How To Configure Nginx as a Reverse Proxy on Ubuntu 24.04

Setting up Nginx as a reverse proxy on Ubuntu 24.04 is easy. This guide shows you how to do it step by step. A reverse proxy helps your website handle more traffic and work faster.

What is a Reverse Proxy

A reverse proxy sits between users and your web servers. When someone visits your website, they connect to the reverse proxy first. The proxy then sends their request to your actual web server.

This is different from a regular proxy. A regular proxy hides your identity when you browse websites. A reverse proxy hides your servers from visitors.

The reverse proxy can send requests to different servers. This helps spread the work across multiple machines.

Why Use Nginx Reverse Proxy

Nginx reverse proxy solves many website problems:

Better Performance: Nginx handles static files like images and CSS faster than most web applications. Your main server can focus on running your application code.

More Traffic: Instead of one server handling all visitors, you can use multiple servers. The reverse proxy spreads visitors across all your servers.

Better Security: Your real servers stay hidden behind the proxy. Attackers cannot directly reach your application servers.

Easy Updates: You can update servers one at a time without taking your website offline. Visitors keep using your site while you work on servers.

SSL Management: The proxy handles all SSL certificates and encryption. Your backend servers do not need to worry about HTTPS.

What You Need

Before starting, make sure you have:

• Ubuntu 24.04 server with internet access
• At least 1GB RAM and 10GB disk space
• Root access or sudo privileges
• Basic command line knowledge

If you want to use a domain name, point your DNS to your server IP address. You can also test everything with just IP addresses.

Installing Nginx

First, update your system packages:

sudo apt update
sudo apt upgrade -y

Install Nginx and helpful tools:

sudo apt install nginx curl -y

Start Nginx service:

sudo systemctl start nginx
sudo systemctl enable nginx

Check if Nginx is running:

sudo systemctl status nginx

You should see “active (running)” in the output.

Test your installation by opening your server IP in a web browser. You should see the Nginx welcome page.

Find your server IP with:

curl -4 icanhazip.com

Understanding Nginx Configuration

Nginx stores its configuration files in specific folders:

• Main config: /etc/nginx/nginx.conf
• Website configs: /etc/nginx/sites-available/
• Active sites: /etc/nginx/sites-enabled/

The sites-available folder contains configuration files for each website. The sites-enabled folder contains links to active configurations.

Always backup your configuration before making changes:

sudo cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.backup

Test configuration changes before applying them:

sudo nginx -t

This command checks for errors in your configuration files.

Basic Reverse Proxy Setup

Remove the default Nginx site:

sudo rm /etc/nginx/sites-enabled/default

Create a new configuration file:

sudo nano /etc/nginx/sites-available/reverse-proxy

Add this basic configuration:

server {
    listen 80;
    server_name your-domain.com;


    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Replace your-domain.com with your actual domain name. Change 3000 to the port where your application runs.

This configuration tells Nginx to:

• Listen on port 80 for HTTP requests
• Send all requests to your application on port 3000
• Pass important information to your backend server

Enable your new configuration:

sudo ln -s /etc/nginx/sites-available/reverse-proxy /etc/nginx/sites-enabled/

Test and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

Your reverse proxy is now working. All requests to your domain go through Nginx to your application.

Load Balancing Multiple Servers

If you have multiple backend servers, you can balance traffic between them. This setup uses an upstream block:

upstream backend_servers {
    server 192.168.1.10:3000;
    server 192.168.1.11:3000;
    server 192.168.1.12:3000;
}

server {
    listen 80;
    server_name your-domain.com;


    location / {
        proxy_pass http://backend_servers;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Replace the IP addresses with your actual server IPs. Nginx automatically distributes requests across all three servers.

You can give different weights to servers:

upstream backend_servers {
    server 192.168.1.10:3000 weight=3;
    server 192.168.1.11:3000 weight=2;
    server 192.168.1.12:3000 weight=1;
}

The first server gets three times more requests than the third server.

Adding SSL Security

Install Certbot to get free SSL certificates:

sudo apt install snapd
sudo snap install --classic certbot

Create a link to use certbot command:

sudo ln -s /snap/bin/certbot /usr/bin/certbot

Get SSL certificate for your domain:

sudo certbot --nginx -d your-domain.com

Follow the prompts to complete certificate installation. Certbot automatically updates your Nginx configuration to use HTTPS.

Your configuration now looks like this:

server {
    listen 443 ssl http2;
    server_name your-domain.com;


    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;


    location / {
        proxy_pass http://backend_servers;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Certbot also creates automatic certificate renewal.

Basic Security Settings

Add security headers to protect your website:

server {
    listen 443 ssl http2;
    server_name your-domain.com;


    # Hide server version
    server_tokens off;


    # Security headers
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";


    location / {
        proxy_pass http://backend_servers;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Add rate limiting to prevent abuse:

# Add this to the main nginx.conf file
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;


# Add this to your server block
location /api/ {
    limit_req zone=api burst=20 nodelay;
    proxy_pass http://backend_servers;
}

This allows 10 requests per second with bursts up to 20 requests.

Performance Improvements

Enable gzip compression to make your website faster:

Add this to /etc/nginx/nginx.conf inside the http block:

gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_comp_level 6;
gzip_types
    text/plain
    text/css
    text/javascript
    application/javascript
    application/json;

Add buffer settings for better performance:

location / {
    proxy_pass http://backend_servers;
    proxy_buffering on;
    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;
}

Testing Your Setup

Test if your reverse proxy works:

curl -I http://your-domain.com
curl -I https://your-domain.com

Both commands should return successful responses.

Check if your backend server is running:

curl http://localhost:3000

Monitor Nginx access logs:

sudo tail -f /var/log/nginx/access.log

Check for errors:

sudo tail -f /var/log/nginx/error.log

Common Problems and Solutions

Connection Refused Error: Your backend application is not running. Check if your application is running on the correct port:

sudo netstat -tlnp | grep :3000

Timeout Errors: Your backend takes too long to respond. Increase timeout values:

location / {
    proxy_pass http://backend_servers;
    proxy_connect_timeout 60s;
    proxy_send_timeout 60s;
    proxy_read_timeout 60s;
}

SSL Certificate Issues: Check certificate status and renew if needed:

sudo certbot certificates
sudo certbot renew --dry-run

Permission Denied: Make sure Nginx has permission to access files:

sudo chown -R www-data:www-data /var/www/

Different Applications Setup

You can route different paths to different applications:

server {
    listen 80;
    server_name your-domain.com;


    # Main website
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }


    # API requests
    location /api/ {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }


    # Admin panel
    location /admin/ {
        proxy_pass http://127.0.0.1:9000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

This sends different requests to different backend applications based on the URL path.

Monitoring and Maintenance

Check Nginx status regularly:

sudo systemctl status nginx

View most requested pages:

sudo awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -10

Check which IPs make the most requests:

sudo awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -10

Reload configuration without downtime:

sudo nginx -t && sudo systemctl reload nginx

Update Nginx to the latest version:

sudo apt update && sudo apt upgrade nginx

Backup Your Configuration

Create a simple backup script:

#!/bin/bash
DATE=$(date +%Y%m%d)
sudo cp -r /etc/nginx/ /backup/nginx-$DATE/

Save this as backup-nginx.sh and run it before making major changes.

Conclusion

You now have a working Nginx reverse proxy on Ubuntu 24.04. This setup improves your website performance, security, and ability to handle traffic.

Key points to remember:

• Always test configuration changes before applying them
• Monitor your logs regularly for issues
• Keep SSL certificates updated automatically
• Use load balancing when you have multiple servers
• Add security headers to protect your website

Your reverse proxy can now handle more visitors, distribute load across servers, and provide better security for your applications. Start with this basic setup and add more features as your website grows.