DEV Community

Ramer Labs
Ramer Labs

Posted on

7 Tips for Securing Nginx with TLS and Firewall Rules Now

#nginx #security #linux #devops

Introduction

If you’re a DevOps lead responsible for public‑facing services, Nginx is probably the front‑line web server or reverse proxy in your stack. While it’s lightning‑fast, a mis‑configured instance can become an easy target for attackers. This tutorial walks you through a practical, step‑by‑step hardening checklist that covers TLS best practices, firewall rules, and a few often‑overlooked Linux tweaks.

1. Obtain a Strong TLS Certificate

Use Let’s Encrypt for Automation 

# Install certbot (Debian/Ubuntu example)
sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx

# Request a certificate for example.com and www.example.com
sudo certbot --nginx -d example.com -d www.example.com
Enter fullscreen mode Exit fullscreen mode
  • Certbot automatically edits your Nginx config to enable HTTPS.
  • It also sets up a systemd timer for automatic renewal.

Prefer ECDSA Over RSA

If your client base includes modern browsers, generate an ECDSA key for better performance:

sudo openssl ecparam -genkey -name secp384r1 -out /etc/ssl/private/example.com.key
sudo openssl req -new -key /etc/ssl/private/example.com.key -out /etc/ssl/csr/example.com.csr
# Then use certbot with the --key-type ecdsa flag
sudo certbot --nginx --key-type ecdsa -d example.com -d www.example.com
Enter fullscreen mode Exit fullscreen mode

2. Harden the Nginx TLS Configuration

Create a dedicated snippet called ssl-strong.conf and include it in your server blocks.

# /etc/nginx/snippets/ssl-strong.conf
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers \
    "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256";
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options DENY;
add_header X-XSS-Protection "1; mode=block";
Enter fullscreen mode Exit fullscreen mode

Then reference it:

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    include snippets/ssl-strong.conf;
    # …rest of config…
}
Enter fullscreen mode Exit fullscreen mode

3. Enable HTTP/2 and Brotli Compression

HTTP/2 reduces latency, while Brotli offers better compression ratios than gzip.

# Enable HTTP/2 in the listen directive (already shown above)
# Install Brotli module (Debian example)
sudo apt-get install -y nginx-module-brotli

# Add Brotli settings
brotli on;
brotli_comp_level 6;
brotli_types text/plain text/css application/javascript application/json image/svg+xml;
Enter fullscreen mode Exit fullscreen mode

4. Restrict Access with a Host‑Based Firewall

Using UFW (Uncomplicated Firewall) 

sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (limit to 5 attempts per minute)
sudo ufw limit 22/tcp

# Allow HTTP/HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

sudo ufw enable
Enter fullscreen mode Exit fullscreen mode

Fine‑Grained iptables Example

If you need more control, drop traffic from known malicious IP ranges:

# Block a CIDR (example)
sudo iptables -A INPUT -s 185.220.101.0/24 -j DROP

# Log and drop malformed packets
sudo iptables -A INPUT -p tcp --tcp-flags ALL NONE -j LOG --log-prefix "[DROP NULL] "
sudo iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
Enter fullscreen mode Exit fullscreen mode

Persist rules with iptables-persistent or netfilter-persistent.

5. Deploy Fail2Ban for Brute‑Force Protection

Fail2Ban monitors log files and bans IPs that show malicious signs.

sudo apt-get install -y fail2ban
Enter fullscreen mode Exit fullscreen mode

Create a custom jail for Nginx:

# /etc/fail2ban/jail.d/nginx-http-auth.conf
[nginx-http-auth]
enabled = true
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
maxretry = 3
bantime = 3600
Enter fullscreen mode Exit fullscreen mode

The built‑in nginx-http-auth filter catches repeated 401 responses.

6. Secure File Permissions and Ownership 

# Nginx binary and config files should be owned by root:root
sudo chown -R root:root /etc/nginx
sudo chmod -R 644 /etc/nginx/*.conf
sudo chmod 600 /etc/ssl/private/*.key

# Serve static content with a non‑privileged user (www-data)
sudo chown -R www-data:www-data /var/www/html
Enter fullscreen mode Exit fullscreen mode

Avoid running Nginx as root; the master process runs as root only to bind privileged ports, while workers run as www-data.

7. Automate Monitoring and Renewal

SSL Certificate Renewal

Certbot already creates a systemd timer, but verify it:

systemctl list-timers | grep certbot
Enter fullscreen mode Exit fullscreen mode

Health Checks

Add a simple /healthz endpoint that returns 200 OK:

location = /healthz {
    access_log off;
    return 200 "OK";
    add_header Content-Type text/plain;
}
Enter fullscreen mode Exit fullscreen mode

Integrate this endpoint with your monitoring stack (Prometheus node exporter, UptimeRobot, etc.) to get instant alerts if Nginx crashes.

Conclusion

Hardening Nginx is a combination of cryptographic hygiene, network‑level gating, and disciplined operational practices. By following these seven tips—obtaining a strong TLS certificate, tightening cipher suites, enabling HTTP/2 and Brotli, locking down the firewall, adding Fail2Ban, tightening file permissions, and automating monitoring—you’ll dramatically reduce the attack surface of any web service.

If you’re looking for a reliable partner to review your Nginx hardening checklist or need hands‑on assistance with cloud‑native deployments, consider checking out https://lacidaweb.com for practical guidance and support.

Top comments (0)