LFCE 45 🐧 Web Server — Nginx Installation - KandZ

⏱️ Estimated read: 11 min | |

Nginx is a web server, reverse proxy, and load balancer. The installation itself is a single package manager command, but the service that results from it is not running until it is started, not reachable until the firewall permits it, and not verified until a client requests a page from it. The previous chapters covered DNS and DHCP, which provide name resolution and address assignment. This chapter covers the first of the application services those protocols support: the web server that listens on port 80 and answers HTTP requests.

The installation procedure differs between the Debian family and the RHEL family in the package manager command and the firewall tool, but the resulting service is the same. Nginx installs with a default configuration that serves a welcome page from /var/www/html, listens on port 80, and logs to /var/log/nginx/. The administrator’s task is to install the package, start and enable the service, open the firewall, and verify that the welcome page is reachable.

Key point: Installing the package does not start the service on all distributions. On Debian and Ubuntu, the apt install command starts nginx automatically. On RHEL and its derivatives, the service must be started explicitly with systemctl start nginx. In both cases, the service must be enabled to start at boot, and the firewall must permit HTTP traffic before a remote client can reach the default page.

Why installation requires distribution-specific steps

The package-name problem.

The nginx package is named nginx on both families, but the repository that provides it differs. On Debian and Ubuntu, the package is in the default apt repositories. On RHEL, Rocky Linux, and Fedora, the package is available in the AppStream repository, but the official nginx repository provides newer versions and is the recommended source when a specific version is required . The installation command is apt install nginx on Debian and dnf install nginx on RHEL.

The firewall problem.

Debian and Ubuntu commonly use ufw, which provides application profiles. The command ufw allow 'Nginx HTTP' opens port 80 using the profile that the nginx package installs . RHEL and its derivatives use firewalld, which does not have an nginx-specific profile but provides the http service definition. The command firewall-cmd --permanent --add-service=http opens port 80, and firewall-cmd --reload applies the change .

The service-start problem.

The Debian package starts the service automatically after installation. The RHEL package does not; the service remains stopped until systemctl start nginx is run. The systemctl enable nginx command is separate from the start command and controls whether the service starts at boot. On modern systemd systems, systemctl enable --now nginx combines both operations .

a. Installing on Debian and Ubuntu

The default repositories contain a stable nginx package. The installation is two commands: update the package index, then install the package.

# Update the package index
sudo apt update

# Install nginx from the default repository
sudo apt install nginx -y

# Verify the installed version
nginx -v
# Output: nginx version: nginx/1.24.0 (Ubuntu)

The -y flag accepts the installation prompt automatically. The version that is installed depends on the distribution release; Ubuntu 24.04 provides nginx 1.24.0 . After installation, the service is started automatically by the package’s post-installation script. The systemctl status nginx command confirms that it is running.

The official nginx repository provides newer versions than the distribution’s default repository. Adding it requires importing the signing key, adding the repository, and pinning the nginx packages to prefer the official source . This is optional for a basic installation but necessary when a specific version or the mainline branch is required.

b. Installing on RHEL and its derivatives

The AppStream repository provides an nginx package, but the official nginx repository is the recommended source for the current stable version. The repository configuration is a single file that points to nginx.org.

# Create the nginx repository file
sudo tee /etc/yum.repos.d/nginx.repo <<'EOF'
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
EOF

# Install nginx
sudo dnf install nginx -y

# Start and enable the service
sudo systemctl start nginx
sudo systemctl enable nginx

The module_hotfixes=true line is required on RHEL 8 and later because the nginx packages are built against a different module stream than the default AppStream packages . Without it, the installation may fail with a module conflict.

The service does not start automatically on RHEL. The systemctl start nginx command starts it, and systemctl enable nginx configures it to start at boot. The combined form systemctl enable --now nginx performs both operations in one command .

c. Opening the firewall and verifying the service

The firewall must permit HTTP traffic before a remote client can reach the default page. The command differs between ufw and firewalld.

# Debian/Ubuntu with ufw
sudo ufw allow 'Nginx HTTP'
sudo ufw status

# RHEL/Rocky with firewalld
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

The ufw allow 'Nginx HTTP' command uses the application profile that the nginx package installs. It opens port 80 for both IPv4 and IPv6 . The firewall-cmd commands open the http and https services permanently and reload the firewall to apply the changes .

Verification has two parts: confirming that the service is listening on port 80, and confirming that a client can retrieve the default page.

# Confirm nginx is listening on port 80
sudo ss -antpl | grep nginx
# Output: LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=...))

# Test locally with curl
curl -I http://localhost
# Output: HTTP/1.1 200 OK
#         Server: nginx/1.24.0 (Ubuntu)

The ss command confirms that the nginx process has bound to port 80. The curl -I command retrieves the HTTP headers from the local server and confirms that it returns 200 OK. A browser request to the server’s IP address returns the default “Welcome to nginx!” page .

Complete Example Session

# ============================================
# PART 1: UPDATE THE PACKAGE INDEX (DEBIAN)
# ============================================
sudo apt update

# ============================================
# PART 2: INSTALL NGINX
# ============================================
sudo apt install nginx -y

# ============================================
# PART 3: VERIFY THE INSTALLED VERSION
# ============================================
nginx -v
# Output: nginx version: nginx/1.24.0 (Ubuntu)

# ============================================
# PART 4: CHECK THE SERVICE STATUS
# ============================================
sudo systemctl status nginx
# The Debian package starts the service automatically
# Output should show "active (running)"

# ============================================
# PART 5: ENABLE THE SERVICE AT BOOT
# ============================================
sudo systemctl enable nginx

# ============================================
# PART 6: OPEN THE FIREWALL (UFW)
# ============================================
sudo ufw allow 'Nginx HTTP'
sudo ufw status
# Output includes: Nginx HTTP ALLOW Anywhere

# ============================================
# PART 7: CONFIRM THE LISTENING PORT
# ============================================
sudo ss -antpl | grep nginx
# Output: LISTEN 0 511 0.0.0.0:80

# ============================================
# PART 8: TEST LOCALLY WITH CURL
# ============================================
curl -I http://localhost
# Output: HTTP/1.1 200 OK

# ============================================
# PART 9: TEST FROM A REMOTE CLIENT
# ============================================
# From another machine on the network:
# curl http://<server-ip>
# The default "Welcome to nginx!" page is returned

# ============================================
# PART 10: INSPECT THE DEFAULT CONFIGURATION
# ============================================
ls -l /etc/nginx/
# Output: nginx.conf, sites-available/, sites-enabled/, conf.d/
cat /etc/nginx/sites-enabled/default
# The default server block listens on port 80 and serves /var/www/html

The ten parts demonstrate the complete installation and verification workflow: package update, installation, version check, service status, boot enablement, firewall opening, port verification, local test, remote test, and configuration inspection. The critical verification steps are Parts 7 and 8: the service must be listening, and it must return a successful HTTP response.

Quick Reference

Installation Commands

Distribution	Install Command	Service Start
Debian / Ubuntu	`apt install nginx`	Automatic
RHEL / Rocky / Fedora	`dnf install nginx`	`systemctl start nginx`

Firewall Commands

Firewall	Open HTTP	Apply
ufw	`ufw allow 'Nginx HTTP'`	Automatic
firewalld	`firewall-cmd --permanent --add-service=http`	`firewall-cmd --reload`

Service Management

Command	Purpose
`systemctl start nginx`	Start the service
`systemctl enable nginx`	Start at boot
`systemctl enable --now nginx`	Start and enable in one command
`systemctl status nginx`	Check service state
`systemctl reload nginx`	Re-read configuration without dropping connections

Verification Commands

Command	Purpose
`nginx -v`	Show installed version
`ss -antpl \| grep nginx`	Confirm listening on port 80
`curl -I http://localhost`	Test local HTTP response
`ls /etc/nginx/`	Inspect configuration directory

Best Practices

✅ Do This:

# Update the package index before installing
apt update                                                     # ✅

# Enable the service at boot
systemctl enable nginx                                         # ✅

# Open the firewall for HTTP
ufw allow 'Nginx HTTP'                                         # ✅

# Verify the service is listening on port 80
ss -antpl | grep nginx                                         # ✅

# Test with curl before testing from a remote client
curl -I http://localhost                                       # ✅

# Use the official nginx repository on RHEL for current versions
# The repository file with module_hotfixes=true is required      # ✅

❌ Don’t Do This:

# Assume the service is running after installation on RHEL
# The RHEL package does not start the service automatically      # ❌

# Forget to reload the firewall after adding the service
firewall-cmd --permanent --add-service=http    # Not active until reload # ❌

# Test only from the local host
# A local curl succeeds even if the firewall blocks remote access # ❌

# Install from a third-party repository without checking the GPG key
# Verify the nginx signing key fingerprint                       # ❌

# Use reload when a restart is required
# reload does not apply changes that require a new process       # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Remote client cannot reach the server	Firewall does not permit HTTP	Open port 80 with `ufw` or `firewall-cmd`
Service not running after install on RHEL	RHEL package does not auto-start	`systemctl start nginx`
Service does not start at boot	Not enabled	`systemctl enable nginx`
Port 80 already in use	Another web server is running	`ss -antpl \| grep :80` to identify
RHEL installation fails with module conflict	`module_hotfixes` missing from repo file	Add `module_hotfixes=true`
`nginx -t` fails after configuration change	Syntax error in config	`nginx -t` reports the file and line

Real-World Examples

1. Debian installation

sudo apt update && sudo apt install nginx -y

2. RHEL installation from official repo

sudo tee /etc/yum.repos.d/nginx.repo <<'EOF'
[nginx-stable]
name=nginx stable repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true
EOF
sudo dnf install nginx -y

3. Start and enable

sudo systemctl enable --now nginx

4. Open ufw

sudo ufw allow 'Nginx HTTP'

5. Open firewalld

sudo firewall-cmd --permanent --add-service=http && sudo firewall-cmd --reload

6. Check listening port

sudo ss -antpl | grep nginx

7. Test locally

curl -I http://localhost

8. Check version

nginx -v

9. Check service status

systemctl status nginx

10. Inspect default site

cat /etc/nginx/sites-enabled/default

Visual

Installation Flow

┌──────────────────────────────────────────────────────────────┐
│  FROM PACKAGE TO REACHABLE WEB SERVER                        │
│                                                              │
│  Step 1: Install                                             │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ apt install nginx    (Debian)                          │  │
│  │ dnf install nginx    (RHEL)                            │  │
│  └────────────────────────────────────────────────────────┘  │
│                           │                                  │
│                           ▼                                  │
│  Step 2: Start                                               │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ Debian: automatic                                      │  │
│  │ RHEL:   systemctl start nginx                          │  │
│  └────────────────────────────────────────────────────────┘  │
│                           │                                  │
│                           ▼                                  │
│  Step 3: Enable at boot                                      │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ systemctl enable nginx                                 │  │
│  └────────────────────────────────────────────────────────┘  │
│                           │                                  │
│                           ▼                                  │
│  Step 4: Open firewall                                       │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ ufw allow 'Nginx HTTP'                                 │  │
│  │ firewall-cmd --add-service=http --permanent            │  │
│  └────────────────────────────────────────────────────────┘  │
│                           │                                  │
│                           ▼                                  │
│  Step 5: Verify                                              │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ ss -antpl | grep nginx  → listening on :80             │  │
│  │ curl -I http://localhost → 200 OK                      │  │
│  └────────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘

Default Directory Layout

┌──────────────────────────────────────────────────────────────┐
│  WHERE NGINX KEEPS ITS FILES                                 │
│                                                              │
│  /etc/nginx/                                                 │
│  ├── nginx.conf              ← Main configuration            │
│  ├── sites-available/        ← All server block configs      │
│  ├── sites-enabled/          ← Symlinks to active configs    │
│  └── conf.d/                 ← Additional config snippets    │
│                                                              │
│  /var/www/html/              ← Default web content           │
│  └── index.nginx-debian.html ← Default welcome page         │
│                                                              │
│  /var/log/nginx/                                             │
│  ├── access.log              ← Request log                   │
│  └── error.log               ← Error log                     │
└──────────────────────────────────────────────────────────────┘

Firewall Comparison

┌──────────────────────────────────────────────────────────────┐
│  DEBIAN/UBUNTU vs RHEL/ROCKY                                 │
│                                                              │
│  ufw (Debian/Ubuntu):                                        │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ ufw allow 'Nginx HTTP'                                 │  │
│  │ → Uses application profile installed by nginx package  │  │
│  │ → Opens port 80 for IPv4 and IPv6                      │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  firewalld (RHEL/Rocky):                                     │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ firewall-cmd --permanent --add-service=http            │  │
│  │ firewall-cmd --reload                                  │  │
│  │ → Uses predefined http service                         │  │
│  │ → Opens port 80                                        │  │
│  └────────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Debian package	`nginx` (default repository)
RHEL package	`nginx` (AppStream or official repository)
Debian service start	Automatic on install
RHEL service start	`systemctl start nginx`
Boot enablement	`systemctl enable nginx`
ufw HTTP rule	`ufw allow 'Nginx HTTP'`
firewalld HTTP rule	`firewall-cmd --permanent --add-service=http`
Default listening port	80
Default content directory	`/var/www/html`
Main config file	`/etc/nginx/nginx.conf`
Verification	`ss -antpl \| grep nginx`, `curl -I http://localhost`

Key takeaways:

The installation command differs by distribution. apt install nginx on Debian and Ubuntu; dnf install nginx on RHEL and its derivatives. The package name is the same, but the repository and the service-start behavior differ.
The service does not always start automatically. Debian starts it after installation. RHEL does not. systemctl start nginx and systemctl enable nginx are separate operations on both families .
The firewall must permit HTTP. Without ufw allow 'Nginx HTTP' or firewall-cmd --add-service=http, the service listens locally but remote clients cannot reach it .
The default page is served from /var/www/html. The sites-enabled/default file contains the server block that listens on port 80 and serves the welcome page. The configuration is already functional after installation.
Verification requires two checks. The ss command confirms the service is listening on port 80. The curl command confirms that it returns an HTTP response. A local test does not confirm that the firewall permits remote access; a remote test is required for that.
The official nginx repository provides current versions on RHEL. The repository file requires module_hotfixes=true on RHEL 8 and later to avoid module conflicts with the AppStream packages .

Remember: Nginx installation is one package command, but the service is not reachable until it is started, enabled, and permitted through the firewall. The Debian package starts the service automatically; the RHEL package does not. The ufw and firewalld commands open port 80 through different mechanisms. The default configuration serves a welcome page from /var/www/html, and the curl test confirms that the HTTP response is correct. Install, start, enable, open the firewall, and verify. The web server is ready when the remote client receives the welcome page, not when the package installation completes.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!