fren
Log In

Install Nginx on Debian

2 min read07 November 2026

Nginx serves static files and forwards requests to an application. It is often the first package installed on a VPS, and also the first source of confusion: an active service does not mean it is reachable from outside. This procedure covers installation, local testing, the firewall and verification from the Internet over both IPv6 and IPv4.

Install and start

Bash
sudo apt update
sudo apt install nginx
sudo systemctl status nginx
sudo systemctl is-enabled nginx

The Debian package installs, starts and enables the service automatically. status must show active (running). If it fails, sudo nginx -t validates the configuration and journalctl -u nginx -n 50 gives the cause.

Useful files:

  • /etc/nginx/nginx.conf: main configuration.
  • /etc/nginx/sites-available/: available site blocks.
  • /etc/nginx/sites-enabled/: links to active sites.
  • /var/www/html/: default page root.
  • /var/log/nginx/access.log and error.log: logs.

Test locally

Bash
curl -I http://127.0.0.1
curl -I http://[::1]
sudo ss -ltnp | grep ':80 '

You should get HTTP/1.1 200 OK or a redirect, and see Nginx listening on port 80 over IPv4 and IPv6. Debian's default configuration contains listen 80 default_server; and listen [::]:80 default_server;. If only IPv4 answers, check that the IPv6 line was not removed.

curl locally bypasses the firewall: local success does not prove the port is open from outside.

Open the firewall

With UFW:

Bash
sudo ufw allow 'Nginx Full'
sudo ufw status

The Nginx Full application opens 80 and 443. If you do not use HTTPS yet, sudo ufw allow 'Nginx HTTP' is enough. List available profiles with sudo ufw app list.

Open the firewall before testing from outside, otherwise you cannot tell whether the failure comes from filtering or Nginx. Keep SSH allowed throughout any change.

Verify from outside

Get the public IPv6 address:

Bash
ip -6 addr show scope global

Then, from another machine:

Bash
curl -6 -I http://[VOTRE_IPV6]
curl -4 -I http://VOTRE_IPV4

A timeout points to a firewall or to the absence of a dedicated IPv4. A 502 makes no sense here: without an application configuration, Nginx serves the default page. Check access.log to confirm the request arrives, and error.log for configuration errors.

  • Do not replace the default page with a file outside /var/www/html without adjusting the root.
  • Never set the web root to 777: Nginx needs read access, not write.
  • Reload with sudo nginx -t && sudo systemctl reload nginx after every change.
  • Keep Nginx updated and check log rotation.

Verify

Bash
sudo nginx -t
systemctl is-active nginx
curl -sI http://localhost | head -1

nginx -t must answer syntax is ok and test is successful. If the test fails, fix the reported line before reloading: a reload with an invalid configuration keeps the old version active, but the error returns at the next restart.

Advertisement

Was this article helpful?

Read next