Windows Server Hardening: Nginx Reverse Proxy Setup

When hosting web applications (Node.js, PHP, ASP.NET) on a Windows Server VPS, exposing your application ports or IIS web service directly to the public internet is risky. IIS is heavy, difficult to customize on-the-fly, and susceptible to automated exploits if left unhardened.

A better pattern is to use **Nginx** as a lightweight reverse proxy sitting in front of your applications. Nginx handles SSL termination, coordinates gzip compression, caches static resources, and routes traffic back to your local app pools securely.

Nginx Reverse Proxy Configuration Block

Download Nginx for Windows, navigate to `C:\nginx\conf\nginx.conf`, and replace the server segment with this high-performance configuration file:

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;

    # Gzip Compression settings
    gzip  on;
    gzip_types text/plain text/css application/json application/javascript text/xml;

    server {
        listen       80;
        server_name  yourdomain.com www.yourdomain.com;

        # Redirect http to https
        return 301 https://$host$request_uri;
    }

    server {
        listen       443 ssl http2;
        server_name  yourdomain.com www.yourdomain.com;

        # SSL Certificates (Let's Encrypt / Cloudflare SSL)
        ssl_certificate      C:/nginx/ssl/certificate.crt;
        ssl_certificate_key  C:/nginx/ssl/private.key;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;

        location / {
            # Proxy headers mapping
            proxy_pass http://127.0.0.1:3000; # Points to your local node/PHP app port
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            # WebSockets support
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }
    }
}

Start Nginx from your command line (`start nginx`), and make sure to only allow TCP port 80 and 443 inbound rules in your Windows Firewall, completely shielding port 3000 from remote external attacks.

Windows Web Server Hardening: Running Nginx as a Reverse Proxy for Local Web Apps

Nginx Reverse Proxy Configuration Block