How to set a static ip address for an NGINX outbound proxy - OutboundGateway Blog
Log in<br>Get Started
How to set a static ip address for an NGINX outbound proxy
June 8, 2026
Tom Mikulin
Author
Table of Contents
Introduction
Quick Answer (TL;DR)
Importance of a Static IP for Outbound Proxies
Prerequisites and Requirements
How NGINX Functions as a Forward Proxy
Step-by-Step: Configure NGINX as an Outbound Proxy<br>1. Install NGINX and the Connect Module
2. Create the Forward Proxy Configuration
3. Add Proxy Authentication
4. Test the Unencrypted Proxy
5. Secure the Proxy with SSL/Let's Encrypt
Conclusion
Frequently Asked Questions (FAQs)
Introduction
While NGINX is famous as a reverse proxy - distributing incoming traffic to backend servers like Puma or Uvicorn - it can also function as a forward proxy (also known as an outbound proxy). Instead of managing requests coming in, a forward proxy routes requests going out from your internal network to the internet.
The primary use case for a static forward proxy is IP whitelisting . Many industries such as e-commerce, finance, healthcare, and security - protect their external resources behind firewalls. To access these resources, you must provide them with a static, persistent IP address that they can add to their allowlist. A single exposed resource can compromise an entire network, making strict firewall policies standard practice.
This tutorial walks through configuring NGINX as a static outbound proxy to route your traffic through a stable, whitelisted IP address.
Note: This guide assumes familiarity with the terminal, Linux servers, and basic networking concepts.
Quick Answer (TL;DR)
Setting up NGINX as an outbound proxy requires compiling the ngx_http_proxy_connect_module , configuring NGINX to handle proxy_connect directives, and securing the connection with SSL.
Below is the core NGINX configuration required for a static outbound proxy. Read the full guide for step-by-step installation and SSL setup instructions.
server {<br>listen 443 ssl;<br>server_name proxy.example.com; # Your DNS
resolver 8.8.8.8 8.8.4.4 valid=300s;<br>resolver_timeout 5s;
ssl_certificate /etc/letsencrypt/live/proxy.example.com/fullchain.pem;<br>ssl_certificate_key /etc/letsencrypt/live/proxy.example.com/privkey.pem;
more_set_input_headers "Authorization: $http_proxy_authorization";
auth_basic "Proxy Authentication";<br>auth_basic_user_file /etc/nginx/.htpasswd;
# Forward Proxy Magic<br>proxy_connect;<br>proxy_connect_allow 443 563;<br>proxy_connect_connect_timeout 60s;<br>proxy_connect_read_timeout 60s;<br>proxy_connect_send_timeout 60s;
location / {<br>proxy_http_version 1.1;<br>proxy_set_header Host $http_host;<br>proxy_pass $scheme://$http_host$request_uri;
Importance of a Static IP for Outbound Proxies
A "static" outbound proxy requires a stable outgoing IP address (or multiple IPs for high availability) for all your requests. Most cloud providers (like AWS, Google Cloud, and Azure) do not provide static IPs by default. For example, on AWS , you must assign an Elastic IP to your instance to ensure the IP persists across server restarts or stops. On Hetzner, this is known as a Floating IP.
Prerequisites and Requirements
To follow this tutorial, you need a small Ubuntu server (24.04 LTS is used here) with a static IP . You can get a highly affordable server from providers like Hetzner, but any cloud provider that allows you to attach a static IP will work.
(Refer to your specific cloud provider's documentation on how to assign a static or elastic IP to your server.)
How NGINX Functions as a Forward Proxy
Because NGINX is built primarily as a reverse proxy, it does not support forward proxying natively. To enable outbound proxy functionality, NGINX must be set up with the ngx_http_proxy_connect_module , which allows it to handle the HTTP CONNECT method used by forward proxies.
Step-by-Step: Configure NGINX as an Outbound Proxy
1. Install NGINX and the Connect Module
After provisioning your server, install NGINX, the required build libraries, and the ngx_http_proxy_connect_module .
sudo apt update<br>sudo apt install -y build-essential libpcre3-dev zlib1g-dev libssl-dev git
# download official Nginx source and the proxy module<br>mkdir ~/nginx_build && cd ~/nginx_build<br>wget http://nginx.org/download/nginx-1.24.0.tar.gz<br>tar -xzf nginx-1.24.0.tar.gz<br>git clone https://github.com/chobits/ngx_http_proxy_connect_module.git<br>git clone https://github.com/openresty/headers-more-nginx-module.git
# cd into the nginx folder<br>cd nginx-1.24.0
# patch the source so it understands the CONNECT method<br>patch -p1 /dev/null /dev/null<br>Check the NGINX configuration and restart the service, ensuring it starts automatically on boot:
sudo nginx -t<br>sudo systemctl restart nginx<br>sudo systemctl enable nginx<br>sudo systemctl status nginx
2. Create the Forward Proxy Configuration
With the module installed, create the main outbound proxy configuration file:
sudo touch /etc/nginx/sites-available/proxy.conf
Add the...