How to set up secure remote access to monitoring server using a NginX Reverse Proxy with SSL certificate

A reverse proxy protects applications against cybercriminals and malicious software. It also allows limiting access to applications based on username, IP, domain, or geographical location.

Reverse proxy includes a special network intermediary, which is located between the application user and the infrastructure where the protected applications are located. This allows you to eliminate many problems, such as the impact of DoS / DDoS attacks or application attacks. The advantage of this type of solution is also the fact that the configuration of the application behind the Reverse Proxy does not require any major changes.

Additionally, with the Reverse Proxy on NginX you can block bots (both malicious and those from search engines), and restrict access to applications based on username, IP, domain, or geographical location. So, for example, you can limit access only for admins who log in from the office and home IP, and for admins from an office located in a specific country.

Configuration of NginX and SSL


Before configuring NginX Reverse Proxy, you should do the following:

  1. Create name-to-number mapping (Host A) DNS entry, for example:
  2. Install and configure OS (preferably Linux)
  3. Create CSR - a certificate signing request
  4. Using CSR, get an SSL Certificate, at least * Wildcard
  5. Install NginX

Configuration of NginX Reverse Proxy

To configure NginX Reverse Proxy, use these following commands:

  • make a copy of the original nginx.conf file
mv /etc/nginx/nginx.conf nginx.conf.bac
  • open nginx.conf file in an editor
vi /etc/nginx/nginx.conf

Example configuration from nginx.conf file:

worker_processes auto; Error_log /var/log/nginx/error.log; Pid /run/;

Events { worker_connections 1024; }

Http { include /etc/nginx/mime.types; default_type application/octet-stream;

Log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"';

Access_log /var/log/nginx/access.log main; Sendfile on; Keepalive_timeout 65; Include /etc/nginx/conf.d/*.conf; Index index.html index.htm; }

Configuration of SSL Wildcard certificate:

  1. Copy all the files in the package from the certificate Provider to your server along with the Private Key to the appropriate directories. Best practice recommends placing the certificate files in the directory /etc/ssl on your server.
  2. Include SSL configuration to nginx.conf file, for example:

server { listen 443; ssl on; ssl_certificate /etc/ssl/your_domain_name.pem; #or bundle.crt ssl_certificate_key /etc/ssl/your_domain_name.key; server_name; access_log /var/log/nginx/nginx.vhost.access.log; error_log /var/log/nginx/nginx.vhost.error.log; location / { root /home/www/public_html/; index index.html; } }

Creating virtual host(s) configuration

We can do it using this command:

vi /etc/nginx/conf.d

Example configuration:

server { listen 80; server_name,; location / { proxy_pass; } }

Important notes

To complete the setup, remember to make sure that you

  • set firewall rules:
sudo firewall-cmd --permanent --zone=public --add-service=http 
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload
  • enable NginX service:
sudo systemctl enable nginx
  • check NginX configuration:
nginx -t

Configuration of NetCrunch to enable secure remote access to NetCrunch Server

As we mentioned at the beginning of the article, the configuration of the application itself does not require any major changes. All you have to do is to add a user in NetCrunch. To do it:

  1. Open Top Menu Tools User & Access Profiles...
  2. From the left pane select NetCrunch Users tab
  3. Click on the Add button on the bottom
  4. Provide Username, Access Profile, and Password
  5. Click OK button

From now, you will be able to open Web Console of your NetCrunch from anywhere in the world in a secure way.

Once you have created the appropriate user, enable your Web Browser, enter the appropriate address, and log in using the previously created user and password.

nginxproxyreverse proxysecurityssl

NetCrunch Network Monitoring

Network Maps, Dashboards, and Alerts.
Monitor anything. Network, cloud, config.