NGINX Proxy Manager on Ubuntu 24: Step-by-Step Setup

Managing reverse proxies for containerized web applications, self-hosted dashboards, and microservices often becomes a maintenance bottleneck when configuring raw NGINX configuration files manually. NGINX Proxy Manager (NPM) solves this by pairing the robust routing capabilities of NGINX with an intuitive, container-based web interface. On modern Linux distributions like Ubuntu 24.04 LTS (Noble Numbat), deploying NPM via Docker Compose delivers an enterprise-grade ingress controller with automated Let’s Encrypt SSL lifecycle management.

NGINX Proxy Manager Default Port Architecture: 80, 81, and 443

Understanding port bindings is critical before exposing services to external traffic. The core nginx proxy manager default port structure encompasses three distinct network channels:

Security Directive: Never expose port 81 to the open internet. The management panel should only be accessible through local subnet IPs or a secure overlay network like WireGuard or Tailscale.

Docker Compose Deployment Configuration on Ubuntu 24.04 LTS

To deploy NGINX Proxy Manager with an isolated SQLite or MariaDB database backend, establish a structured compose environment:

# compose.yaml for NGINX Proxy Manager
version: '3.8'
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'      # Public HTTP Traffic
      - '81:81'      # Admin Web UI
      - '443:443'    # Public HTTPS Traffic
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    environment:
      DISABLE_IPV6: 'true'

On Ubuntu 24.04, execute the deployment with standard Docker commands:

# Update repositories and install Docker
sudo apt update && sudo apt install -y docker.io docker-compose-v2

# Create directory and deploy NPM container
mkdir -p ~/npm && cd ~/npm
nano compose.yaml
docker compose up -d

# Verify container status
docker ps

Once running, access the administrative console by navigating to http://your-server-ip:81. The default initial login credentials are admin@example.com with password changeme. You will be prompted immediately to set a secure administrator email and password.

Configuring SSL Certificates and Let’s Encrypt Wildcard Records

One of the greatest operational strengths of NGINX Proxy Manager is automated certificate lifecycle management:

1. HTTP-01 Challenge: For single domain records (e.g., app.yourdomain.com), NPM provisions free Let’s Encrypt certificates automatically, automatically renewing them 30 days prior to expiration.
2. DNS-01 Challenge for Wildcards: For multi-service deployments (e.g., *.yourdomain.com), configure DNS API integration (Cloudflare, DigitalOcean, Route53). This eliminates the need to expose individual internal ports to the internet during certificate generation.
3. Enforce Strict Transport Security (HSTS): In the SSL tab of each proxy host, toggle Force SSL and HSTS Enabled to prevent man-in-the-middle downgrade attacks.

UFW Firewall Configuration on Ubuntu 24.04

Secure your host operating system using the Uncomplicated Firewall (UFW):

# Allow SSH, HTTP, and HTTPS
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Restrict Admin Port 81 to local subnet only
sudo ufw allow from 192.168.1.0/24 to any port 81 proto tcp

# Enable firewall
sudo ufw enable
sudo ufw status