NGINX Reverse Proxy and Load Balancing
NGINX can sit between clients and application servers, forwarding each request to a chosen backend. As a reverse proxy and load balancer, it gives clients one entry point while distributing traffic across multiple servers.
itWeb servers, proxies, and traffic management | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic - NGINX Reverse Proxy and Load Balancing
NGINX can sit in front of application instances so clients do not need to know where every backend runs. The client talks to one endpoint. NGINX selects a backend, forwards the request, receives the response, and returns it. That is a reverse proxy: it represents servers to clients. A forward proxy represents clients to the outside world.
The useful path is short: client to virtual server to location to upstream group to a selected backend. A virtual server is the client-facing server block. A location matches a URI. proxy_pass sends the request onward. An upstream names one server or a group. Load balancing chooses among healthy members with a method you configure.
Why bother? One hop becomes the place to terminate TLS, add request limits, rewrite paths, log access, and apply timeouts. Backends can come and go without teaching every client a new address. Failure policy also concentrates here: what happens when a member is slow, when a health check fails, and how long NGINX waits before giving up.
The surprises are usually contractual, not mystical. URI rewriting changes with proxy_pass slash rules. Health checks that only prove a port is open will send traffic to applications that cannot finish useful work. Sticky sessions paper over missing shared state and then punish you when that sticky node dies.
Read the Intro for the client-to-upstream mental model. Use the Cheatsheet when you need the directive map for proxy_pass, upstreams, and health checks. Updates tracks NGINX security advisories that affect these proxy paths.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy
Supports
- Reverse-proxy request flow and supported upstream protocols
- proxy_pass placement, URI replacement, request-header defaults, and proxy_set_header
- Default response buffering, buffer controls, and behavior when buffering is disabled
- https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/
Supports
- Upstream groups and proxy_pass to a named group
- Weighted round robin, least connections, IP hash, generic hash, weights, backup servers, and product capability boundaries
- https://nginx.org/en/docs/http/ngx_http_proxy_module.html
Supports
- Exact proxy_pass URI mapping and request-header directive behavior
- Proxy buffering, connect, send, and read timeout semantics
- proxy_next_upstream conditions and the response-sent retry boundary
- https://nginx.org/en/docs/http/ngx_http_upstream_module.html
Supports
- Upstream server weights, max_fails, fail_timeout, backup, and down parameters
- Load-balancing directives, passive failure handling, consistent hashing, and upstream timing variables
- https://docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/
Supports
- Passive health checks based on request outcomes
- Active periodic health checks as an NGINX Plus capability
- https://docs.nginx.com/nginx/admin-guide/security-controls/securing-http-traffic-upstream/
Supports
- HTTPS proxy_pass for encrypted upstream traffic
- Upstream certificate trust, verification, and optional client-certificate configuration
- https://docs.nginx.com/nginx/admin-guide/monitoring/logging/
Supports
- Error and access logging
- request, upstream connection, upstream header, and upstream response timing variables
- https://nginx.org/en/docs/beginners_guide.html
Supports
- Configuration hierarchy, master and worker responsibilities, and reload behavior
- New-worker startup, graceful old-worker retirement, and retention of the old configuration after a failed apply
- https://nginx.org/en/docs/switches.html
Supports
- Configuration syntax and referenced-file checks with nginx -t
- Reload signals and other command-line parameters
- https://github.com/sindresorhus/awesome
Supports
- Discovery of the curated NGINX resources list
- https://github.com/fcambus/nginx-resources
Supports
- Discovery of Gixy, BunkerWeb, OpenResty, and Kong as NGINX-related ecosystem projects
- https://gixy.getpagespeed.com/
Supports
- Gixy as an NGINX configuration analyzer for security misconfiguration and flaw detection
- Documented checks covering proxy-pass paths, headers, access control, TLS, DNS, and regular expressions
- https://docs.bunkerweb.io/
Supports
- BunkerWeb as an open-source NGINX-based web application firewall and reverse proxy
- Documented Linux, Docker, Swarm, and Kubernetes integrations
- https://openresty.org/en/
Supports
- OpenResty as a web and gateway platform combining NGINX, LuaJIT, Lua libraries, and NGINX modules
- https://developer.konghq.com/gateway/
Supports
- Kong Gateway as an API reverse proxy for request management, configuration, and routing
- Plugin extension and distributed-architecture positioning