Hosting Websites

Ports 80 and 443 can only be forwarded to one VM. To host several websites on different VMs, run a reverse proxy: one VM receives all web traffic and passes each request to the right VM based on the domain name.

                         ┌──► shop.example.com  ──► 10.10.10.11
Internet ──► :80/:443 ──► Reverse proxy (10.10.10.10)
                         └──► blog.example.com  ──► 10.10.10.12

We recommend Nginx Proxy Manager. It has a web interface and handles free Let's Encrypt SSL certificates automatically.

1. Create the proxy VM

Create a small Debian or Ubuntu VM (1 CPU, 1 GB RAM, 10 GB disk) on vmbr1 with IP 10.10.10.10. See Creating a VM.

2. Install Docker and Nginx Proxy Manager

Inside the VM:

cd ~
curl -fsSL https://get.docker.com | sh
mkdir -p ~/npm

cd ~/npm
cat > docker-compose.yml <<'EOF'
services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "81:81"
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
EOF
docker compose up -d

3. Forward ports 80 and 443

On the Proxmox host, forward 80 and 443 to 10.10.10.10 (see the web server example in Port Forwarding). With the OPNsense router, create the two forwards in the OPNsense GUI instead.

:::warning Don't forward port 81 Port 81 is the Nginx Proxy Manager admin panel. Keep it private, and reach it via a VPN or SSH tunnel:

cd ~
ssh -L 8181:10.10.10.10:81 root@YOUR-PUBLIC-IP

Then open http://localhost:8181. :::

4. Point your domains

At your DNS provider, create A records for each domain pointing to YOUR-PUBLIC-IP.

5. Add your websites

Log in to the admin panel (default: admin@example.com / changeme, and change it immediately).

Hosts → Proxy Hosts → Add Proxy Host

Field	Example
Domain Names	shop.example.com
Scheme	http
Forward Hostname / IP	10.10.10.11
Forward Port	80
Block Common Exploits	✅
SSL tab	Request a new certificate, ✅ Force SSL, ✅ HTTP/2

Repeat for each website. The backend VMs only need a plain HTTP web server, because SSL is handled by the proxy.

Non-web services

Nginx Proxy Manager can also forward plain TCP/UDP ports under Hosts → Streams. Each stream port must also be forwarded from the host to the proxy VM first.