Ravindra BagaleCourses & study guides मराठी Track your progress

Chapter 8: Configuring Nginx and Apache

8.6 Task: run a site on a different port

By Last updated:

The Amul-style dairy needs an admin panel that opens only from the office. Sometimes a second site or an admin panel must run on another port, e.g. 8081.

# Nginx: /etc/nginx/conf.d/admin.conf   (Ubuntu: sites-available + symlink)
server {
    listen 8081;
    server_name _;
    root /var/www/admin;
    index index.html;
}

# Apache (AL2023/CentOS): add to /etc/httpd/conf.d/admin.conf
Listen 8081
<VirtualHost *:8081>
    DocumentRoot /var/www/admin
    <Directory /var/www/admin>
        Require all granted
    </Directory>
</VirtualHost>

On Ubuntu Apache, put Listen 8081 in /etc/apache2/ports.conf (not in the vhost file). Then:

  1. Test and reload the web server.
  2. Check that it listens: sudo ss -tlnp | grep 8081.
  3. Security group: add an inbound rule Custom TCP 8081 (from My IP for admin pages).
  4. CentOS Stream 9: open firewalld if active (sudo firewall-cmd --permanent --add-port=8081/tcp && sudo firewall-cmd --reload) and allow the port in SELinux:
sudo semanage port -l | grep -w http_port_t              # ports web servers may bind to
sudo semanage port -a -t http_port_t -p tcp 8081          # add 8081 if not listed

Without the SELinux step, the service fails to start with bind() to 0.0.0.0:8081 failed (13: Permission denied).

Ravindra Bagale's Tip

Many students set port 8081 in the config but don't add a rule in the security group, and the browser times out. A new port means three places: the config, the security group (My IP for admin), and on CentOS, firewalld and semanage port.

Lab

Chala, Nginx kiwa Apache var /var/www/admin sathi port 8081 var site chalu kara aani sudo ss -tlnp | grep 8081 ne listen hota ka te bagha. Mag security group madhe Custom TCP 8081 fakt My IP sathi add karun browser madhe http://<PUBLIC_IP>:8081 ughda.

Why run on another port, and the safe way to do it

Admin panels, staging copies and internal tools often run on a separate port. Done safely, that port is open only to the people who need it.

  1. Choose a port, for example 8081.
  2. Add the listen and site block (as shown above).
  3. Test and reload.
  4. Check that it is listening with ss -tlnp.
  5. Open the port in the security group from your own IP only.
  6. Test from your laptop. Then test from mobile data, where it should fail.
Admin on 8081Office IPSecurity group8081 from office onlynginx :8081Admin site
Only the office IP can reach 8081. Everyone else gets a timeout.

Common ports for other apps (and who should reach them)

When an app runs on its own port, put nginx in front and keep the app port private.

Tomcat / Spring Boot

8080. Proxy it with nginx and do not open 8080 publicly.

ASP.NET Core

5000 (or 8080 in .NET 8 containers).

Node.js / Express

3000.

Python: Flask 5000, Django 8000, FastAPI with Uvicorn 8000

Bind to 127.0.0.1.

Databases: MySQL 3306, PostgreSQL 5432, MongoDB 27017, Redis 6379

Allow these only from the app server's security group. Never from 0.0.0.0/0.

Cloud alternatives

Instead of opening a port at all, use AWS Systems Manager Session Manager port forwarding, Azure Bastion or GCP IAP TCP forwarding to reach admin tools privately.

aws ssm start-session --target i-0abc --document-name AWS-StartPortForwardingSession --parameters portNumber=8081,localPortNumber=8081

What you see:

Port 8081 opened for sessionId ...

Real example

Global: exposed admin panels (Jenkins on 8080, database admin tools, Kubernetes dashboards) are a common starting point for attacks reported in the news. Keeping admin ports IP-restricted or private avoids most of them.

Recap

  • Separate port + IP-restricted security group.
  • Keep app and database ports private and proxy through nginx.