Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The shortest reliable path is: run Nginx Proxy Manager (NPM) in Docker, point a domain or subdomain at your public IP, forward TCP ports 80 and 443 to the NPM host, create a proxy host for your internal application, and request a Let’s Encrypt certificate from NPM. Keep the NPM administration port, 81, private—use local access or a VPN rather than exposing it broadly to the Internet.
This guide uses NPM’s single-container Docker Compose deployment with its bundled SQLite database. That is the sensible starting point for most home labs and small deployments. An external MySQL/MariaDB or PostgreSQL database is better reserved for a specific operational requirement, such as an existing database platform or a deliberately separated application and database lifecycle.
What Nginx Proxy Manager does
Nginx Proxy Manager is a Docker-based management interface for Nginx. Instead of writing ordinary Nginx configuration files by hand, you use a web interface to create:
- Reverse-proxy hosts
- HTTP-to-HTTPS redirects
- TCP/UDP streams
- Access lists
- Basic HTTP authentication
- Custom TLS certificates
- Automatically managed Let’s Encrypt certificates
- Selected advanced Nginx configuration
A reverse proxy accepts a request for a public hostname such as app.example.com and forwards it to an upstream service, such as a Docker container on port 8080 or a server elsewhere on your LAN. NPM can terminate HTTPS at the edge while the internal connection uses HTTP or HTTPS according to your design.
#1 Best Overall
- 𝗢𝗻𝗲 𝗦𝘄𝗶𝘁𝗰𝗵 𝗠𝗮𝗱𝗲 𝘁𝗼 𝗘𝘅𝗽𝗮𝗻𝗱 𝗡𝗲𝘁𝘄𝗼𝗿𝗸: 5× 10/100/1000Mbps RJ45 Ports supporting Auto Negotiation and Auto MDI/MDIX.
- 𝗚𝗶𝗴𝗮𝗯𝗶𝘁 𝘁𝗵𝗮𝘁 𝗦𝗮𝘃𝗲𝘀 𝗘𝗻𝗲𝗿𝗴𝘆: Latest innovative energy-efficient technology greatly expands your network capacity with much less power consumption and helps save money.
- 𝗥𝗲𝗹𝗶𝗮𝗯𝗹𝗲 𝗮𝗻𝗱 𝗤𝘂𝗶𝗲𝘁: IEEE 802.3X flow control provides reliable data transfer and Fanless design ensures quiet operation.
- 𝗣𝗹𝘂𝗴 𝗮𝗻𝗱 𝗣𝗹𝗮𝘆: Easy setup with no software installation or configuration needed.
- 𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝗱 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗙𝗲𝗮𝘁𝘂𝗿𝗲𝘀: Prioritize your traffic and guarantee high quality of video or voice data transmission with Port-based 802.1p/DSCP QoS and IGMP Snooping.
NPM is not a firewall, identity provider, DDoS-protection service, or complete application-security platform. It can add TLS termination, access controls, and authentication, but the security of the upstream application and the surrounding network still matters.
Before you begin
Required components
- A Docker host. Docker Desktop includes Docker Engine, the Docker CLI, and Compose. On Linux, install Docker Engine and the Docker Compose plugin using Docker’s instructions for your distribution.
- A domain or subdomain. For example,
app.example.com. You need an A record pointing to the public IPv4 address that reaches your home or server network. Use an AAAA record only if IPv6 is correctly routed from the Internet to NPM. - Inbound network access. Forward TCP ports
80and443from your router to the machine running NPM. Port81is the administrative interface and should normally remain accessible only from your LAN or a management VPN. - An upstream application. Record its hostname or IP address and listening port. It can be another Docker container, a service on the NPM host, or a reachable machine elsewhere on the LAN.
Hardware requirements depend on how many services you proxy and what those services do. NPM itself is commonly suitable for a small always-on Docker host; readers choosing hardware can compare a Raspberry Pi 5 for Nginx Proxy Manager with a compact x86-64 mini PC for a broader home-lab workload. Do not treat either platform as a universal capacity recommendation.
Verify Docker and Compose
After installing Docker using the official instructions for your operating system, verify the tools:
docker --version
docker compose version
sudo docker run hello-worldThe exact installation commands vary by Linux distribution and desktop platform. Prefer the Docker Compose plugin or Docker Desktop; Docker describes the standalone Compose installation as a legacy compatibility option. Also review how published container ports interact with host firewall rules, particularly on Linux.
1. Create the NPM Docker Compose project
Create a dedicated directory for the Compose file and persistent data:
mkdir -p ~/nginx-proxy-manager
cd ~/nginx-proxy-manager
nano compose.ymlSave this Compose configuration as compose.yml:
services:
app:
image: 'jc21/nginx-proxy-manager:2.15.1'
restart: unless-stopped
environment:
TZ: 'UTC'
# Uncomment only when the Docker host does not have IPv6 enabled:
# DISABLE_IPV6: 'true'
ports:
- '80:80'
- '81:81'
- '443:443'
volumes:
- ./data:/data
- ./letsencrypt:/etc/letsencryptThe NPM setup documentation currently shows image tag 2.15.1. Treat that as the version documented by the source used for this guide, not as a promise that it will remain current indefinitely. Check the official setup and release information before a new deployment or upgrade.
The two bind mounts are important:
./datastores NPM application state and its bundled database../letsencryptstores certificate and related Let’s Encrypt data.
Replace UTC with an IANA time-zone name such as America/New_York if local timestamps are more useful to you. UTC is often preferable when logs are collected centrally.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesSet DISABLE_IPV6: 'true' only when the Docker host does not have usable IPv6 support. If IPv6 is configured correctly, leaving IPv6 enabled may be preferable.
2. Start Nginx Proxy Manager
From the directory containing compose.yml, start the container in the background:
docker compose up -d
docker compose ps
docker compose logs -f appOn first startup, NPM initializes its database tables and application state. Depending on the hardware, this can take a minute or longer. Stop following the logs with Ctrl+C; that does not stop the container.
Rank #2
- GIGABIT ETHERNET PORTS: Features 5 x 1.0Gbps Ethernet ports for high-speed connectivity. Auto-negotiating ports detect the optimal speed for connected devices and work with existing Cat5e or Cat6 Ethernet cables.
- PLUG-AND-PLAY UNMANAGED NETWORK SWITCH: Simple plug-and-play setup with no software to install or configuration required.
- FLEXIBLE MOUNTING OPTIONS: Compact metal design supports desktop or wall-mount placement for versatile installation.
- SILENT & ENERGY-EFFICIENT OPERATION: Fanless design ensures silent performance, while IEEE 802.3az Energy Efficient Ethernet reduces power consumption without compromising high-speed network performance.
- REGIONAL COMPATIBILITY: Made for use in U.S. & CA only
Open the administration interface from the local network:
Free tools Windows power users keep installed
One-click scans. No signup required.
http://SERVER-IP:81For a local installation, http://127.0.0.1:81 works when the browser is running on the Docker host. Complete the initial administrator setup immediately, use a strong unique password, and never reuse credentials copied from an example or documentation page.
Do not publish port 81 casually. The Compose mapping makes the administration interface available on the host’s port 81. That does not mean it should be forwarded by the router. Keep it on the LAN, restrict it with a management firewall rule, or reach it through a VPN.
3. Put same-host Docker applications on a shared network
If the upstream application is another Docker container on the same host, a shared user-defined Docker network is usually cleaner and safer than publishing the application’s port on the host.
Create the network once:
docker network create npm_proxyAdd this network declaration to NPM’s compose.yml:
networks:
default:
external: true
name: npm_proxyThen add the same external network to the application’s Compose project. For example:
services:
app:
image: example/application:stable
expose:
- '8080'
networks:
- npm_proxy
networks:
npm_proxy:
external: trueAfter both projects are attached to npm_proxy, use the application service name as NPM’s forward hostname and the container’s internal listening port as the forward port. In this example, use:
- Forward hostname:
app - Forward port:
8080
Do not use localhost by default. Inside the NPM container, localhost refers to the NPM container itself, not the Docker host and not another application container.
For an application on another LAN machine, use its reachable private IP address or hostname and its listening port. Confirm that the remote service accepts connections from the NPM host.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
- GIGABIT ETHERNET PORTS: Features 8 x 1.0Gbps Ethernet ports for high-speed connectivity. Auto-negotiating ports detect the optimal speed for connected devices and work with existing Cat5e or Cat6 Ethernet cables.
- PLUG-AND-PLAY UNMANAGED NETWORK SWITCH: Simple plug-and-play setup with no software to install or configuration required.
- FLEXIBLE MOUNTING OPTIONS: Compact metal design supports desktop or wall-mount placement for versatile installation.
- SILENT & ENERGY-EFFICIENT OPERATION: Fanless design ensures silent performance, while IEEE 802.3az Energy Efficient Ethernet reduces power consumption without compromising high-speed network performance.
- REGIONAL COMPATIBILITY: Made for use in U.S. & CA only
4. Configure DNS and router forwarding
Create the DNS record
For app.example.com, create an A record pointing to the public IPv4 address that ultimately routes to NPM. If your public address changes, use a dynamic-DNS arrangement or update the DNS record automatically. Services commonly used in home-network deployments include DuckDNS, Cloudflare, and Amazon Route 53, although the exact provider is a separate choice from NPM.
Create DNS before requesting a certificate. From an external network, verify that the hostname resolves to the expected public address. Testing only from inside your LAN can be misleading because split DNS or router hairpin behavior may produce a different result.
Forward the public ports
On the router, forward:
| Public port | Protocol | Destination | Purpose |
|---|---|---|---|
| 80 | TCP | NPM host port 80 | HTTP traffic and HTTP-01 certificate validation |
| 443 | TCP | NPM host port 443 | HTTPS traffic |
| 81 | TCP | Normally not forwarded | NPM administration |
Make sure no other service already occupies ports 80 or 443 on the Docker host. The router and host firewall must both permit the intended traffic.
When direct forwarding cannot work
Carrier-grade NAT, ISP port blocking, or an unavailable public address can prevent ordinary inbound forwarding. NPM cannot correct that network limitation. Possible architecture changes include a secure tunnel, a VPS-based relay, or DNS-01 certificate validation. These approaches add networking, DNS, and security decisions; they are alternatives to the basic home-router setup, not required NPM settings.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check AAAA records carefully. If a domain has an AAAA record pointing to an incorrect or unreachable IPv6 address, certificate validation may attempt IPv6 and fail even though IPv4 works. Correct the IPv6 route or remove the AAAA record when IPv6 is not intended to serve the domain.
5. Add a proxy host in NPM
Once DNS and routing are ready, sign in to NPM and follow this path:
- Open Hosts → Proxy Hosts.
- Select Add Proxy Host.
- Enter the public domain name, such as
app.example.com. - Choose the upstream scheme:
httporhttps. - Enter the forward hostname or IP address.
- Enter the forward port.
- Enable WebSocket support if the application requires WebSockets.
- Add an access list only when you understand its effect and have tested it.
- Save the proxy host.
For a same-host Docker application on the shared network, the forward hostname should normally be the Docker service name, not the public domain, host IP, or localhost.
Start with the simplest working route. Applications that use WebSockets, large uploads, streaming, secure cookies, absolute URLs, or root-path assumptions may require application-specific settings or advanced Nginx configuration. NPM does not make every application proxy-compatible without additional work.
6. Request a Let’s Encrypt certificate
Edit the proxy host and open its SSL tab:
- Choose Request a new SSL Certificate.
- Enter a valid email address.
- Agree to the terms.
- Save or request the certificate.
- After issuance, enable Force SSL if all intended traffic should use HTTPS.
The usual HTTP-01 challenge requires the certificate authority to retrieve a challenge from your domain over port 80. Ordinary HTTP requests can then redirect to HTTPS; keeping port 80 reachable is also useful for future HTTP-01 validation.
Rank #4
- 8 GIGABIT PORTS: Features 8 RJ45 ports supporting 10/100/1000 Mbps speeds, providing high-speed wired network connectivity for computers, printers, gaming consoles, and other Ethernet-enabled devices
- PLUG AND PLAY SETUP: No configuration required; simply connect the switch to your network devices and it is ready to use immediately, making network expansion quick and hassle-free
- FANLESS QUIET DESIGN: The fanless design ensures silent operation, making this switch suitable for noise-sensitive environments such as home offices, bedrooms, or conference rooms
- STURDY METAL CONSTRUCTION: Built with a durable metal housing and shielded ports that provide reliable performance, better heat dissipation, and protection against electromagnetic interference
- TRAFFIC OPTIMIZATION: Supports IEEE 802.3x flow control and advanced traffic optimization technology to reduce data bottlenecks and ensure smooth, efficient data transfer across your network
Certificate issuance commonly fails when:
- The DNS record points to the wrong public address.
- Port 80 is not forwarded or is blocked by the ISP.
- A different service owns port 80 or 443.
- The host or router firewall blocks inbound traffic.
- A CDN or other proxy sends the request to the wrong origin.
- An incorrect AAAA record directs validation to broken IPv6.
- The domain is not publicly reachable from the certificate authority.
If port 80 cannot be used, DNS-01 or TLS-ALPN-01 may be alternatives depending on the certificate client and provider setup. DNS-01 is also the relevant method for wildcard certificates; HTTP-01 cannot issue wildcard certificates. A DNS-01 design generally requires giving a certificate client the ability to change DNS records, so treat those credentials as sensitive.
7. Verify the complete request path
Test from a network outside your home or server LAN, such as a phone using cellular data:
- Resolve the hostname and confirm it reaches the intended public address.
- Open
http://app.example.comand confirm the expected HTTP behavior. - Open
https://app.example.comand inspect the certificate hostname and validity. - Sign in to the application and test its key functions.
- Test WebSockets, uploads, downloads, streaming, redirects, and API access if the application uses them.
A successful certificate does not prove that the application is correctly configured. Check the application’s external URL, trusted-proxy settings, secure-cookie behavior, and host-header requirements when redirects or logins behave incorrectly.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Security and maintenance
Keep the management plane private
Do not forward port 81 to the Internet merely because NPM needs to be reachable for configuration. Use local access, a VPN, an IP-restricted management path, or another controlled method. Use strong unique administrator credentials and keep the host, Docker Engine, NPM image, and upstream applications updated.
Minimize upstream exposure
For same-host containers, prefer the shared Docker network and expose rather than publishing application ports to every host interface. Direct host publishing may still be appropriate for a particular service, but it creates another access path that must be secured.
Back up persistent data
Back up both ./data and ./letsencrypt, along with the Compose file and any relevant DNS or router configuration. Backup storage is not the same as live NPM storage: an external SSD can be a practical target for configuration backups, but a drive alone is not a tested disaster-recovery plan. Perform a restoration test before you need one.
Consider power protection
An always-on reverse-proxy host benefits operationally from stable power. An optional UPS for a home-lab server can give the host time to shut down cleanly during an outage, but it does not replace backups, monitoring, or a tested recovery procedure.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Upgrade deliberately
The documented NPM upgrade procedure is:
docker compose pull
docker compose up -dNPM states that this process updates its database and other requirements automatically. Before a production upgrade, still review release notes, back up the persistent directories, and use a tested image tag rather than silently tracking latest. Pinning a version makes rollback and troubleshooting more predictable, while deliberate updates let you review changes before deployment.
Troubleshooting
The NPM dashboard does not load
- Run
docker compose psand confirm the container is running. - Review
docker compose logs -f appfor startup errors. - Confirm that port 81 is not occupied by another process and is reachable from the local network.
- Check whether the first startup is still initializing; slower hardware may take a minute or longer.
- Check the Docker host firewall and the bind address used by the port mapping.
NPM returns “502 Bad Gateway”
- Confirm that the upstream application is running.
- Verify the hostname and port in the proxy-host configuration.
- From the NPM container, verify that the upstream hostname resolves and that the port is reachable.
- For same-host containers, confirm both Compose projects are attached to the same external network.
- Use the Docker service name and internal listening port, not
localhost. - Check whether the application listens only on an unexpected interface or requires HTTPS upstream.
Let’s Encrypt certificate issuance fails
Check the public DNS record, router forwarding, host firewall, port conflicts, CDN or proxy behavior, and AAAA records. Confirm that a request to the domain on port 80 reaches NPM. HTTP-01 validation is restricted to port 80; a working local browser test does not establish that the public certificate authority can reach the challenge endpoint.
WebSockets do not work
Enable WebSocket support in the proxy-host settings. Then verify that the upstream application knows its public scheme and hostname and is configured for the expected trusted proxy. Incorrect external-URL settings commonly produce failed connections or redirects to an internal address.
Access-list authentication breaks the application’s login
NPM documents a conflict when both an NPM access list and the upstream application use the standard Authorization header. Multiple values are generally not supported, so one login layer can interfere with the other. Remove one layer of username/password authentication or redesign the application’s authentication arrangement.
Best Value
- One Switch Made to Expand Network-16× 10/100/1000Mbps RJ45 Ports supporting Auto Negotiation and Auto MDI/MDIX
- Gigabit that Saves Energy-Latest innovative energy-efficient technology greatly expands your network capacity with much less power consumption and helps save money
- Reliable and Quiet-IEEE 802.3X flow control provides reliable data transfer and Fanless design ensures quiet operation
- Plug and Play-Easy setup with no software installation or configuration needed
- Advanced Software Features-Prioritize your traffic and guarantee high quality of video or voice data transmission with Port-based 802.1p/DSCP QoS and IGMP Snooping
Choosing a Docker host
NPM can run on a small ARM64 device such as a Raspberry Pi or on an x86-64 mini PC, provided Docker and the image architecture are supported. The correct choice depends on the entire workload: number of proxied services, databases, media processing, storage, memory, network interfaces, and desired maintenance model. NPM’s suitability for a small host does not mean every application behind it has the same requirements.
For a host that will run only NPM and a few lightweight services, low-power hardware may be sufficient. If the same machine will run several databases, media servers, virtual machines, or CPU-intensive workloads, a compact x86-64 mini PC may provide more headroom. Keep the host’s operating system, Docker data, and backups in a maintainable layout.
Power and backup considerations
NPM’s persistent state and certificate material should survive container recreation because they are stored in the mounted directories. They should also survive a host failure through independent backups. Keep at least one backup separate from the live machine and periodically verify that you can restore the Compose project, data, and letsencrypt directories.
A UPS is optional and especially useful where brief outages or brownouts are common. It improves continuity only when the host is configured to detect the outage and shut down appropriately; it does not make the deployment highly available.
Frequently Asked Questions
Can Nginx Proxy Manager run without Docker?
This guide uses NPM’s supported Docker packaging and Compose deployment. NPM is designed as a Docker application, so Docker Engine with Compose or Docker Desktop is the normal installation path.
What ports must be forwarded for NPM?
Forward TCP ports 80 and 443 from the router to the NPM host for public HTTP and HTTPS traffic. Port 81 is the administration interface and should normally remain private rather than being forwarded to the Internet.
Why should I not use localhost as the forward hostname?
Inside a container, localhost refers to that container itself. If NPM and the upstream application are separate containers, attach them to a shared Docker network and use the upstream service name, such as app, with its internal listening port.
Can NPM issue a certificate if my home network uses CGNAT?
Not through ordinary port forwarding if the Internet cannot reach your network. You may need a tunnel or VPS-based relay, or a DNS-01 certificate arrangement. Those options change the network architecture and add their own security and operational requirements.
Recommended Free Tools
Should I use SQLite or an external database?
Use the bundled SQLite database for a first installation and many small deployments. Choose MySQL/MariaDB or PostgreSQL when you have a concrete operational reason, such as an existing managed database platform or a deliberate separation of application and database lifecycles.
The Bottom Line
NPM is easiest to deploy when the network path is established first: Docker is working, DNS points to the correct public address, ports 80 and 443 reach NPM, and the upstream service is reachable by its correct hostname and port. Create the proxy host, issue the certificate, keep port 81 private, persist and back up NPM’s data, and test the application from outside the LAN.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
