You have a single incoming IP address and want to run multiple web servers for multiple sites behind this IP address on your local network. The best way to do this is using a reverse proxy server For example:

  • Your External IP is: with and internal LAN of 10.1.1.X
  • Ports 80 (http) and 443 (https) have been forwarded from your external ip to an internal server at which will handle the reverse proxy and SSL/TLS work using letsencrypt
  • You have other application web servers listening on port 80 on your internal LAN at and but these are not accessible from outside your network.
  • You have and both pointed to and you want visitors to them to see the application servers at and respectively.
  • You want to provide secure https access to both subdomains but don’t want to configure this on each of the three servers separately.

This guide is based on using Apache2 on Ubuntu 16.04, some commands may differ slightly between different flavours of Linux but the core configuration for Apache2 should work on any distribution.

Instructions (Run All on the Reverse Proxy server – for this example it is

  1. Set up Apache
    On the reverse proxy server, install apache web server and enabled the required modules by executing the lines below in terminal

    sudo apt-get install apache2 -y
    a2enmod proxy
    a2enmod proxy_http
    a2enmod proxy_ajp
    a2enmod rewrite
    a2enmod deflate
    a2enmod headers
    a2enmod proxy_balancer
    a2enmod proxy_connect
    a2enmod proxy_html
    service apache2 restart
  2. Set up vhost files for each subdomain as per the examples below – this is the key to the super easy reverse proxy config that will support automatic use of letsencrypt and forward incoming traffic to and from each of the application servers from the single incoming IP.
    File: /etc/apache2/sites-enabled/subdomain11.conf

    <VirtualHost *:80>
     ProxyPreserveHost On 
     DocumentRoot /var/www/html
     ProxyPass /.well-known !
     ProxyPass /
     ProxyPassReverse /

    Ok so what is going on in this file?

    ServerName – tells apache to use the config file when a visitor arrives at your IP address using the domain specified.

    DocumentRoot – is the local directory on the ReverseProxy server which will be used to authenticate the server using lets encrypt in the next step
    ProxyPass /.well-known ! – tells apache not to forward traffic for the sub directory to the application server. This directory is used by letsencrypt to authenticate your server for SSL so we want to keep that heading to the local directory on the reverse proxy server.
    ProxyPass / http:/ and ProxyPassReverse / tells apache to forward all other traffic for this domain to the server on port 80

    Once created you can run the command:

    sudo service apache2 restart

    Then browse to and you should see the content hosted on the application server at Once this is working you can create the virtualhost file for your other domain as per below:

    File: /etc/apache2/sites-enabled/subdomain12.conf

    <VirtualHost *:80>
     ProxyPreserveHost On 
     DocumentRoot /var/www/html
     ProxyPass /.well-known !
     ProxyPass /
     ProxyPassReverse /
  3. This is all good and well but we do not yet have secure https access to these domains. To set this up we are going to use LetsEncrypt which is a great free service for obtaining https certificates for web servers. Install CertBot by following the instructions at their page. For Apache on Ubuntu 16.04 the command is as simple as running the command:
     sudo apt-get install python-letsencrypt-apache
  4. Once certbot is installed we should be able to run it as per the instructions for your operating system. For Ubuntu 16.04 it is:
    letsencrypt --apache

    Which will take you through a wizard to automatically install the certificates to enable https access. Once complete you should be able to visit and If you encounter any issues you may want to restart Apache one more time:

    sudo service apache2 restart


One note is that while you will be providing secure connections to visitors from the public internet the traffic between your reverse proxy server and the application servers will not be encrypted. You will need to ensure that the private LAN (in the example 10.1.1.X) is secure from monitoring or MITM attacks.

Sources and Thanks

This guide was assembled after a fair session of google-fu. Big thanks to the posts and guides below which have all been drawn upon to create this single guide.