If you’re running services on a home server, VPS, or self-hosted environment, one of the first problems you’ll encounter is how to access everything cleanly and securely from the internet.

You might start by accessing services through IP addresses and ports like:

http://192.168.1.10:3000
http://192.168.1.10:8080
http://192.168.1.10:8123

This works at first, but it quickly becomes messy, hard to remember, and difficult to secure.

The solution used by nearly every professional infrastructure setup is a reverse proxy.

In this guide, you’ll learn how to install Nginx Proxy Manager using Portainer, what a reverse proxy is, why it’s essential for self-hosting, and how to configure it properly.

By the end of this tutorial you’ll be able to:

Install Nginx Proxy Manager with Portainer
Secure your services with free HTTPS certificates
Create clean subdomains for your applications
Understand how reverse proxies work
Compare Nginx Proxy Manager with other solutions such as Traefik, Caddy, HAProxy, and SafelineWAF

What is Nginx Proxy Manager?

Nginx Proxy Manager (NPM) is an open-source management interface built on top of the NGINX web server.

NGINX itself is one of the most widely used web servers and reverse proxies in the world, powering millions of websites and services.

Normally, configuring NGINX requires manually editing configuration files such as:

/etc/nginx/nginx.conf

While this provides incredible flexibility, it can be intimidating for beginners.

Nginx Proxy Manager solves this by providing a simple web dashboard where you can configure everything visually.

With NPM you can easily:

Create reverse proxies
Issue free Let’s Encrypt SSL certificates
Redirect domains
Protect services with authentication
Manage multiple websites and applications
Configure advanced NGINX rules

In short:

Nginx Proxy Manager makes enterprise-level reverse proxy management accessible to anyone.

What is a Reverse Proxy?

To understand why Nginx Proxy Manager is useful, we need to understand the concept of a reverse proxy.

A reverse proxy is a server that sits between users and your applications.

Instead of users connecting directly to your services, they connect to the proxy first.

The proxy then forwards the request to the correct internal service.

Example infrastructure:

Internet
   ↓
Reverse Proxy
   ↓
Internal Services

Imagine you run these services internally:

Service	Internal Address
Jellyfin	192.168.1.20:8096
Grafana	192.168.1.21:3000
Home Assistant	192.168.1.22:8123

Without a reverse proxy you must access them using ports.

With a reverse proxy you can use domains:

jellyfin.example.com
grafana.example.com
home.example.com

The proxy routes traffic to the correct destination.

Benefits of Running Your Own Reverse Proxy

Running your own reverse proxy provides several major advantages.

Clean Domain Names

Instead of remembering ports, you access services via subdomains.

Example:

media.example.com
dashboard.example.com
automation.example.com

This makes your infrastructure much easier to manage.

Automatic HTTPS Encryption

A reverse proxy can automatically generate free SSL certificates using Let’s Encrypt.

This means all services can run securely over HTTPS without manual certificate management.

Centralised Access Control

Rather than configuring authentication on every application, you can control access from the proxy.

This allows you to:

restrict services to certain IP addresses
require login authentication
protect internal tools

Professional Infrastructure

Most modern cloud platforms and companies use reverse proxies.

Learning how they work improves your understanding of real-world DevOps architecture.

Run Multiple Services on One Server

A single server with one IP address can host dozens of services behind a reverse proxy.

Why Use Nginx Proxy Manager?

There are many reverse proxy tools available, but Nginx Proxy Manager is especially popular in home labs and small servers.

Key advantages include:

User-Friendly Dashboard

Everything is managed through a web interface rather than configuration files.

Automatic SSL Certificates

NPM integrates directly with Let’s Encrypt.

Certificates are issued and renewed automatically.

Docker Friendly

It runs perfectly inside Docker and integrates well with Portainer.

Minimal Configuration Required

You can have a working reverse proxy within minutes.

Based on NGINX

You still benefit from the reliability and performance of NGINX.

Requirements Before Installing

Before installing Nginx Proxy Manager, ensure the following requirements are met.

Since this guide focuses on Portainer deployment, we assume:

Docker is installed
Portainer is already running
You have access to the Portainer dashboard

You should also have:

A domain name
Access to DNS settings
Ports 80 and 443 available
A public IP address or port forwarding configured

These ports are necessary for HTTP and HTTPS traffic.

Installing Nginx Proxy Manager with Portainer

Deploying Nginx Proxy Manager through Portainer is straightforward.

We will create a Docker stack.

Step 1: Open the Portainer Dashboard

Log into your Portainer interface.

Navigate to:

Stacks

Click:

Add Stack

Name the stack something like:

nginx-proxy-manager

Step 2: Add the Docker Compose Configuration

Paste the following configuration into the editor.

version: "3"

services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
    restart: unless-stopped

    ports:
      - "80:80"
      - "81:81"
      - "443:443"

    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

This configuration will:

expose port 80 for HTTP
expose port 443 for HTTPS
expose port 81 for the admin dashboard

Step 3: Deploy the Stack

Click:

Deploy the Stack

Portainer will automatically pull the Docker image and start the container.

Within a minute Nginx Proxy Manager should be running.

Accessing the Nginx Proxy Manager Dashboard

Once the container is running, open a browser and go to:

http://your-server-ip:81

You will see the login screen.

Default credentials:

Email: admin@example.com
Password: changeme

You will be prompted to change both immediately.

Always use a strong password for security.

Understanding the Dashboard

The Nginx Proxy Manager dashboard is intentionally simple.

Main sections include:

Proxy Hosts

Create reverse proxy rules.

Redirection Hosts

Forward one domain to another domain.

Streams

Used for TCP or UDP forwarding.

Access Lists

Manage authentication and IP restrictions.

SSL Certificates

Manage HTTPS certificates.

Creating Your First Proxy Host

Let’s connect a service to the internet.

Example service:

Grafana running at:

192.168.1.52:3000

Step 1: Add Proxy Host

Navigate to:

Proxy Hosts → Add Proxy Host

Step 2: Enter Domain Configuration

Domain name:

grafana.example.com

Forward hostname:

192.168.1.52

Forward port:

Scheme:

http

Step 3: Enable SSL

Open the SSL tab.

Enable:

Request new SSL certificate
Force SSL
HTTP/2 support
HSTS

Click Save.

Nginx Proxy Manager will automatically issue a Let’s Encrypt certificate.

You can now access:

https://grafana.example.com

Using Wildcard Domains

If you host many services, creating DNS entries individually can become tedious.

Instead you can create a wildcard DNS record.

Example:

*.example.com → your server IP

This means any subdomain automatically resolves.

You can then create proxy hosts instantly without editing DNS each time.

Access Lists and Authentication

NPM includes built-in authentication features.

You can protect services with:

username/password login
IP restrictions

Example use cases:

protecting admin dashboards
restricting internal tools
securing development environments

To create one:

Access Lists → Add Access List

Then apply it to a proxy host.

Advanced NGINX Configuration

Even though NPM is beginner friendly, you can still use advanced NGINX directives.

Example custom configuration:

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

These settings are often required for applications that need the client’s real IP address.

Backups and Data Storage

Your configuration is stored inside the Docker volumes:

/data
/etc/letsencrypt

These folders contain:

proxy configurations
SSL certificates
user accounts

Backing them up ensures you can quickly restore your setup.

Reverse Proxy Security Best Practices

Running internet-accessible services requires careful security practices.

Always Use HTTPS

Encrypt all traffic using SSL certificates.

Use Strong Passwords

Protect dashboards and admin panels.

Restrict Sensitive Services

Use access lists or VPN access for critical tools.

Keep Containers Updated

Regularly update Docker images to patch vulnerabilities.

Consider a Web Application Firewall

A Web Application Firewall (WAF) filters malicious traffic before it reaches your services.

Alternative Reverse Proxy Solutions

While Nginx Proxy Manager is excellent, several alternatives exist.

Traefik

Traefik is designed for modern container environments.

Features include:

automatic Docker service discovery
dynamic configuration
integrated Let’s Encrypt

However it is usually configured through labels rather than a GUI.

Caddy

Caddy is known for its simplicity.

Example configuration:

example.com {
 reverse_proxy localhost:3000
}

It automatically provisions HTTPS certificates.

HAProxy

HAProxy is extremely powerful and commonly used by high-traffic websites.

However it requires more complex configuration.

SafelineWAF

SafelineWAF is a security-focused proxy designed to act as a Web Application Firewall.

It protects services from attacks such as:

SQL injection
cross-site scripting
automated vulnerability scanning
malicious bots

Many administrators combine a reverse proxy with a WAF for enhanced protection.

Example architecture:

Internet
   ↓
SafelineWAF
   ↓
Nginx Proxy Manager
   ↓
Internal Services

Example Home Lab Setup

A typical self-hosting architecture might look like this.

Internet
   ↓
Router
   ↓
Nginx Proxy Manager
   ↓
Docker Services

Example services:

jellyfin.example.com
nextcloud.example.com
grafana.example.com
homeassistant.example.com

This structure keeps your infrastructure organised and secure.

Troubleshooting Common Problems

DNS Not Resolving

Check your DNS records.

Tools like nslookup or dig can verify resolution.

SSL Certificate Errors

Ensure:

ports 80 and 443 are open
DNS is correct
the domain resolves to your server

502 Bad Gateway

This usually means the proxy cannot reach the service.

Verify:

correct internal IP
correct port
container is running

Final Thoughts

Running your own services is incredibly rewarding, but managing access and security can quickly become complicated.

Installing Nginx Proxy Manager with Portainer simplifies this dramatically.

With just a few steps you can create a powerful reverse proxy that provides:

clean domain-based access
automatic HTTPS encryption
simple management through a dashboard
centralised control over all your services

Whether you’re building a home lab, self-hosted platform, or small production server, Nginx Proxy Manager is one of the best tools available. Once you’re comfortable with it, you can explore more advanced infrastructure ideas such as:

adding a Web Application Firewall
integrating authentication services
automating container deployments
building high-availability clusters

But every great self-hosting setup begins with a solid reverse proxy. Nginx Proxy Manager is one of the easiest places to start.