Running Nginx on a Nonstandard Port Behind NAT

Nginx can listen on a guest port such as 8080 and receive traffic through an assigned public NAT port. The port in the visitor's URL is the public port; the Nginx configuration uses the private destination port.

Minimal HTTP server example

On a guest with Nginx installed, a server block might be:

server {
    listen 8080;
    server_name app.example.com;
    root /var/www/example;
    index index.html;
    location / {
        try_files $uri $uri/ =404;
    }
}

Create the document root, make files readable by Nginx and enable the configuration using your distribution's layout. Validate with sudo nginx -t before reloading. Then test locally using curl -I http://127.0.0.1:8080.

Connect the public side

Create or verify a TCP mapping from your assigned public port to guest port 8080, then permit 8080 through the guest firewall if needed. Test externally with http://PUBLIC_HOST:PUBLIC_PORT. This example serves HTTP, not encrypted HTTPS; do not send sensitive sessions over it.

If a separate proxy handles public HTTPS, configure its origin path and TLS expectations explicitly. A domain's DNS record does not change the mapping or make this server own public port 80.

Check the selected server block

When several sites share Nginx, the request's Host header and default server determine which block handles it. A default welcome page can mean the request reached Nginx but selected a different configuration.

See website ingress requirements, certificate options and website diagnosis.

Reference: Nginx request processing.