How to Use Apache as a Reverse Proxy (mod_proxy)

Applies to: Apache 2.4 on Ubuntu 24.04, Debian 13, AlmaLinux and Rocky Linux 9

A reverse proxy receives visitors’ requests on ports 80 and 443 and passes them to an application running on another port, such as a Node.js, Python or Java app on port 3000. Apache does this with mod_proxy. We tested the configuration below with Apache 2.4.68 and a small app on port 3000.

1. Enable the modules

sudo a2enmod proxy proxy_http headers      # Ubuntu, Debian
sudo systemctl restart apache2

On AlmaLinux and Rocky Linux the modules are loaded by default (check with httpd -M | grep proxy).

2. Add a virtual host

Create /etc/apache2/sites-available/app.conf (Ubuntu, Debian) or /etc/httpd/conf.d/app.conf (AlmaLinux, Rocky Linux):

<VirtualHost *:80>
    ServerName app.example.com

    ProxyPreserveHost On
    ProxyPass        / http://127.0.0.1:3000/
    ProxyPassReverse / http://127.0.0.1:3000/
</VirtualHost>

• ProxyPass sends requests to the app; ProxyPassReverse fixes redirect headers coming back from it.
• ProxyPreserveHost On passes the original host name to the app.
• To proxy only part of a site, use a path: ProxyPass /app/ http://127.0.0.1:3000/.

sudo a2ensite app && sudo apachectl configtest && sudo systemctl reload apache2   # Ubuntu, Debian
sudo apachectl configtest && sudo systemctl reload httpd                         # AlmaLinux, Rocky Linux

3. Add HTTPS

Get a certificate with Certbot (sudo certbot --apache -d app.example.com). If the app needs to know that visitors use HTTPS, add RequestHeader set X-Forwarded-Proto "https" in the HTTPS virtual host.

4. Keep the app private

Make the app listen on 127.0.0.1 only (as our test app did), or block its port in the firewall, so visitors can reach it only through Apache and not directly on port 3000.

WebSockets

For apps that use WebSockets (chat, live dashboards), also enable proxy_wstunnel and add ProxyPass / ws://127.0.0.1:3000/ upgrade=websocket before the normal ProxyPass line (Apache 2.4.47 and later).

SELinux on AlmaLinux and Rocky Linux

If Apache logs Permission denied: AH00957, allow it to make network connections: sudo setsebool -P httpd_can_network_connect 1.

Prefer Nginx? See Nginx as a reverse proxy for Apache and n8n behind Nginx with free SSL.