A reverse proxy is a front door. Visitors talk to Nginx on port 80 (or 443). Nginx then asks your app—often Node.js or Express on 127.0.0.1:3000—for the page, and sends the answer back.
proxy_pass chooses the upstream.This walkthrough uses Ubuntu-style commands (common on Amazon Linux alternatives and Ubuntu EC2 AMIs). Package names can differ slightly on Amazon Linux—use the same ideas.
EC2 deploy demos often bind Node to port 80 with elevated privileges. A reverse proxy is the cleaner habit: Node on 3000, Nginx on 80, visitors never type :3000.
After a working app from Node on EC2, Express on EC2, React on EC2, or Next.js on EC2. If you prefer a managed public door, study an Application Load Balancer instead.
Browser → server:80 (Nginx) → proxy_pass → 127.0.0.1:3000 (Node) → response back through Nginx.
See the Beginner’s Guide (simple proxy) and the proxy module reference for every proxy_* directive.
| Word | Plain meaning |
|---|---|
proxy_pass | Forward matching requests to this upstream URL |
proxy_set_header | Pass Host, real client IP, and other headers to the app |
sites-available | Ubuntu folder for server configs (enabled via symlink) |
nginx -t | Test config syntax before reload |
502 Bad Gateway | Nginx could not get a valid answer from the upstream |
upstream | Optional named block listing one or more backends |
node. Confirm with curl http://127.0.0.1:3000 on the server.If your app listens on 8080 or 4000, use that port in every proxy_pass and curl below.
Five small steps. After Step 5, http://YOUR_PUBLIC_IP/ should show your app.
On Ubuntu / Debian-style AMIs:
sudo apt update
sudo apt install -y nginx
sudo systemctl enable nginx
sudo systemctl start nginxOpen the public IP in a browser. You should see the default Nginx welcome page.
Nginx can only proxy to something that answers.
curl -I http://127.0.0.1:3000
# or
pm2 statusYou want an HTTP response (often 200), not “Connection refused.”
proxy_pass will use.Add a simple server block that forwards everything to Node.
sudo nano /etc/nginx/sites-available/my-appserver {
listen 80;
server_name _;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cache_bypass $http_upgrade;
}
}listen 80 is the public HTTP door.proxy_pass sends the request to your Node process.Disable the default site if it conflicts, then enable yours.
sudo ln -s /etc/nginx/sites-available/my-app /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginxnginx -t must say the syntax is ok before reload.You may edit /etc/nginx/conf.d/my-app.conf instead of sites-available. Same server { } content; still run nginx -t and reload.
http://YOUR_PUBLIC_IP/ (or your domain if DNS already points here).Run pm2 status and curl 127.0.0.1:3000 on the server before blaming Nginx.
Config says 3000 but the app listens on 8080. Match them exactly.
A missing semicolon can leave the old site running or block reload. Always test first.
Remove or disable default in sites-enabled so your proxy config is the one that answers.
SSH works, browser times out. Open TCP 80 (and 443 later).
Stop the old “listen on 80 with sudo” process so Nginx can own port 80.
proxy_pass is the core reverse-proxy line.nginx -t then reload after every config change.One line: install Nginx, proxy_pass to your app, test, reload, then browse port 80.
Deploy a simple Node site on EC2 first, then come back and put Nginx in front.
10 people found this page helpful