Nginx Proxy Manager Setup: Web-Based Reverse Proxy

Nginx Proxy Manager Setup: Web-Based Reverse Proxy

Nginx Proxy Manager (NPM) is an open-source tool that allows you to manage Nginx reverse proxy through a user-friendly web interface. You can handle SSL certificate management, proxy host configuration, and access control without needing the command line.

What is Nginx Proxy Manager?

Key features of Nginx Proxy Manager:

• Web Interface: Easy-to-use management panel
• Automatic SSL Renewal: Free SSL with Let's Encrypt integration
• Proxy Hosts: Reverse proxy configuration
• Redirection Hosts: URL redirections
• Stream Hosts: TCP/UDP port forwarding
• Access Lists: IP and user-based access control
• Custom Locations: Custom Nginx location blocks
• 404 Hosts: Custom 404 pages

Docker Installation

Docker Compose Configuration

# docker-compose.yml
version: '3.8'
services:
  npm:
    image: 'jc21/nginx-proxy-manager:latest'
    container_name: nginx-proxy-manager
    restart: unless-stopped
    ports:
      - '80:80'      # HTTP
      - '443:443'    # HTTPS
      - '81:81'      # Admin Panel
    volumes:
      - npm_data:/data
      - npm_letsencrypt:/etc/letsencrypt
    environment:
      - TZ=Europe/Istanbul

volumes:
  npm_data:
  npm_letsencrypt:

# Start installation
docker compose up -d

# Check container status
docker ps | grep nginx-proxy-manager

First Login

Access the admin panel after installation:

http://SERVER_IP:81

Default credentials:
Email:    admin@example.com
Password: changeme

You will be prompted to change your password and email on first login.

Adding Proxy Hosts

Basic Proxy Host

To put a web application behind a reverse proxy:

1. Proxy Hosts → Add Proxy Host
2. Domain Names: app.example.com
3. Scheme: http
4. Forward Hostname / IP: 192.168.1.10 (or container name)
5. Forward Port: 3000
6. Block Common Exploits: Enable
7. Websockets Support: Enable for WebSocket applications

Adding SSL Certificate

In the SSL tab when creating a proxy host:

1. SSL Certificate: Request a new SSL Certificate
2. Force SSL: Enable (HTTP → HTTPS redirect)
3. HTTP/2 Support: Enable
4. HSTS Enabled: Enable
5. Email Address: Email for SSL notifications
6. I Agree: Accept Let's Encrypt terms
7. Save

The SSL certificate will be automatically obtained and renewed.

Proxy with Docker Network

Use the same network to proxy Docker containers:

# docker-compose.yml
version: '3.8'
services:
  npm:
    image: 'jc21/nginx-proxy-manager:latest'
    container_name: nginx-proxy-manager
    restart: unless-stopped
    ports:
      - '80:80'
      - '443:443'
      - '81:81'
    volumes:
      - npm_data:/data
      - npm_letsencrypt:/etc/letsencrypt
    networks:
      - proxy_network

  webapp:
    image: your-webapp:latest
    container_name: webapp
    restart: unless-stopped
    expose:
      - "3000"
    networks:
      - proxy_network

networks:
  proxy_network:
    driver: bridge

volumes:
  npm_data:
  npm_letsencrypt:

Use the container name as Forward Hostname in the proxy host:

• webapp → webapp:3000

Access Lists

Restrict access to specific IPs or users:

IP-Based Access Control

1. Access Lists → Add Access List
2. Name: Admin Only
3. Satisfy Any: Any condition is sufficient

In the Access tab:

Allow: 192.168.1.0/24
Allow: 10.0.0.0/8
Deny: all

HTTP Basic Authentication

In the Authorization tab:

Username: admin
Password: StrongPassword123!

Assign the access list to a proxy host: Proxy Host → Edit → Access List → Select Admin Only.

Redirection Host

To create URL redirections:

1. Redirection Hosts → Add Redirection Host
2. Domain Names: old.example.com
3. Scheme: https
4. Forward Domain: new.example.com
5. HTTP Code: 301 (Permanent redirect)
6. Preserve Path: Keep URL path

Stream Host (TCP/UDP Proxy)

To forward TCP or UDP ports:

1. Streams → Add Stream
2. Incoming Port: 25565 (e.g., Minecraft)
3. Forward Host: 192.168.1.50
4. Forward Port: 25565
5. TCP Forwarding: Enable

Example use cases:

• Minecraft server: TCP 25565
• FiveM server: TCP/UDP 30120
• Database: TCP 3306 (MySQL), TCP 5432 (PostgreSQL)

Custom Nginx Configuration

Advanced Tab

In the Advanced tab when editing a proxy host:

# Custom headers
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

# Large file uploads
client_max_body_size 100M;

# Timeout settings
proxy_connect_timeout 300;
proxy_send_timeout 300;
proxy_read_timeout 300;

# WebSocket support
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

Custom Location

To route different paths to different backends within a proxy host:

1. Proxy Host → Edit → Custom Locations
2. Location: /api
3. Scheme: http
4. Forward Hostname: api-server
5. Forward Port: 8080

Wildcard SSL Certificate

To obtain a wildcard certificate with DNS Challenge:

1. SSL Certificates → Add SSL Certificate
2. Let's Encrypt tab
3. Domain Names: *.example.com
4. Use a DNS Challenge: Enable
5. DNS Provider: Cloudflare, DigitalOcean, etc.
6. Credentials: Enter API token

Backup and Restore

# Backup NPM data
docker exec nginx-proxy-manager tar -czf /tmp/npm-backup.tar.gz /data /etc/letsencrypt
docker cp nginx-proxy-manager:/tmp/npm-backup.tar.gz ./npm-backup-$(date +%Y%m%d).tar.gz

# Restore
docker cp ./npm-backup.tar.gz nginx-proxy-manager:/tmp/
docker exec nginx-proxy-manager tar -xzf /tmp/npm-backup.tar.gz -C /
docker restart nginx-proxy-manager

Update

docker compose pull
docker compose up -d
docker image prune -f

Security Recommendations

# Make admin panel accessible only from specific IPs
ports:
  - '80:80'
  - '443:443'
  - '127.0.0.1:81:81'  # Localhost only

# Access via SSH tunnel
ssh -L 81:localhost:81 user@server-ip
# In browser: http://localhost:81