Adding SSL\/TLS to Your Reverse Proxy<\/strong><\/h2>\n\n\n\nRunning HTTP-only in 2026 is a non-starter for most real traffic. Use Certbot for free, automated certificates:<\/p>\n\n\n\n
sudo apt install certbot python3-certbot-nginx -y<\/p>\n\n\n\n
sudo certbot –nginx -d example.com -d www.example.com<\/p>\n\n\n\n
Certbot edits your NGINX config automatically, adding a listen 443 ssl block and redirecting HTTP to HTTPS.<\/p>\n\n\n\n
\u2705 Best Practice:<\/strong> Set up auto-renewal with sudo certbot renew –dry-run to confirm it’ll renew without manual intervention.<\/p>\n\n\n\nReverse Proxy vs. Forward Proxy vs. Load Balancer<\/strong><\/h2>\n\n\n\nFeature<\/strong><\/td>Reverse Proxy<\/strong><\/td>Forward Proxy<\/strong><\/td>Load Balancer<\/strong><\/td><\/tr>Sits in front of<\/strong><\/td>Servers<\/td> Clients<\/td> Multiple servers<\/td><\/tr> Main Purpose<\/strong><\/td>Protect\/manage backend<\/td> Anonymize\/filter client traffic<\/td> Distribute traffic<\/td><\/tr> Common Tool<\/strong><\/td>NGINX, HAProxy<\/td> Squid<\/td> NGINX, HAProxy, AWS ELB<\/td><\/tr> Client Awareness<\/strong><\/td>The client is unaware of the backend<\/td> The server is unaware of the real client<\/td> The client is unaware of which server responds<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nIn practice, NGINX often does all three jobs at once \u2014 which is part of why it’s so widely adopted.<\/p>\n\n\n\n
Common Errors and How to Fix Them<\/strong><\/h2>\n\n\n\n\n502 Bad Gateway:<\/strong> Usually means your backend app isn’t running or is on the wrong port. Check with curl localhost:PORT directly.<\/li>\n\n\n\n413 Request Entity Too Large:<\/strong> Add client_max_body_size 20M; inside your server block.<\/li>\n\n\n\nConnection refused:<\/strong> Confirm your backend is bound to 127.0.0.1 and not blocked by a firewall rule.<\/li>\n\n\n\nMixed content warnings after SSL:<\/strong> Make sure proxy_set_header X-Forwarded-Proto $scheme; is present so your app knows it’s behind HTTPS.<\/li>\n<\/ul>\n\n\n\nWhat to Do Next<\/strong><\/h2>\n\n\n\nBefore wrapping up, here’s how to keep moving:<\/p>\n\n\n\n
\nAdd a second backend instance and configure basic load balancing with upstream.<\/li>\n\n\n\n Set up logging (access_log \/ error_log) to monitor proxy traffic.<\/li>\n\n\n\n Harden your config with rate limiting (limit_req) to prevent abuse.<\/li>\n<\/ol>\n\n\n\nKey Takeaways<\/strong><\/h2>\n\n\n\n\nAn NGINX reverse proxy forwards client requests to backend servers and returns the response.<\/li>\n\n\n\n Use proxy_pass plus the standard proxy_set_header lines to avoid losing client info.<\/li>\n\n\n\n Always run nginx -t before reloading configs in production.<\/li>\n\n\n\n SSL termination at the proxy layer (via Certbot) is now standard practice, not optional.<\/li>\n\n\n\n Common errors like 502s almost always trace back to the backend app, not NGINX itself.<\/li>\n<\/ul>\n\n\n\nFAQs<\/strong><\/h2>\n\n\n\n
\n
\n
What does a reverse proxy do in NGINX?<\/strong><\/h3>\n\n\n
It receives incoming client requests, forwards them to one or more backend servers, and returns the backend’s response to the client.<\/p>\n\n<\/div>\n<\/div>\n
\n
Is NGINX reverse proxy free to use?<\/strong><\/h3>\n\n\n
Yes. NGINX (the open-source version) is free under a BSD-style license; only NGINX Plus, the commercial edition, requires a paid license.<\/p>\n\n<\/div>\n<\/div>\n
\n
Why am I getting a 502 Bad Gateway error?<\/strong><\/h3>\n\n\n
This almost always means your backend application isn’t running, is on the wrong port, or NGINX can’t reach it \u2014 check with a direct curl to the backend port.<\/p>\n\n<\/div>\n<\/div>\n
\n
Can NGINX reverse proxy multiple domains on one server?<\/strong><\/h3>\n\n\n
Yes. You can create separate server blocks for each domain, each with its own proxy_pass target, all on the same NGINX instance.<\/p>\n\n<\/div>\n<\/div>\n
\n
Do I need SSL for a reverse proxy?<\/strong><\/h3>\n\n\n
It’s strongly recommended. Terminating SSL at the proxy layer with a tool like Certbot secures traffic without requiring changes to your backend app.<\/p>\n\n<\/div>\n<\/div>\n
\n
What’s the difference between proxy_pass and upstream in NGINX?<\/strong><\/h3>\n\n\n
proxy_pass points to a single backend address, while upstream defines a named pool of backend servers that NGINX can load-balance across.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"
Most modern websites don’t expose their backend servers directly to the internet. Instead, they use a reverse proxy to handle incoming traffic, improve security, and manage requests efficiently. NGINX is one of the most popular tools for this job, but a small configuration mistake can quickly lead to frustrating errors like 502 Bad Gateway. This […]<\/p>\n","protected":false},"author":64,"featured_media":119502,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[294],"tags":[],"views":"59","authorinfo":{"name":"Abhishek Pati","url":"https:\/\/www.guvi.in\/blog\/author\/abhishek-pati\/"},"thumbnailURL":"https:\/\/www.guvi.in\/blog\/wp-content\/uploads\/2026\/06\/NGINX-Reverse-Proxy-300x116.webp","_links":{"self":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/119355"}],"collection":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/users\/64"}],"replies":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/comments?post=119355"}],"version-history":[{"count":5,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/119355\/revisions"}],"predecessor-version":[{"id":119506,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/119355\/revisions\/119506"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/media\/119502"}],"wp:attachment":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/media?parent=119355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/categories?post=119355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/tags?post=119355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}