---
title: "Install nginx secure on Ubuntu 22.04, 20.04, 18.04"
description: "Discover install nginx secure on ubuntu 22.04, 20.04, 18.04 with this in-depth guide, providing actionable insights and practical tips to boost your knowledge and results."
date: 2023-10-19
tags:
  - "install"
  - "nginx"
  - "secure"
authors:
  - "Cojocaru David"
  - "ChatGPT"
slug: "install-nginx-secure"
updatedDate: 2025-05-02
---

# How to Install and Secure Nginx on Ubuntu 22.04, 20.04, or 18.04  

Want to install and secure Nginx on Ubuntu 22.04, 20.04, or 18.04? This step-by-step guide covers everything—from installing Nginx and configuring a firewall with `iptables` to setting up free SSL certificates with Let’s Encrypt. Follow these best practices to ensure a fast, secure, and optimized web server.  

> "Security is not a product, but a process." — Bruce Schneier  

## Prerequisites  

Before starting, ensure you have:  
- A server running **Ubuntu 22.04, 20.04, or 18.04**.  
- A **non-root user with sudo privileges**.  
- An updated system (run `sudo apt update && sudo apt upgrade -y`).  

## Step 1: Install Nginx and Required Packages  

Install Nginx along with essential security tools:  

```bash  
sudo apt install nginx iptables-persistent certbot python3-certbot-nginx curl -y  
```  

After installation, verify Nginx is running:  

```bash  
sudo systemctl status nginx  
```  

## Step 2: Configure the Firewall for Security  

Secure your server by allowing only necessary traffic:  

### Allow HTTP and HTTPS  
```bash  
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT  
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT  
```  

### Rate-Limit Connections (Prevent DDoS)  
```bash  
sudo iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 --connlimit-mask 24 -j DROP  
sudo iptables -A INPUT -p tcp --syn --dport 443 -m connlimit --connlimit-above 20 --connlimit-mask 24 -j DROP  
```  

### Block Invalid Packets  
```bash  
iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP  
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP  
```  

Save firewall rules permanently:  
```bash  
sudo netfilter-persistent save  
```  

## Step 3: Set Up Let’s Encrypt SSL  

### Edit Nginx Configuration  
Open the default config file:  
```bash  
sudo nano /etc/nginx/sites-available/default  
```  

Replace `server_name _;` with your domain:  
```bash  
server_name example.com www.example.com;  
```  

### Obtain SSL Certificate  
Run Certbot to generate a free SSL certificate:  
```bash  
sudo certbot --nginx -d example.com -d www.example.com  
```  

Follow the prompts to complete setup.  

## Step 4: Optimize Nginx for Security and Performance  

Update `/etc/nginx/sites-available/default` with these security headers and optimizations:  

```bash  
server_tokens off;  

server {  
    listen 80;  
    server_name example.com www.example.com;  
    return 301 https://$host$request_uri;  
}  

server {  
    listen 443 ssl http2;  
    server_name example.com www.example.com;  

    # SSL and security headers  
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;  
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;  
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";  
    add_header X-Frame-Options SAMEORIGIN;  
    add_header X-Content-Type-Options nosniff;  

    # Performance optimizations  
    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {  
        expires 1y;  
        access_log off;  
        add_header Cache-Control "public";  
    }  
}  
```  

Test and restart Nginx:  
```bash  
sudo nginx -t && sudo systemctl restart nginx  
```  

## Step 5: Verify and Maintain Security  

- **Check SSL**: Use [SSL Labs](https://www.ssllabs.com/ssltest/) to test your configuration.  
- **Auto-Renew Certificates**: Ensure Certbot auto-renewal is active:  
  ```bash  
  sudo certbot renew --dry-run  
  ```  

#nginx #ubuntu #websecurity #devops #letsencrypt