Nginx Reverse Proxy with
HTTPS Setup (Ubuntu)
Nginx Reverse Proxy with HTTPS Setup
(Ubuntu)
System Overview
Role IP Address Description
Nginx Reverse Proxy [Link] Routes incoming traffic, handles HTTPS
Web Server 1 [Link] Hosts backend site 1
Web Server 2 [Link] Hosts backend site 2
1. Update All Servers
On all servers (Proxy, Web Server 1, Web Server 2):
sudo apt update -y && sudo apt upgrade -y
sudo apt install curl net-tools -y
Nginx Reverse Proxy with HTTPS Setup (Ubuntu) 1
2. Configure Backend Web Servers
Web Server 1 ([Link])
sudo apt install nginx -y
sudo systemctl enable nginx
sudo systemctl start nginx
echo "<h1>Welcome to Web Server 1 ([Link])</h1>" | sudo tee /var/www/h
tml/[Link]
Web Server 2 ([Link])
sudo apt install nginx -y
sudo systemctl enable nginx
sudo systemctl start nginx
echo "<h1>Welcome to Web Server 2 ([Link])</h1>" | sudo tee /var/www/
html/[Link]
Test both servers:
curl <[Link]
Should display respective welcome messages.
3. Set Up Nginx Reverse Proxy ([Link])
sudo apt install nginx -y
sudo systemctl enable nginx
sudo systemctl start nginx
sudo rm /etc/nginx/sites-enabled/default
4. Configure HTTPS for Reverse Proxy
Nginx Reverse Proxy with HTTPS Setup (Ubuntu) 2
Choose one option:
Option A: Let’s Encrypt (public domains)
Option B: Self-signed SSL (local/lab testing)
Option A: Let’s Encrypt (Public Domains)
Step 1: Install Certbot
sudo apt install certbot python3-certbot-nginx -y
Step 2: Create Nginx Configs
File: /etc/nginx/sites-available/[Link]
server {
listen 80;
server_name [Link];
location / {
proxy_pass <[Link]
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
File: /etc/nginx/sites-available/[Link]
server {
listen 80;
server_name [Link];
location / {
proxy_pass <[Link]
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
Nginx Reverse Proxy with HTTPS Setup (Ubuntu) 3
}
}
Enable configs:
sudo ln -s /etc/nginx/sites-available/[Link] /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/[Link] /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl restart nginx
Step 3: Obtain SSL Certificates
sudo certbot --nginx
Follow prompts for [Link] and [Link] .
Step 4: Enable Auto-Renewal
sudo systemctl enable [Link]
sudo systemctl start [Link]
sudo certbot renew --dry-run
Step 5: Verify
Visit:
[Link]
[Link]
Should show web server pages with a valid SSL padlock.
Option B: Self-Signed SSL (Local/Lab Use)
Step 1: Create Self-Signed Certificate
Nginx Reverse Proxy with HTTPS Setup (Ubuntu) 4
sudo mkdir -p /etc/nginx/ssl
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ngi
nx/ssl/[Link] -out /etc/nginx/ssl/[Link]
Step 2: Configure HTTPS Reverse Proxy
File: /etc/nginx/sites-available/[Link]
server {
listen 443 ssl;
server_name [Link];
ssl_certificate /etc/nginx/ssl/[Link];
ssl_certificate_key /etc/nginx/ssl/[Link];
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
proxy_pass [Link]
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
server {
listen 80;
server_name [Link];
return 301 [Link]
}
File: /etc/nginx/sites-available/[Link]
server {
listen 443 ssl;
server_name [Link];
Nginx Reverse Proxy with HTTPS Setup (Ubuntu) 5
ssl_certificate /etc/nginx/ssl/[Link];
ssl_certificate_key /etc/nginx/ssl/[Link];
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
location / {
proxy_pass [Link]
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
server {
listen 80;
server_name [Link];
return 301 [Link]
}
Enable and reload:
sudo nginx -t
sudo systemctl restart nginx
Step 3: Add Local DNS Entries (Client-Side)
Edit /etc/hosts :
[Link] [Link]
[Link] [Link]
Step 4: Test
curl -k <[Link]
curl -k <[Link]
Nginx Reverse Proxy with HTTPS Setup (Ubuntu) 6
Should display respective welcome messages.
Browsers may show a self-signed certificate warning (normal for labs).
5. Security Hardening (Optional)
Add to each HTTPS server block:
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
Final Setup Summary
Component Function
[Link] Nginx Reverse Proxy (HTTPS)
[Link] Backend Web Server 1 (HTTP)
[Link] Backend Web Server 2 (HTTP)
SSL Type Let’s Encrypt (public) or Self-signed (local)
Traffic Flow Client → HTTPS (Proxy) → HTTP (Backends)s
Nginx Reverse Proxy with HTTPS Setup (Ubuntu) 7