Nginx as Reverse Proxy

Nginx is one of the most powerful and widely-used reverse proxy servers in modern web infrastructure. As a reverse proxy, Nginx sits between client requests and backend servers, forwarding requests and responses while providing load balancing, SSL termination, caching, and security features. This comprehensive guide will teach you how to configure Nginx as a reverse proxy, enabling you to build scalable, secure, and high-performance web applications.

Whether you're running microservices, containerized applications, Node.js servers, or traditional web applications, implementing Nginx as a reverse proxy provides critical benefits including improved security, enhanced performance through caching, simplified SSL management, and seamless load distribution across multiple backend servers. Understanding reverse proxy configuration is essential knowledge for any system administrator or DevOps engineer managing modern web infrastructure.

Prerequisites
Understanding Reverse Proxy
Basic Reverse Proxy Configuration
Advanced Proxy Features
Load Balancing with Reverse Proxy
SSL/TLS Termination
Caching Configuration
Security Headers and Protection
Verification and Testing
Troubleshooting
Best Practices
Conclusion

Prerequisites

Before configuring Nginx as a reverse proxy, ensure you have:

Operating System: Ubuntu 20.04/22.04, Debian 10/11, CentOS 8/Rocky Linux 8, or similar
Nginx Version: 1.18.0 or later (latest stable version recommended)
Backend Application: Running web application or service to proxy to
Root or sudo access: Required for installing and configuring Nginx
Basic networking knowledge: Understanding of HTTP, ports, and IP addresses
Domain name: Configured DNS pointing to your server (for production use)
Backup: Current backup of existing Nginx configuration files

Understanding Reverse Proxy

What is a Reverse Proxy?

A reverse proxy is a server that sits in front of backend servers and forwards client requests to those servers. Unlike a forward proxy that acts on behalf of clients, a reverse proxy acts on behalf of servers.

Key characteristics:

Clients connect to the reverse proxy, not directly to backend servers
The reverse proxy forwards requests to appropriate backend servers
Responses are sent back through the reverse proxy to clients
Backend servers remain invisible to clients

Benefits of Using Nginx as Reverse Proxy

Security Enhancement:

Hides backend server architecture and IP addresses
Single point for SSL/TLS termination
Protection against DDoS attacks through rate limiting
Centralized security policy enforcement

Performance Optimization:

Content caching reduces backend load
Connection pooling and keep-alive optimization
Compression of responses
Static content serving

Scalability:

Load balancing across multiple backend servers
Easy addition or removal of backend servers
Zero-downtime deployments
Health checks for backend availability

Simplified Management:

Single entry point for multiple applications
Centralized logging and monitoring
Unified SSL certificate management
Simplified firewall rules

Common Use Cases

Microservices Architecture: Route requests to different services based on URL paths
Node.js Applications: Handle static content and proxy dynamic requests
Docker Containers: Access containerized applications through unified entry point
API Gateway: Centralized entry point for multiple APIs
Legacy Application Migration: Gradually migrate from old to new systems

Basic Reverse Proxy Configuration

Installing Nginx

First, ensure Nginx is installed on your system.

For Ubuntu/Debian:

# Update package index
sudo apt update

# Install Nginx
sudo apt install nginx -y

# Start and enable Nginx
sudo systemctl start nginx
sudo systemctl enable nginx

# Verify installation
nginx -v

For CentOS/Rocky Linux:

# Install Nginx from EPEL repository
sudo dnf install epel-release -y
sudo dnf install nginx -y

# Start and enable Nginx
sudo systemctl start nginx
sudo systemctl enable nginx

# Verify installation
nginx -v

Simple Reverse Proxy Configuration

Create a basic reverse proxy configuration for a single backend server.

Create a new configuration file:

# Ubuntu/Debian
sudo nano /etc/nginx/sites-available/reverse-proxy

# CentOS/Rocky Linux
sudo nano /etc/nginx/conf.d/reverse-proxy.conf

Add the following configuration:

# Simple reverse proxy configuration
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    # Access and error logs
    access_log /var/log/nginx/reverse-proxy-access.log;
    error_log /var/log/nginx/reverse-proxy-error.log;

    # Reverse proxy to backend server
    location / {
        # Backend server address
        proxy_pass http://localhost:3000;

        # Preserve original host header
        proxy_set_header Host $host;

        # Forward client IP address
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Protocol forwarding
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Enable the configuration (Ubuntu/Debian only):

# Create symbolic link to enable site
sudo ln -s /etc/nginx/sites-available/reverse-proxy /etc/nginx/sites-enabled/

# Test configuration
sudo nginx -t

# Reload Nginx
sudo systemctl reload nginx

For CentOS/Rocky Linux, the configuration is automatically included:

# Test configuration
sudo nginx -t

# Reload Nginx
sudo systemctl reload nginx

Proxying to Different Backend Servers

Configure multiple backend services with different URL paths:

server {
    listen 80;
    server_name example.com;

    # Proxy to Node.js application
    location /api/ {
        proxy_pass http://localhost:3000/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # Proxy to Python application
    location /admin/ {
        proxy_pass http://localhost:8000/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    # Serve static content directly
    location /static/ {
        alias /var/www/static/;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    # Default location for frontend application
    location / {
        proxy_pass http://localhost:4200;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Upstream Configuration

Define backend servers using upstream blocks for better control:

# Define upstream backend servers
upstream backend_app {
    server localhost:3000;
}

upstream api_backend {
    server localhost:8000;
}

server {
    listen 80;
    server_name example.com;

    # Proxy to backend application
    location / {
        proxy_pass http://backend_app;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Proxy to API backend
    location /api/ {
        proxy_pass http://api_backend/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Advanced Proxy Features

Timeouts and Buffer Configuration

Configure timeouts and buffers for optimal performance:

upstream backend {
    server localhost:3000;
}

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://backend;

        # Timeout settings
        proxy_connect_timeout 60s;      # Connection timeout to backend
        proxy_send_timeout 60s;         # Timeout for sending request
        proxy_read_timeout 60s;         # Timeout for reading response

        # Buffer settings
        proxy_buffering on;             # Enable buffering
        proxy_buffer_size 4k;           # Buffer for response headers
        proxy_buffers 8 4k;             # Number and size of buffers
        proxy_busy_buffers_size 8k;     # Busy buffers size

        # Request body settings
        client_max_body_size 10M;       # Max upload size
        client_body_buffer_size 128k;   # Buffer for request body

        # Headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

WebSocket Support

Enable WebSocket connections through the reverse proxy:

# WebSocket-enabled reverse proxy
upstream websocket_backend {
    server localhost:3000;
}

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    listen 80;
    server_name example.com;

    # WebSocket location
    location /ws {
        proxy_pass http://websocket_backend;

        # WebSocket headers
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        # Standard proxy headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Timeouts for long-lived connections
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }

    # Regular HTTP traffic
    location / {
        proxy_pass http://websocket_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Custom Headers and Response Modification

Add or modify headers in proxied responses:

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://localhost:3000;

        # Standard proxy headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Custom request headers
        proxy_set_header X-Custom-Header "custom-value";
        proxy_set_header X-Request-ID $request_id;

        # Hide backend headers
        proxy_hide_header X-Powered-By;
        proxy_hide_header Server;

        # Add security headers to response
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;

        # CORS headers (if needed)
        add_header Access-Control-Allow-Origin "*" always;
        add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;

        # Handle OPTIONS requests for CORS
        if ($request_method = OPTIONS) {
            return 204;
        }
    }
}

Load Balancing with Reverse Proxy

Round-Robin Load Balancing

Distribute requests evenly across multiple backend servers:

# Define backend servers
upstream backend_cluster {
    # Round-robin by default
    server 192.168.1.10:3000;
    server 192.168.1.11:3000;
    server 192.168.1.12:3000;
}

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://backend_cluster;

        # Proxy headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Enable keep-alive connections to backend
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }
}

Load Balancing Methods

Configure different load balancing algorithms:

# Least connections method
upstream backend_least_conn {
    least_conn;  # Send to server with fewest active connections

    server 192.168.1.10:3000;
    server 192.168.1.11:3000;
    server 192.168.1.12:3000;
}

# IP hash method (session persistence)
upstream backend_ip_hash {
    ip_hash;  # Same client IP always goes to same server

    server 192.168.1.10:3000;
    server 192.168.1.11:3000;
    server 192.168.1.12:3000;
}

# Weighted load balancing
upstream backend_weighted {
    server 192.168.1.10:3000 weight=3;  # Gets 3x more requests
    server 192.168.1.11:3000 weight=2;  # Gets 2x more requests
    server 192.168.1.12:3000 weight=1;  # Gets 1x requests (default)
}

# Server with health checks and failover
upstream backend_advanced {
    server 192.168.1.10:3000 max_fails=3 fail_timeout=30s;
    server 192.168.1.11:3000 max_fails=3 fail_timeout=30s;
    server 192.168.1.12:3000 backup;  # Only used if others fail
}

server {
    listen 80;
    server_name example.com;

    location / {
        # Use desired upstream
        proxy_pass http://backend_least_conn;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Session Persistence

Ensure user sessions stick to the same backend server:

# Method 1: IP Hash
upstream backend_sticky {
    ip_hash;
    server 192.168.1.10:3000;
    server 192.168.1.11:3000;
}

# Method 2: Cookie-based (requires commercial Nginx Plus or third-party module)
# For open-source Nginx, use ip_hash or external session storage (Redis)

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://backend_sticky;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;

        # Add backend server info to response header (for debugging)
        add_header X-Upstream-Server $upstream_addr always;
    }
}

SSL/TLS Termination

SSL Termination at Reverse Proxy

Handle SSL/TLS at the proxy level, forwarding plain HTTP to backend:

upstream backend {
    server localhost:3000;
}

# HTTP to HTTPS redirect
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    return 301 https://$server_name$request_uri;
}

# HTTPS server with SSL termination
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    # SSL certificates
    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;

    # Modern SSL configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;

    # SSL optimization
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    # Security headers
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;

    # Proxy to backend (HTTP)
    location / {
        proxy_pass http://backend;

        # Forward client information
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
    }
}

Caching Configuration

Basic Proxy Caching

Enable caching to improve performance and reduce backend load:

# Define cache path and settings
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=1g inactive=60m use_temp_path=off;

upstream backend {
    server localhost:3000;
}

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://backend;

        # Enable caching
        proxy_cache my_cache;
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
        proxy_cache_background_update on;
        proxy_cache_lock on;

        # Cache duration based on response code
        proxy_cache_valid 200 302 10m;
        proxy_cache_valid 404 1m;

        # Cache key
        proxy_cache_key "$scheme$request_method$host$request_uri";

        # Add cache status to response header
        add_header X-Cache-Status $upstream_cache_status;

        # Standard proxy headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # Don't cache API endpoints
    location /api/ {
        proxy_pass http://backend;
        proxy_cache off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Advanced Caching with Bypass

Implement cache bypass and selective caching:

# Cache configuration
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=content_cache:20m max_size=2g inactive=120m;

# Define when to bypass cache
map $request_method $skip_cache {
    default 0;
    POST 1;
    PUT 1;
    DELETE 1;
}

map $request_uri $skip_cache_uri {
    default 0;
    ~*/admin/ 1;
    ~*/checkout/ 1;
}

upstream backend {
    server localhost:3000;
}

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://backend;

        # Caching configuration
        proxy_cache content_cache;
        proxy_cache_bypass $skip_cache $skip_cache_uri;
        proxy_no_cache $skip_cache $skip_cache_uri;

        # Cache settings
        proxy_cache_valid 200 10m;
        proxy_cache_valid 404 1m;
        proxy_cache_use_stale error timeout updating;
        proxy_cache_lock on;
        proxy_cache_lock_timeout 5s;

        # Cache based on response headers
        proxy_cache_valid any 1m;
        proxy_ignore_headers Cache-Control Expires;

        # Add debug headers
        add_header X-Cache-Status $upstream_cache_status;
        add_header X-Cache-Key "$scheme$request_method$host$request_uri";

        # Proxy headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Create cache directory:

# Create cache directory
sudo mkdir -p /var/cache/nginx

# Set appropriate permissions
sudo chown -R www-data:www-data /var/cache/nginx  # Ubuntu/Debian
# sudo chown -R nginx:nginx /var/cache/nginx      # CentOS/Rocky

# Test configuration
sudo nginx -t

# Reload Nginx
sudo systemctl reload nginx

Security Headers and Protection

Comprehensive Security Configuration

Implement security headers and protection mechanisms:

upstream backend {
    server localhost:3000;
}

# Rate limiting zones
limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=api:10m rate=100r/s;

# Connection limiting
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;

server {
    listen 443 ssl http2;
    server_name example.com;

    # SSL configuration
    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Security headers
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

    # Hide Nginx version
    server_tokens off;

    # Deny access to hidden files
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }

    # Main application with rate limiting
    location / {
        # Apply rate limiting
        limit_req zone=general burst=20 nodelay;
        limit_conn conn_limit 10;

        proxy_pass http://backend;

        # Security-focused proxy headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Hide backend headers
        proxy_hide_header X-Powered-By;
        proxy_hide_header Server;
    }

    # API endpoint with different rate limits
    location /api/ {
        limit_req zone=api burst=50 nodelay;

        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Verification and Testing

Basic Functionality Testing

Verify the reverse proxy is working correctly:

# Test from local machine
curl -I http://example.com

# Should show Nginx handling the request

# Check if backend is receiving requests
curl -v http://example.com

# Verify headers are being forwarded
curl -H "X-Custom-Header: test" http://example.com

Load Balancing Verification

Test load balancing across multiple backends:

# Add debug header to backend response to identify server
# Then make multiple requests

for i in {1..10}; do
    curl -s http://example.com | grep "Server-ID"
done

# Should show different backend servers responding

SSL/TLS Verification

Test SSL termination:

# Test SSL certificate
openssl s_client -connect example.com:443 -servername example.com

# Check SSL rating
# Use SSL Labs: https://www.ssllabs.com/ssltest/

# Verify HTTPS redirect
curl -I http://example.com
# Should show 301 redirect to HTTPS

Cache Testing

Verify caching is working:

# First request (cache MISS)
curl -I http://example.com
# Look for: X-Cache-Status: MISS

# Second request (cache HIT)
curl -I http://example.com
# Look for: X-Cache-Status: HIT

# Clear cache
sudo rm -rf /var/cache/nginx/*
sudo systemctl reload nginx

Performance Testing

Benchmark reverse proxy performance:

# Install Apache Bench
sudo apt install apache2-utils

# Test performance
ab -n 1000 -c 10 http://example.com/

# Test with keep-alive
ab -n 1000 -c 10 -k http://example.com/

# Compare with direct backend access
ab -n 1000 -c 10 http://localhost:3000/

Troubleshooting

Backend Connection Issues

Issue: Nginx cannot connect to backend server

Solution:

# Verify backend is running
sudo netstat -tlnp | grep 3000
# or
sudo ss -tlnp | grep 3000

# Check SELinux (if applicable)
sudo getsebool httpd_can_network_connect
# If off, enable it:
sudo setsebool -P httpd_can_network_connect 1

# Test backend directly
curl http://localhost:3000

# Check Nginx error logs
sudo tail -f /var/log/nginx/error.log

502 Bad Gateway Error

Issue: 502 Bad Gateway response

Causes and solutions:

# 1. Backend server is down
sudo systemctl status your-app

# 2. Incorrect proxy_pass address
# Verify in configuration:
sudo nginx -T | grep proxy_pass

# 3. Firewall blocking connection
sudo iptables -L | grep 3000
sudo firewall-cmd --list-all

# 4. Timeout too short
# Increase timeouts in nginx config:
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;

# 5. Check error logs
sudo tail -50 /var/log/nginx/error.log

504 Gateway Timeout

Issue: Request times out

Solution:

# Increase timeout values
location / {
    proxy_pass http://backend;

    # Increase all timeouts
    proxy_connect_timeout 120s;
    proxy_send_timeout 120s;
    proxy_read_timeout 120s;

    # For long-running requests
    proxy_buffering off;
}

WebSocket Connection Failing

Issue: WebSocket connections not working

Solution:

# Ensure WebSocket headers are set
location /ws {
    proxy_pass http://backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    # Increase timeout for long-lived connections
    proxy_read_timeout 3600s;
    proxy_send_timeout 3600s;
}

# Test WebSocket connection
# Install wscat: npm install -g wscat
wscat -c ws://example.com/ws

Performance Issues

Issue: Slow response times through reverse proxy

Solutions:

# Enable buffering and keep-alive
location / {
    proxy_pass http://backend;

    # Enable buffering
    proxy_buffering on;
    proxy_buffer_size 4k;
    proxy_buffers 8 4k;

    # Enable keep-alive to backend
    proxy_http_version 1.1;
    proxy_set_header Connection "";

    # Enable caching
    proxy_cache my_cache;
    proxy_cache_use_stale updating;
}

# Monitor Nginx performance
# Install nginx-module-vts or use built-in stub_status

# Check connection states
sudo netstat -an | grep :80 | wc -l

# Monitor access logs for slow requests
sudo tail -f /var/log/nginx/access.log

Best Practices

Configuration Organization

Use separate configuration files:

# Organize by application
/etc/nginx/conf.d/
├── app1.conf
├── app2.conf
└── api.conf

Use includes for common settings:

# /etc/nginx/snippets/proxy-params.conf
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

# Include in server blocks
include snippets/proxy-params.conf;

Security Hardening

Implement rate limiting:

limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
limit_req zone=general burst=20 nodelay;

Hide server information:

server_tokens off;
proxy_hide_header X-Powered-By;

Use security headers:

add_header Strict-Transport-Security "max-age=63072000" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;

Performance Optimization

Enable connection pooling:

upstream backend {
    server localhost:3000;
    keepalive 32;
}

location / {
    proxy_pass http://backend;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
}

Implement caching strategically:

Cache static content aggressively
Cache API responses selectively
Bypass cache for user-specific content

Use HTTP/2:

listen 443 ssl http2;

Monitoring and Logging

Structured logging:

log_format custom '$remote_addr - $remote_user [$time_local] '
                  '"$request" $status $body_bytes_sent '
                  '"$http_referer" "$http_user_agent" '
                  'upstream: $upstream_addr '
                  'upstream_status: $upstream_status '
                  'request_time: $request_time '
                  'upstream_response_time: $upstream_response_time';

access_log /var/log/nginx/access.log custom;

Monitor key metrics:

Response times
Error rates
Cache hit ratios
Backend health

High Availability

Multiple backend servers:

upstream backend {
    least_conn;
    server backend1.example.com:3000 max_fails=3 fail_timeout=30s;
    server backend2.example.com:3000 max_fails=3 fail_timeout=30s;
    server backend3.example.com:3000 backup;
}

Health checks (Nginx Plus or use workarounds):

upstream backend {
    server backend1.example.com:3000 max_fails=2 fail_timeout=10s;
    server backend2.example.com:3000 max_fails=2 fail_timeout=10s;
}

Conclusion

Nginx as a reverse proxy is an essential component of modern web infrastructure, providing load balancing, SSL termination, caching, and security features that improve application performance and reliability. By properly configuring Nginx as a reverse proxy, you create a robust, scalable architecture that can handle high traffic loads while protecting backend servers from direct exposure.

Key takeaways from this guide:

Reverse proxy basics: Forward client requests to backend servers while adding value
Load balancing: Distribute traffic across multiple backends for scalability
SSL termination: Centralize SSL/TLS management at the proxy layer
Caching: Reduce backend load and improve response times
Security: Implement rate limiting, security headers, and protection mechanisms
Monitoring: Track performance and troubleshoot issues effectively

Nginx's flexibility and performance make it the preferred choice for reverse proxy deployments, whether you're running microservices, containerized applications, or traditional web stacks. Combined with proper monitoring, security hardening, and performance optimization, Nginx reverse proxy configuration forms the foundation of reliable, high-performance web infrastructure.

Continue learning by exploring advanced topics like Nginx Plus features, integration with service meshes, advanced caching strategies, and dynamic upstream configuration for even more sophisticated deployments. Regular testing, monitoring, and optimization ensure your reverse proxy continues to meet the evolving demands of your applications and users.

Nginx as Reverse Proxy

Nginx as Reverse Proxy

Table of Contents

Prerequisites

Understanding Reverse Proxy

What is a Reverse Proxy?

Benefits of Using Nginx as Reverse Proxy

Common Use Cases

Basic Reverse Proxy Configuration

Installing Nginx

Simple Reverse Proxy Configuration

Proxying to Different Backend Servers

Upstream Configuration

Advanced Proxy Features

Timeouts and Buffer Configuration

WebSocket Support

Custom Headers and Response Modification

Load Balancing with Reverse Proxy

Round-Robin Load Balancing

Load Balancing Methods

Session Persistence

SSL/TLS Termination

SSL Termination at Reverse Proxy

Caching Configuration

Basic Proxy Caching

Advanced Caching with Bypass

Security Headers and Protection

Comprehensive Security Configuration

Verification and Testing

Basic Functionality Testing

Load Balancing Verification

SSL/TLS Verification

Cache Testing

Performance Testing

Troubleshooting

Backend Connection Issues

502 Bad Gateway Error

504 Gateway Timeout

WebSocket Connection Failing

Performance Issues

Best Practices

Configuration Organization

Security Hardening

Performance Optimization

Monitoring and Logging

High Availability

Conclusion

Latest Video

Get $20 Free Credit