# Can't get v6 webinterface behind nginx reverse proxy to work

**URL:** <https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231>\
**Category:** Beta 6.0\
**Created:** [February 20, 2025, 9:09pm UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231 "2025-02-20T21:09:01Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefan](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/bbce88/32.png) [@stefan](https://discourse.pi-hole.net/u/stefan)\
**Post date:** [February 20, 2025, 9:09pm UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/1 "2025-02-20T21:09:01Z")

</div>

Hey there,

after upgrading Pi-hole to v6, I can't reach the webinterface behind a nginx reverse proxy anymore.  
I use nginx, because I have more web services running on the Pi-hole box, so I configure them to different ports, and reverse-proxy them to an internal hostname, e.g. `pi-hole.home` for my Pi-hole instance.

For v5 I configured `lighttpd` to localhost:

```auto
server.port = 8001
server.bind = "127.0.0.1"

```

and used this nginx config for years which worked like a charm:

```auto
server {
        listen 192.168.0.1:80;
        listen [::]:80 ;

        server_name pi-hole.home;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_pass http://127.0.0.1:8001/admin/;
        }

        location /admin/ {
                return 301 $scheme://$host/;
        }
}

```

Now after update, I can't get this to work.  
I already figured out with [this post](https://discourse.pi-hole.net/t/cant-reach-the-web-interface-after-updating-to-6-0/76064/10) to run  
`pihole-FTL --config webserver.port 8001` to get back "my" port.

But this now ends in a redirect loop:

- [http://pi-hole.home/](http://pi-hole.home/) replys with 302 Found [http://pi-hole.home/admin/login](http://pi-hole.home/admin/login)
- [http://pi-hole.home/admin/login](http://pi-hole.home/admin/login) replys with 301 Moved Permanently [http://pi-hole.home/](http://pi-hole.home/) (because of my second rule which was needed for some faulty v5 redirects)

So I stripped down the config to just do a plain reverse proxy:

```auto
server {
        listen 192.168.0.1:80;
        listen [::]:80 ;

        server_name pi-hole.home;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_pass http://127.0.0.1:8001/;
        }
}

```

Which ends in a different situation: [http://pi-hole.home/](http://pi-hole.home/) replys with 403 Forbidden, and nearly all script/stylesheet requests (except `/admin/vendor/datatables/`, `/admin/vendor/daterangepicker/` and `/admin/vendor/bootstrap-toggle/`) return a 301 Moved Permanently to [http://pi-hole.home/](http://pi-hole.home/)  
This results in black text on black background:

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/e/0/e045866e1b6fda2122753039f63031df5a6f6e90.png)  
Which basically wants to tell me:  
 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/2/3/23ad023df121eb13a315ee522aa376e94a8cab2d.png)

So how can I get my configuration to work?  
It seems as other users [got it to work with a lighttpd reverse proxy config](https://discourse.pi-hole.net/t/webui-behind-lighttpd-reverse-proxy/71239).

PS: [http://pi.hole:8001/](http://pi.hole:8001/) works, but that's not the url I want it to be at.

---

<div class="post-metadata">

**Author:** ![stefan](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/bbce88/32.png) [@stefan](https://discourse.pi-hole.net/u/stefan)\
**Post date:** [February 20, 2025, 9:19pm UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/2 "2025-02-20T21:19:37Z")

</div>

I got one step further:

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/7/3/735628df3dfa024505086c0974ecce78aeabd18b.png)

The new server doesn't seem to expect `X-Real-IP` but classic `X-Forwarded-For`

But when I click the [http://pi-hole.home/admin/](http://pi-hole.home/admin/) I get a 301 Moved permanently to [http://pi-hole.home/](http://pi-hole.home/) which doesn't help me.

Manually going to [http://pi-hole.home/admin/login](http://pi-hole.home/admin/login) shows this:

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/a/6/a69efb3d05027a3b3e9c5ecba04977e7f21b6480.png)  
But login doesn't work and [http://pi-hole.home/admin/img/logo.svg](http://pi-hole.home/admin/img/logo.svg) replys with 301 Moved Permanently [http://pi-hole.home/](http://pi-hole.home/), that's why the logo is missing.

---

<div class="post-metadata">

**Author:** ![rdwebdesign](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rdwebdesign/32/51363_2.png) [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)\
**Post date:** [February 20, 2025, 9:39pm UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/3 "2025-02-20T21:39:44Z")

</div>

> [@stefan](#):
>
> `location / {`

I'm not a nginx user, but maybe this should be `location /admin/ {`

---

<div class="post-metadata">

**Author:** ![stefan](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/bbce88/32.png) [@stefan](https://discourse.pi-hole.net/u/stefan)\
**Post date:** [February 21, 2025, 8:11am UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/4 "2025-02-21T08:11:28Z")

</div>

Thanks! I just wanted to object because a `location /` with `proxy_pass http://127.0.0.1:8001/;` should reverse proxy all paths including `/admin`...

But weirdly, this config works, setting up two separate reverse proxies for `/admin` and `/api`  
So this is the full config I now use:

```auto
server {
        listen 192.168.0.1:80;
        listen [::]:80 ;

        server_name pi-hole.home;

        location / {
                return 301 $scheme://$host/admin/;
        }
        location /admin/ {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass http://127.0.0.1:8001/admin/;
        }
        location /api/ {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass http://127.0.0.1:8001/api/;
        }
}

server {
        # redirect non-standard TLD to proper domain
        listen 192.168.0.1:80;
        listen [::]:80 ;

        server_name pi.hole;

        location / {
                return 301 $scheme://pi-hole.home/admin/;
        }
}

```

So run `pihole-FTL --config webserver.port "127.0.0.1:8001"` to not expose this port to the network interface(s) and you are done.

With v5 I didn't see a reason to have Pi-hole set up under `/admin`, that's why I moved it to the root. But I don't insist on that, so I'm fine with the new setup.

So thanks for making me try out that way.

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [February 21, 2025, 9:32am UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/5 "2025-02-21T09:32:43Z")

</div>

> [@stefan](#):
>
> The only thing missing is a config option to bind the Pi-hole webserver to localhost to properly close port `8001` from the network

As per the documentation (from `pihole.toml` or _All settings » Webserver and API_ in the webUI), you could either set **`webserver.acl`** to e.g. `+127.0.0.1,+[::1]` to restrict access, or bind the webserver to the loopback addresses by setting **`webserver.port`** to e.g. `127.0.0.1:80,[::1]:80`.

---

<div class="post-metadata">

**Author:** ![tokyovigilante](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/tokyovigilante/32/45985_2.png) [@tokyovigilante](https://discourse.pi-hole.net/u/tokyovigilante)\
**Post date:** [February 22, 2025, 9:27am UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/6 "2025-02-22T09:27:40Z")

</div>

Thanks, worked for me with a podman install behind Nginx too.

---

<div class="post-metadata">

**Author:** ![Joulinar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/joulinar/32/12299_2.png) [@Joulinar](https://discourse.pi-hole.net/u/Joulinar)\
**Post date:** [February 24, 2025, 9:20pm UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/7 "2025-02-24T21:20:45Z")

</div>

In fact, the solution for me was also to explicitly set the `location /api/`. thx for sharing.

---

<div class="post-metadata">

**Author:** ![jclendineng](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/j/c77e96/32.png) [@jclendineng](https://discourse.pi-hole.net/u/jclendineng)\
**Post date:** [February 25, 2025, 1:28am UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/8 "2025-02-25T01:28:06Z")

</div>

Thank you!

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [April 1, 2025, 11:56pm UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/9 "2025-04-01T23:56:46Z")

</div>

FTL version 6.1 had some changes to how it handled reverse proxy setups, I'm not sure if those changes fixed the need to have separate `/admin` and `/api` locations or not though. You may want to see if things are better now.

---

<div class="post-metadata">

**Author:** ![stefan](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/bbce88/32.png) [@stefan](https://discourse.pi-hole.net/u/stefan)\
**Post date:** [April 2, 2025, 11:06am UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/10 "2025-04-02T11:06:43Z")

</div>

Thanks for the heads up! Yes indeed it did change something, I just need one reverse proxy statement now.  
As I read in [Implement auto-redirection to /admin - #2 by DL6ER](https://discourse.pi-hole.net/t/implement-auto-redirection-to-admin/77370/2) to set `webserver.domain` to the domain I'm using (`pi-hole.home` in my example) even the redirect to `/admin` works, so I can skip this in nginx config too.

New config:

```plaintext
server {
        listen 192.168.0.1:80;
        listen [::]:80 ;

        server_name pi-hole.home;

        location / {
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass http://127.0.0.1:8001/;
        }
}

server {
        # redirect non-standard TLD to proper domain
        listen 192.168.0.1:80;
        listen [::]:80 ;

        server_name pi.hole;

        location / {
                return 301 $scheme://pi-hole.home/admin/;
        }
}

```

---

<div class="post-metadata">

**Author:** ![LoneStar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/lonestar/32/49214_2.png) [@LoneStar](https://discourse.pi-hole.net/u/LoneStar)\
**Post date:** [April 3, 2025, 1:34am UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/11 "2025-04-03T01:34:02Z")

</div>

I am glad this thread was started and that I am starting to get somewhere with my reverse proxy configuration.

My issue is that I also have homeassistant running alongside pihole and it uses the / location. Pihole V5 was using the /pihole/ location and all the locations were happily getting along.

Following the original instructions here, I could configure an /admin/ location, which worked well, but the /api/ configuration was conflicting with the homeassistant /api/ subpath.

I upgrade to V6.1 last night and tried the latest suggestion above, which works for pihole, but breaks homeassistant.

Did someone successfully configure their reverse proxy with pihole V6.1 on a subpath?

What I would like to to have everything on the /pihole/admin/ and /pihole/api/ locations so that homeassistant can remain in the / location.

Thanks!

---

<div class="post-metadata">

**Author:** ![stefan](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/bbce88/32.png) [@stefan](https://discourse.pi-hole.net/u/stefan)\
**Post date:** [April 3, 2025, 8:52am UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/12 "2025-04-03T08:52:40Z")

</div>

> [@LoneStar](#):
>
> Did someone successfully configure their reverse proxy with pihole V6.1 on a subpath?

See [Pi-hole behind Nginx but it's not redirecting with target port. - #6 by stefan](https://discourse.pi-hole.net/t/pi-hole-behind-nginx-but-its-not-redirecting-with-target-port/77153/6) for thoughts on this.

But why put it into a subpath? I would suggest using a subdomain, that's more straight forward.

---

<div class="post-metadata">

**Author:** ![LoneStar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/lonestar/32/49214_2.png) [@LoneStar](https://discourse.pi-hole.net/u/LoneStar)\
**Post date:** [April 3, 2025, 6:37pm UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/13 "2025-04-03T18:37:24Z")

</div>

To lessen the burden of having to manage multiple subdomains?

I am not using a commercial server and I use a free domain provider. Your suggestion, if I understand it correctly, implies a new domain and a new SSL certificate.

I am not saying that it cannot be done, but there should be a simpler solution.

---

<div class="post-metadata">

**Author:** ![stefan](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/bbce88/32.png) [@stefan](https://discourse.pi-hole.net/u/stefan)\
**Post date:** [April 3, 2025, 8:09pm UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/14 "2025-04-03T20:09:19Z")

</div>

> [@LoneStar](#):
>
> Your suggestion, if I understand it correctly, implies a new domain and a new SSL certificate.

Your answer, if I understand it correctly, implies that you want to make Pi-hole available from the internet. This NEVER should be done, the developers strongly discourage this! Pi-hole isn't a service meant to be available from internet. I'm not going to help you on this.

Set up a proper VPN to your network, and make Pi-hole available there through LOCAL domains!

---

<div class="post-metadata">

**Author:** ![LoneStar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/lonestar/32/49214_2.png) [@LoneStar](https://discourse.pi-hole.net/u/LoneStar)\
**Post date:** [April 3, 2025, 10:42pm UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/15 "2025-04-03T22:42:46Z")

</div>

For later readers, I just located some new settings in Settings -\> All Settings -\> Webserver and API.

If you scroll halfway down, have a look at "webserver.paths.webhome", "webserver.paths.prefix", and other settings around those.

The webserver.paths.prefix setting, according to the instructions, appears to have been put there by developers specifically to configure pihole behind a reverse proxy.

That is what I will be trying next.

---

<div class="post-metadata">

**Author:** ![LoneStar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/lonestar/32/49214_2.png) [@LoneStar](https://discourse.pi-hole.net/u/LoneStar)\
**Post date:** [April 4, 2025, 1:42am UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/16 "2025-04-04T01:42:28Z")

</div>

Here is my final solution.

On pihole (as root):

```auto
pihole-FTL --config webserver.paths.prefix /pihole

```

My location block:

```auto
location ^~ /pihole/ {
   proxy_set_header Host $host;
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header X-Nginx-Proxy true;

   rewrite ^/pihole/(.*)$ /$1 break;
   proxy_pass http://localhost:8080/;
}

```

---

<div class="post-metadata">

**Author:** ![fozid](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/f/e9a140/32.png) [@fozid](https://discourse.pi-hole.net/u/fozid)\
**Post date:** [June 5, 2025, 8:40pm UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/17 "2025-06-05T20:40:36Z")

</div>

Thank you so much for this! I can't believe how difficult it has been to set up a reverse proxy for this software!

---

<div class="post-metadata">

**Author:** ![Scrawdad](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/9fc29f/32.png) [@Scrawdad](https://discourse.pi-hole.net/u/Scrawdad)\
**Post date:** [April 28, 2026, 7:27am UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/19 "2026-04-28T07:27:47Z")

</div>

> 

The excuses being offered here are truly staggering. It is clear that no one involved in this project has any idea how web servers work at a fundamental level and that is probably why they went with some utterly insane Lua-based solution no one has ever heard of before that also obeys no convention established over the last 40 years. If it did then all of this would just work without any stupid tricks involving multiple location directives to cope with the mysterious internal rewrites being performed.

One does not need to be an Nginx user to understand that this wheel re-invention is unfit for highway travel and start catching up on everything you’ve slept through so far.

---

<div class="post-metadata">

**Author:** ![nero355](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/nero355/32/54774_2.png) [@nero355](https://discourse.pi-hole.net/u/nero355)\
**Post date:** [April 28, 2026, 11:55am UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/20 "2026-04-28T11:55:27Z")

</div>

Integrating CivetWeb is waaaay better than depending on LigHTTPd and PHP for all the webGUI stuff and avoids dependency issues while also being a lot more flexible when it comes to running on different platforms !!!

Maybe you should just read about the changes between Pi-Hole v5 and Pi-Hole v6 and why they have been applied before making such statements… 😴

---

<div class="post-metadata">

**Author:** ![tomporter518](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/tomporter518/32/3504_2.png) [@tomporter518](https://discourse.pi-hole.net/u/tomporter518)\
**Post date:** [April 28, 2026, 3:54pm UTC](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231/21 "2026-04-28T15:54:21Z")

</div>

Personally, I kept lighttpd with my v6 install and have no issue proxying (fairly easily) to the admin UI pages and API. I wanted to preserve my system monitoring and DOH proxy, so it made sense for me. I make no judgements about the embedded web server as for my needs, it’s completely transparent.

[Next page](https://discourse.pi-hole.net/t/cant-get-v6-webinterface-behind-nginx-reverse-proxy-to-work/76231.md?page=2)