Nginx Proxy Manager Setup: Publishing Services to the Internet

Sooner or later, every company has a service that lived only on the internal network and suddenly needs to go public. The accounting team needs access to 1C from home, managers need the CRM on their phones, developers need the staging panel reachable from outside. And that’s where the trouble starts: if you just forward a port to the internet, within a week you’ll have vulnerability scanners, bots, and people trying to brute-force passwords knocking on your door. Nginx Proxy Manager setup solves this the right way: services get published under domain names over HTTPS, not as raw ports exposed on an IP.

This service is for companies with internal services that need to go public safely. It doesn’t matter if you have one admin panel or five, the approach is the same: reverse proxy, certificates, brute-force protection.

What’s included

I build a complete service publishing setup: from inventory to external verification.

• Reverse proxy on Nginx Proxy Manager: a layer that accepts incoming requests and routes them to the right internal service based on domain name
• SSL certificates (Let’s Encrypt) so services run over HTTPS instead of plain HTTP
• CrowdSec or fail2ban: automatic blocking of IPs running password brute-force attempts or scanning
• Closing unnecessary ports on the firewall, so only what’s actually needed is exposed to the internet

How the work is done

%%{init: {
  'theme': 'base',
  'themeVariables': {
    'primaryColor': '#ffffff',
    'primaryTextColor': '#1e293b',
    'primaryBorderColor': '#94a3b8',
    'lineColor': '#64748b',
    'fontSize': '15px',
    'fontFamily': 'ui-sans-serif, system-ui, sans-serif'
  },
  'flowchart': {'curve': 'linear', 'nodeSpacing': 50, 'rankSpacing': 50}
}}%%
flowchart TD
    S1["1. Service inventory"]
    S2["2. Reverse proxy setup"]
    S3["3. SSL certificates"]
    S4["4. CrowdSec/fail2ban"]
    S5["5. External check and documentation"]
    S1 --> S2
    S2 --> S3
    S3 --> S4
    S4 --> S5
    style S1 fill:#f8fafc,stroke:#3b82f6,stroke-width:2px,color:#1e40af
    style S2 fill:#f8fafc,stroke:#94a3b8,stroke-width:2px,color:#1e293b
    style S3 fill:#f8fafc,stroke:#94a3b8,stroke-width:2px,color:#1e293b
    style S4 fill:#f8fafc,stroke:#94a3b8,stroke-width:2px,color:#1e293b
    style S5 fill:#f8fafc,stroke:#22c55e,stroke-width:2px,color:#15803d

1. Service inventory. I check what exactly needs to be published: which services, on which ports, who needs access.
2. Reverse proxy setup. I deploy Nginx Proxy Manager on a server or VM and configure routing by domain name.
3. SSL and access restrictions. I issue certificates, set up HTTP to HTTPS redirects, and restrict access by IP or password if needed.
4. Attack protection. I set up CrowdSec or fail2ban and close off everything on the firewall that shouldn’t be visible from outside.
5. Verification and documentation. I check that services work externally, from different devices, and hand over documentation with settings and credentials.

What hardware you’ll need

You need a server or virtual machine for the reverse proxy and a public static IP address (the address your services will be reachable at from the internet). If you don’t have your own server, I’ll pick one that fits the task.

What gets deployed

In the end, your infrastructure runs: Nginx Proxy Manager as the reverse proxy, Let’s Encrypt for automatic SSL certificate issuance and renewal, CrowdSec or fail2ban for attack protection, and configured firewall rules.

What you get as a result

Your services become accessible from outside over HTTPS and under domain names, not as raw IPs with exposed ports. Unnecessary ports are closed, and password brute-force attempts and scanning get blocked automatically, without any effort on your part.

Pricing

The base price covers publishing up to 5 services. Each additional service beyond that, plus extra options like a block monitoring web interface, is billed separately.

Not included in the price: Domain and DNS hosting.

After delivery: 14 days of free fixes for any issues. After that: one-off work at 2 000 ₽/hour or support plans from 4 000 ₽/month.

What I need from you

• Access to your domain’s DNS (to add records for the services)
• A list of services that need to be published, with internal addresses and ports
• Access to the server or VM where the reverse proxy will run
• A contact for coordination, in case details need clarifying along the way

Frequently asked questions

Is the work done remotely or do you need a site visit?

Remotely. Everything is configured through remote access to the server.

How long does the setup take?

2-3 days from the moment I get DNS access and the list of services.

What if I don’t have a server for the reverse proxy?

I’ll pick one that fits the task, it can be deployed on your existing infrastructure or a new virtual machine.

What happens if something stops working after delivery?

I fix any issues for free within 14 days after delivery. After that, one-off fixes are billed separately or you can switch to a monthly support plan.

Can I publish more than 5 services?

Yes, each service beyond the base package is billed separately.

Will this protect against all attacks?

CrowdSec and fail2ban block password brute-forcing and typical scanning. No reverse proxy will stop a targeted attack backed by real resources, but those are thankfully rare for small businesses.