URL and inspect the response’s Location header. Do not fix a wrong public URL by creating a second proxy loop.
/mail works but /SOGo or administration does not
Confirm that the application is enabled in the installed iRedMail configuration and that the path’s capitalization is preserved. A subdomain template cannot automatically serve a path-based URL unless its location rules are present.
Webmail works but mail clients cannot send or receive
Check ports 587, 993 and, when applicable, 25 or 995 independently with firewall and service-listener tests. HTTP proxy settings do not affect those protocols. If you intended Nginx to front them, verify the mail modules, top-level mail {} configuration and authentication service.
Nginx refuses to reload
Run nginx -t and read the reported file and line number. Typical causes are a duplicate listen/server combination, a missing certificate file, an unmatched brace or an include pointing to a removed template. Restore the last known-good configuration if the error cannot be corrected during the change window.
A repeatable deployment checklist
- Choose the public hostname and whether applications use paths or subdomains.
- Point A and, when correctly routed, AAAA records to the Nginx edge.
- Identify the private iRedMail web listener and prove that the edge can reach it.
- Resolve any existing 443 ownership or same-host port conflict.
- Install a trusted certificate covering every published hostname.
- Enable iRedMail’s generated templates when they match the deployment, or create a dedicated HTTP proxy server block.
- Set the public host and forwarded scheme/address headers.
- Run
nginx -t, reload Nginx and test redirects and every selected web path. - Test SMTP, IMAP and POP3 separately; add the mail-proxy configuration only if Nginx must front those protocols.
- Restrict firewall ports, monitor certificate expiry and document the backend port for future upgrades.
Frequently asked questions
Can Nginx proxy only Roundcube?
No. The same HTTP reverse-proxy design can publish Roundcube, SOGo, Netdata and iRedAdmin, provided the corresponding paths or application templates are enabled. It still does not proxy SMTP, IMAP or POP3 through an HTTP location.
Which port should users configure for outgoing mail?
Use authenticated SMTP submission on port 587. iRedMail identifies port 465 as deprecated and recommends 587 instead.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Must the iRedMail backend also use HTTPS?
Not necessarily. Nginx can terminate public TLS and forward over a protected private network. Use HTTPS upstream when your trust requirements demand encryption on that hop, and configure it intentionally rather than sending traffic to the same public 443 listener.
Can I leave the default self-signed certificate in production?
You can, but clients will receive trust warnings or failures unless they trust your private certificate authority. A publicly trusted certificate is the practical choice for Internet-facing webmail and administration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why does a working webmail page not prove that IMAP works?
Roundcube is an HTTP application. IMAP is a separate protocol and port, normally 993 for encrypted access. Each service has its own listener, firewall rule and authentication path, so each must be tested independently.
Frequently Asked Questions
Can Nginx proxy only Roundcube?
No. It can publish the documented iRedMail web applications, including SOGo and iRedAdmin, but SMTP, IMAP and POP3 require Nginx’s separate mail-proxy context or direct exposure.
Which port should users configure for outgoing mail?
Use authenticated SMTP submission on port 587. Port 465 is marked deprecated in the iRedMail port guidance.
Must the iRedMail backend also use HTTPS?
No. Nginx may terminate public TLS and forward to a private HTTP listener, provided that the private network is appropriately protected and the backend address is not the public 443 socket.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Why does webmail work while IMAP fails?
Webmail uses HTTP; IMAP uses its own service and port, normally 993 for encrypted access. They need separate listener, firewall and protocol tests.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
