[GH-ISSUE #1114] Support for PROXY Protocol

kerem commented

2026-02-26 06:34:57 +03:00

Owner

Originally created by @furgoose on GitHub (May 21, 2021).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1114

Is it possible to accept PROXY Protocol traffic from within the UI?
If I go in and manually edit the files it works, but requesting certs resets the files so it's not really a viable alternative.

https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/

Originally created by @furgoose on GitHub (May 21, 2021). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1114 Is it possible to accept PROXY Protocol traffic from within the UI? If I go in and manually edit the files it works, but requesting certs resets the files so it's not really a viable alternative. https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/

kerem added the

enhancement

label

2026-02-26 06:34:57 +03:00

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@gtmadev commented on GitHub (Aug 24, 2021):

Lack of proxy protocol is a non-starter.

You can't be running this stuff in a cluster behind a cloud load balancer and then not be able to listen with proxy protocol. Without it, the applications lose the IP information from the origin client. Geo-based content becomes impossible.

I'm going to look at the source code to see if this is an easy fix. Seems like a checkbox or toggle is all that would be needed as proxy_protocol is just a single directive that goes with the listener line in NGINX.

@gtmadev commented on GitHub (Aug 24, 2021): Lack of proxy protocol is a non-starter. You can't be running this stuff in a cluster behind a cloud load balancer and then not be able to listen with proxy protocol. Without it, the applications lose the IP information from the origin client. Geo-based content becomes impossible. I'm going to look at the source code to see if this is an easy fix. Seems like a checkbox or toggle is all that would be needed as proxy_protocol is just a single directive that goes with the listener line in NGINX.

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@jc21 commented on GitHub (Aug 24, 2021):

Correct yes a simple toggle in the UI would be enough to get this moving, saved to the db table and the backend template just needs to know about that value.

This kind of thing wasn't part of the project's goal. It's generally not expected that people using this for their home gateway would be using a load balancer or HA.

@jc21 commented on GitHub (Aug 24, 2021): Correct yes a simple toggle in the UI would be enough to get this moving, saved to the db table and the backend template just needs to know about that value. This kind of thing wasn't part of the project's goal. It's generally not expected that people using this for their home gateway would be using a load balancer or HA.

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@gtmadev commented on GitHub (Aug 25, 2021):

I did some digging through the source code and I can see how to add support for this. There are models to update, etc. But.. you are correct. I also reviewed a few other things and concluded that this is a good system for a home lab, but it can't do things like setup backend streams or sets of target servers for load balancing. And without that, it would be pretty senseless to add proxy protocol because anyone utilizing proxy protocol is most certainly doing so to load balance their services.

I wouldn't mind using this in a homelab environment myself, but the problem is that I usually need to mimic the production environment as closely as possible so that I can see how things will (hopefully) work in the real world.

I think I will still spin this up though and play with it.

@gtmadev commented on GitHub (Aug 25, 2021): I did some digging through the source code and I can see how to add support for this. There are models to update, etc. But.. you are correct. I also reviewed a few other things and concluded that this is a good system for a home lab, but it can't do things like setup backend streams or sets of target servers for load balancing. And without that, it would be pretty senseless to add proxy protocol because anyone utilizing proxy protocol is most certainly doing so to load balance their services. I wouldn't mind using this in a homelab environment myself, but the problem is that I usually need to mimic the production environment as closely as possible so that I can see how things will (hopefully) work in the real world. I think I will still spin this up though and play with it.

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@ylx2016 commented on GitHub (Mar 7, 2022):

I would like to support adding listen ssl proxy_protocol,
Thanks.
like this:
listen 443 ssl http2 proxy_protocol;

@ylx2016 commented on GitHub (Mar 7, 2022): I would like to support adding listen ssl proxy_protocol, Thanks. like this: listen 443 ssl http2 proxy_protocol;

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@openncomp commented on GitHub (Jun 24, 2022):

I'm looking forward to adding this option!

@openncomp commented on GitHub (Jun 24, 2022): I'm looking forward to adding this option!

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@capthndsme commented on GitHub (Sep 30, 2022):

Hopefully I'd see this feature get supported soon.
I can think of one instance where support of proxy protocol is great for home settings: Users with two or more WANs.
Personally my old test setup with dual-wan + proxy is like this:

@capthndsme commented on GitHub (Sep 30, 2022): Hopefully I'd see this feature get supported soon. I can think of one instance where support of proxy protocol is great for home settings: Users with two or more WANs. Personally my old test setup with dual-wan + proxy is like this: ![image](https://user-images.githubusercontent.com/4083123/193192896-4573097b-a3d3-46dd-94be-697e9d5aba7d.png)

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@foxy82 commented on GitHub (Sep 30, 2022):

This also works well if you have multiple domains that you want to serve from different machines.

You can use a load balancer that splits the traffic using SNI (so it doesn't need to know about the certificate) and then proxies it on so originating IP data isn't lost.

@foxy82 commented on GitHub (Sep 30, 2022): This also works well if you have multiple domains that you want to serve from different machines. You can use a load balancer that splits the traffic using SNI (so it doesn't need to know about the certificate) and then proxies it on so originating IP data isn't lost.

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@msalman-91 commented on GitHub (Apr 13, 2023):

Hello @jc21

Is there any update is it going to be added?

@msalman-91 commented on GitHub (Apr 13, 2023): Hello @jc21 Is there any update is it going to be added?

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@Ador-able commented on GitHub (Mar 29, 2024):

Strongly needed, can this feature be included in the development plan

@Ador-able commented on GitHub (Mar 29, 2024): Strongly needed, can this feature be included in the development plan

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@julianq commented on GitHub (Jun 9, 2024):

Is this still going to be added? I need proxy protocol support for my setup, really don't want to move off of NPM.

@julianq commented on GitHub (Jun 9, 2024): Is this still going to be added? I need proxy protocol support for my setup, really don't want to move off of NPM.

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@xenadmin commented on GitHub (Oct 12, 2024):

I want to setup https://github.com/stalwartlabs/mail-server in my home environment, and I only have 1 public IP. Therefore, NPM handles all my traffic. But for stalwart mail server, I need the proxy to be able to speak PROXY protocol: https://stalw.art/docs/server/reverse-proxy/proxy-protocol

@xenadmin commented on GitHub (Oct 12, 2024): I want to setup https://github.com/stalwartlabs/mail-server in my home environment, and I only have 1 public IP. Therefore, NPM handles all my traffic. But for stalwart mail server, I need the proxy to be able to speak PROXY protocol: https://stalw.art/docs/server/reverse-proxy/proxy-protocol

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@julianq commented on GitHub (Oct 12, 2024):

I want to setup https://github.com/stalwartlabs/mail-server in my home environment, and I only have 1 public IP. Therefore, NPM handles all my traffic. But for stalwart mail server, I need the proxy to be able to speak PROXY protocol: https://stalw.art/docs/server/reverse-proxy/proxy-protocol

Have you checked out SWAG? Since there seems to be no movement on this I migrated to SWAG since you get more flexibility; it's essentially nginx with some pre-configurations (you lose the GUI). I still prefer NPM but needed proxy protocol support, may be worth checking out if you need it also.

@julianq commented on GitHub (Oct 12, 2024): > I want to setup https://github.com/stalwartlabs/mail-server in my home environment, and I only have 1 public IP. Therefore, NPM handles all my traffic. But for stalwart mail server, I need the proxy to be able to speak PROXY protocol: https://stalw.art/docs/server/reverse-proxy/proxy-protocol Have you checked out SWAG? Since there seems to be no movement on this I migrated to SWAG since you get more flexibility; it's essentially nginx with some pre-configurations (you lose the GUI). I still prefer NPM but needed proxy protocol support, may be worth checking out if you need it also.

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@sclu1034 commented on GitHub (Oct 16, 2024):

I want to setup stalwartlabs/mail-server in my home environment, and I only have 1 public IP. Therefore, NPM handles all my traffic. But for stalwart mail server, I need the proxy to be able to speak PROXY protocol: stalw.art/docs/server/reverse-proxy/proxy-protocol

Do you need NPM to proxy all ports explicitly?
I'm running docker-mailserver next to NPM just fine, with the latter listening on 80+443 and the former on all the mail stuff like 25 or 143.

Unless you have things like custom load balancing set up in your NPM config that you want to leverage by setting up a stream module, you shouldn't need NPM as a middle-man on mail ports.

@sclu1034 commented on GitHub (Oct 16, 2024): > I want to setup [stalwartlabs/mail-server](https://github.com/stalwartlabs/mail-server) in my home environment, and I only have 1 public IP. Therefore, NPM handles all my traffic. But for stalwart mail server, I need the proxy to be able to speak PROXY protocol: [stalw.art/docs/server/reverse-proxy/proxy-protocol](https://stalw.art/docs/server/reverse-proxy/proxy-protocol) Do you need NPM to proxy all ports explicitly? I'm running docker-mailserver next to NPM just fine, with the latter listening on 80+443 and the former on all the mail stuff like 25 or 143. Unless you have things like custom load balancing set up in your NPM config that you want to leverage by setting up a `stream` module, you shouldn't need NPM as a middle-man on mail ports.

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@lastsamurai26 commented on GitHub (Oct 18, 2024):

You can theoretically send the smtp imap ports directly to stalwart and only send the port 8080 for the gui via NPM, but then you have to include the certificates I think

@lastsamurai26 commented on GitHub (Oct 18, 2024): You can theoretically send the smtp imap ports directly to stalwart and only send the port 8080 for the gui via NPM, but then you have to include the certificates I think

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Apr 23, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Apr 23, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 06:34:57 +03:00

Author

Owner

@ysenner commented on GitHub (Oct 23, 2025):

I found a usable workaround for this issue.
You can add

#use proxy protocol
listen 4443 ssl proxy_protocol;
set_real_ip_from YOUR_PROXY_IP_OR_CIDR;
real_ip_header proxy_protocol;

to /data/nginx/custom/server_proxy.conf and then have all your ssl traffic come in on port 4443 (e.g. via Docker port mapping).
A different port is needed since there already is a listen 443 in the vanilla .conf we can't remove, so it is easiest to just leave it there and move to a different port.

@ysenner commented on GitHub (Oct 23, 2025): I found a usable workaround for this issue. You can add ``` #use proxy protocol listen 4443 ssl proxy_protocol; set_real_ip_from YOUR_PROXY_IP_OR_CIDR; real_ip_header proxy_protocol; ``` to `/data/nginx/custom/server_proxy.conf` and then have all your ssl traffic come in on port 4443 (e.g. via Docker port mapping). A different port is needed since there already is a `listen 443` in the vanilla .conf we can't remove, so it is easiest to just leave it there and move to a different port.

kerem referenced this issue

2026-02-26 07:32:50 +03:00

[GH-ISSUE #2713] SSL/Let's encrypt not working anymore after update or any other version #1872

Rows
Columns

[GH-ISSUE #1114] Support for PROXY Protocol #918