Website Not Loading on a NAT VPS: DNS, Ports, TLS and HTTP

When a NAT-hosted website fails, identify whether the failure occurs at DNS, connection establishment, TLS or HTTP. A browser's general error page is not enough to determine the cause.

Check the destination and port

Confirm the hostname resolves to the intended ingress address. A normal HTTPS URL uses port 443. If your origin is reachable only on a mapped high port, either the URL must specify that port or a separate ingress must route ordinary HTTPS to it.

DNS-only and CDN-proxied records follow different paths. A DNS A record cannot carry a port number. Check for an invalid AAAA record too, because some clients may attempt a broken IPv6 path.

Separate TLS from application errors

An expired certificate, wrong hostname or untrusted chain is a TLS issue. A 404 means an HTTP server answered but did not find the requested resource; a proxy 502 often means it could not get a valid origin response. Neither automatically proves the VPS is down.

Use curl -I URL for a short header check, adapting the URL to your real endpoint. Avoid making certificate verification bypasses the final configuration. Test the origin locally and externally before changing proxy settings.

Check the server configuration

Verify listener address, NAT mapping, guest firewall and selected virtual host. If HTML works but assets fail, inspect their URLs and status codes. For redirect loops, compare the external scheme with what the application believes and review trusted proxy headers.

See website ingress design, certificate challenges and Nginx configuration.