Mastering Nginx Reverse Proxy & Load Balancing: Best Practices for High‑Performance Deployments

1. Overview

Nginx is a high‑performance HTTP and reverse proxy server widely used in modern web architectures; over 33% of websites globally rely on it. It offers low memory consumption, powerful concurrency handling, and rich load‑balancing algorithms, making it the default choice for enterprise‑grade applications.

Reverse proxy hides backend IPs, provides a unified entry point, and supports request routing, SSL termination, and caching. Load balancing distributes traffic across multiple backends to improve throughput and reliability.

2. Technical Features

High‑performance concurrency : epoll event‑driven model supports 50k+ concurrent connections with ~10 MB memory per worker.

Rich load‑balancing algorithms : round‑robin, weighted round‑robin, IP hash, least_conn, consistent hash, etc.

Flexible reverse proxy : supports HTTP, HTTPS, WebSocket, TCP/UDP proxy, protocol conversion, and SSL offloading.

Health checks : passive and (commercial) active health checks automatically remove faulty nodes.

Hot deployment : configuration reload without downtime.

Modular architecture : third‑party modules extend rate limiting, authentication, WAF, and more.

3. Applicable Scenarios

Microservice architecture : act as API gateway for Spring Cloud, Dubbo, etc., with dynamic upstream discovery and gray releases.

High‑concurrency web apps : e‑commerce flash sales, online education, live streaming – distribute traffic to support millions of QPS.

Hybrid cloud disaster recovery : intelligent DNS routing across public clouds (AWS, Alibaba Cloud) and private data centers.

4. Environment Requirements

Component

Version

Notes

OS

CentOS 7.6+/Ubuntu 20.04+/Rocky Linux 8+

Prefer LTS releases

Nginx

1.20.1+ (stable) / 1.24+ (mainline)

Production recommends 1.20+ stable

GCC

4.8.5+

Required for source compilation

OpenSSL

1.1.1+

Needed for TLS 1.3 support

PCRE

8.40+

Regex library for rewrite module

Hardware

4 CPU 8 GB RAM (minimum) – 8 CPU 16 GB recommended

~10k concurrent connections per CPU core

Disk

System 20 GB+, Log 100 GB+

Separate log disk and rotate regularly

5. Detailed Steps

5.1 Preparation

System checks : verify OS version, ensure >4 GB free memory, >20 GB free disk, and that ports 80/443 are not in use.

Install dependencies (CentOS/Yum): gcc gcc‑c++ make zlib‑devel pcre‑devel openssl‑devel wget curl vim net‑tools telnet. (Ubuntu/Debian): build‑essential libpcre3 libpcre3‑dev zlib1g zlib1g‑dev libssl-dev libgd-dev libgeoip-dev wget curl vim net‑tools.

Create a non‑login nginx user and required directories (/data/nginx/{logs,cache,temp,proxy_temp}, /etc/nginx/{conf.d,ssl,stream.d}) with proper ownership.

5.2 Core Configuration

Compile and install Nginx with essential modules:

# download source
wget http://nginx.org/download/nginx-1.24.0.tar.gz
 tar -zxvf nginx-1.24.0.tar.gz
 cd nginx-1.24.0
# configure
./configure \
  --prefix=/usr/local/nginx \
  --user=nginx --group=nginx \
  --with-http_ssl_module \
  --with-http_v2_module \
  --with-http_realip_module \
  --with-http_stub_status_module \
  --with-http_gzip_static_module \
  --with-http_sub_module \
  --with-http_gunzip_module \
  --with-stream \
  --with-stream_ssl_module \
  --with-stream_realip_module \
  --with-stream_ssl_preread_module \
  --with-pcre \
  --with-file-aio \
  --with-threads
make -j$(nproc)
sudo make install
sudo ln -sf /usr/local/nginx/sbin/nginx /usr/local/bin/nginx
nginx -v

Main nginx.conf (optimized) :

user nginx nginx;
worker_processes auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 65535;
error_log /data/nginx/logs/error.log warn;
pid /var/run/nginx.pid;

events {
    use epoll;
    worker_connections 10240;
    multi_accept on;
}

http {
    include mime.types;
    default_type application/octet-stream;
    log_format main '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" rt=$request_time uct="$upstream_connect_time"';
    access_log /data/nginx/logs/access.log main buffer=64k flush=5s;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    client_max_body_size 100m;
    client_body_buffer_size 128k;
    client_header_buffer_size 4k;
    large_client_header_buffers 4 16k;
    gzip on;
    gzip_comp_level 6;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    gzip_vary on;
    gzip_min_length 1k;
    proxy_cache_path /data/nginx/cache levels=1:2 keys_zone=my_cache:100m max_size=10g inactive=60m use_temp_path=off;
    upstream backend_pool {
        keepalive 32;
        keepalive_timeout 60s;
        keepalive_requests 100;
        server 192.168.1.101:8080 weight=5 max_fails=3 fail_timeout=30s;
        server 192.168.1.102:8080 weight=3 max_fails=3 fail_timeout=30s;
        server 192.168.1.103:8080 weight=2 max_fails=3 fail_timeout=30s backup;
    }
    server {
        listen 80;
        server_name www.example.com example.com;
        return 301 https://$server_name$request_uri;
    }
    server {
        listen 443 ssl http2;
        server_name www.example.com;
        ssl_certificate /etc/nginx/ssl/example.com.crt;
        ssl_certificate_key /etc/nginx/ssl/example.com.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384';
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        location / {
            proxy_pass http://backend_pool;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_buffering on;
            proxy_buffer_size 8k;
            proxy_buffers 8 8k;
            proxy_cache my_cache;
            proxy_cache_valid 200 12h;
            proxy_cache_valid 404 1m;
            add_header X-Cache-Status $upstream_cache_status;
            expires 7d;
        }
        location /api/ {
            proxy_pass http://backend_pool;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 10s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_next_upstream error timeout http_500 http_502 http_503;
            proxy_next_upstream_tries 2;
            proxy_next_upstream_timeout 15s;
        }
        location /nginx_status {
            stub_status on;
            access_log off;
            allow 127.0.0.1;
            deny all;
        }
    }
}

5.3 Sample Configurations

High‑availability dual‑node (active‑passive) example :

# /etc/nginx/conf.d/ha_reverse_proxy.conf
upstream backend_cluster {
    hash $request_uri consistent;
    server 10.0.1.11:8080 weight=10 max_fails=3 fail_timeout=30s;
    server 10.0.1.12:8080 weight=10 max_fails=3 fail_timeout=30s;
    server 10.0.1.13:8080 weight=10 max_fails=3 fail_timeout=30s;
    server 10.0.1.14:8080 weight=10 max_fails=3 fail_timeout=30s;
    server 10.0.2.11:8080 weight=1 max_fails=2 fail_timeout=10s backup;
    server 10.0.2.12:8080 weight=1 max_fails=2 fail_timeout=10s backup;
    keepalive 128;
    keepalive_timeout 90s;
}
server {
    listen 80;
    server_name www.production.com;
    return 301 https://$server_name$request_uri;
}
server {
    listen 443 ssl http2;
    server_name www.production.com;
    ssl_certificate /etc/nginx/ssl/production.com.crt;
    ssl_certificate_key /etc/nginx/ssl/production.com.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    log_format json_log '{"time":"$time_iso8601","remote_addr":"$remote_addr","request":"$request","status":$status,"body_bytes_sent":$body_bytes_sent,"request_time":$request_time,"upstream_response_time":"$upstream_response_time","upstream_addr":"$upstream_addr","http_user_agent":"$http_user_agent","http_referer":"$http_referer"}';
    access_log /data/nginx/logs/production.access.log json_log buffer=64k flush=5s;
    location / {
        proxy_pass http://backend_cluster;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_buffering on;
        proxy_buffer_size 8k;
        proxy_buffers 16 8k;
        limit_req zone=global_limit burst=2000 nodelay;
        limit_conn conn_limit 50;
    }
}

5.4 Real‑World Cases

Case 1 – E‑commerce flash‑sale : 20 k+ QPS during Double 11, using weighted round‑robin and per‑IP rate limiting. Achieved 218 k QPS peak, 120 ms average latency, 78% cache hit, and 42% request drop due to rate limiting, protecting backend services.

Case 2 – Cross‑border intelligent routing : GeoIP2 module directs traffic to China, US, or EU data centers based on client country code. Latency reduced from 380 ms to 45 ms for Chinese users and from 420 ms to 38 ms for European users, with 72% overall TTFB improvement.

6. Best Practices & Cautions

6.1 Performance Optimizations

Kernel tuning : increase fs.file‑max, net.ipv4.tcp_max_syn_backlog, net.core.somaxconn, enable tcp_tw_reuse, adjust ip_local_port_range, and raise user limits for nofile and nproc.

Enable HTTP/2 and QUIC : use "listen 443 ssl http2 quic" and set appropriate ssl_protocols and Alt‑Svc header.

Buffer sizing : small buffers (8k) for APIs, large buffers (128k) for big files; optionally map $request_length to dynamic buffer sizes.

6.2 Security Hardening

Disable server version: server_tokens off; and hide Server header.

Enforce request size limits: client_max_body_size 10m; and large_client_header_buffers 4 8k;.

Block unsafe HTTP methods (TRACE, TRACK, DELETE, OPTIONS) via map and conditional return.

Prevent Slowloris attacks by setting client_body_timeout 10s;, client_header_timeout 10s;, send_timeout 30s; and reset_timedout_connection on;.

6.3 High Availability

Keepalived VRRP for active‑passive IP failover (example config provided).

DNS‑based multi‑active routing (GeoDNS) for cross‑region resilience.

Version control of configs with Git and automated backups.

6.4 Common Pitfalls

Incorrect proxy_pass trailing slash leads to unexpected URI rewriting.

Static upstream hostnames resolve only at start‑up; use resolver or dynamic modules for DNS updates.

Never trust client‑provided X‑Forwarded‑For; use $proxy_add_x_forwarded_for instead.

7. Troubleshooting & Monitoring

7.1 Log Analysis

# syntax check
nginx -t
# tail access and error logs
tail -f /data/nginx/logs/access.log
grep "ERROR" /data/nginx/logs/error.log | tail -50
# count 502 errors per backend
awk '$9 == 502 {print $NF}' /data/nginx/logs/access.log | sort | uniq -c | sort -rn
# top 10 slow requests (assuming $request_time logged)
awk '{split($NF,a,"="); if(a[2]>1) print a[2],$7}' /data/nginx/logs/access.log | sort -rn | head -10

7.2 Performance Metrics

CPU 70% – 85% (alert >85%).

Memory < 50% (alert >80%).

Active connections approaching 70% of worker_connections (alert >80%).

P99 response < 500 ms (alert >2 s).

5xx error rate < 0.01% (alert >1%).

Cache hit > 60% (alert < 30%).

SSL handshake < 100 ms (alert >500 ms).

Prometheus rule examples and Grafana dashboard JSON are provided for automated alerting and visualization.

7.3 Backup & Restore

Backup script ( /usr/local/bin/nginx_backup.sh) archives configuration, SSL certificates, and recent logs, rotates older backups, verifies integrity, and optionally uploads to object storage. Restoration steps: stop Nginx, extract archives, verify syntax with nginx -t, and restart.

8. Conclusion

8.1 Key Takeaways

Choose load‑balancing algorithm based on workload: round‑robin for uniform traffic, IP hash for session persistence, least_conn for long‑lived connections, consistent hash for cache‑friendly services.

Optimize core parameters ( worker_processes auto, worker_connections, keepalive settings) and tune kernel limits for high concurrency.

Implement health checks, rate limiting, and SSL hardening to ensure reliability and security.

Design multi‑layer HA (DNS → LVS → Nginx) and use Git‑based config management for safe deployments.

Continuously monitor key metrics (CPU, memory, active connections, latency, error rates) and set alert thresholds.

8.2 Further Learning Paths

Nginx module development : write custom HTTP filters, understand event loop, study open‑source modules.

OpenResty API gateway : Lua scripting for dynamic routing, authentication, rate limiting; explore Kong/APISIX.

Kubernetes cloud‑native deployment : nginx‑ingress‑controller, Cert‑Manager for automated TLS, integration with Service Mesh.

8.3 References

Nginx official documentation.

OpenResty best‑practice guide.

"Nginx Development from Beginner to Expert" (Alibaba T‑Engine).

GitHub – nginx/nginx source code.

Nginx Admin’s Handbook.

SSL Labs SSL Test.

Nginx configuration generators.

Appendix

A. Command Cheat Sheet

# Test config
nginx -t
# Reload without downtime
nginx -s reload
# Graceful stop
nginx -s quit
# View active connections
curl http://127.0.0.1/nginx_status
# Top 10 IPs
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -10
# Top 10 URLs
awk '{print $7}' access.log | sort | uniq -c | sort -rn | head -10
# ApacheBench
ab -n 10000 -c 100 http://localhost/
# wrk
wrk -t12 -c400 -d30s http://localhost/

B. Parameter Details

Core : worker_processes auto, worker_cpu_affinity auto, worker_rlimit_nofile 65535, events { worker_connections 10240; }.

HTTP : sendfile on, tcp_nopush on, tcp_nodelay on, keepalive_timeout 65, client_max_body_size 100m.

Proxy : proxy_connect_timeout 10s, proxy_send_timeout 30s, proxy_read_timeout 30s, proxy_buffering on, proxy_buffer_size 8k, proxy_buffers 8 8k, proxy_http_version 1.1, proxy_set_header Connection "".

Upstream : weight, max_fails, fail_timeout, backup, keepalive, keepalive_timeout.

C. Glossary

Term

English

Explanation

反向代理

Reverse Proxy

Server receives client requests and forwards them to backend servers, returning the response.

负载均衡

Load Balancing

Distributes traffic across multiple servers to increase throughput and availability.

上游服务器

Upstream Server

Backend application servers proxied by Nginx.

健康检查

Health Check

Periodically tests backend health and automatically removes failed nodes.

会话保持

Session Persistence

Ensures the same client is routed to the same backend.

零拷贝

Zero Copy

Data transferred directly in kernel space without user‑space copying.

平滑升级

Graceful Upgrade

Upgrade Nginx without interrupting service.

SSL卸载

SSL Offloading

Terminate TLS at Nginx, backend communicates via HTTP.

一致性哈希

Consistent Hashing

Hash algorithm that minimizes key redistribution when nodes change.

限流

Rate Limiting

Restricts request frequency to protect resources.

缓存

Cache

Temporary storage of responses to reduce backend load.

四层代理

Layer 4 Proxy

TCP/UDP level proxy without HTTP parsing.

七层代理

Layer 7 Proxy

Application‑level proxy that parses HTTP.

QPS

Queries Per Second

Metric measuring request throughput.

TTFB

Time To First Byte

Latency from request start to first byte received.

RTO

Recovery Time Objective

Maximum acceptable downtime after a failure.