The proxy host form is five fields and four switches. Filled in correctly, it is the difference between typing 192.168.1.50:8080 forever and simply opening app.yourdomain.com.
A proxy host is NPM's name for one rule: 'when this name arrives, send it to that internal service'. The form looks small, but two of its fields are misunderstood often enough to fill forums — the forward hostname has a Docker trap inside it, and one toggle silently breaks whole categories of apps when left off. This page walks the form top to bottom, exactly as you will fill it for your first real service.
Domain Names is the exact public name visitors will type — and it must already exist in DNS, pointing at your server. You can put several names on one host if the same service answers to all of them. Scheme describes the connection between NPM and the internal service, not what visitors use. Almost every home and office app speaks plain http internally, so http is the normal choice even though visitors will see HTTPS — NPM handles the public encryption at the door and speaks plain HTTP inside your trusted LAN. Choose https here only when the internal app itself serves HTTPS, usually with its own self-signed certificate.
This is where the internal service lives. If the service runs on another machine or a different port on the same machine, use its LAN IP address — simple and reliable. The trap: if the service runs in another Docker container, the tempting answer localhost is wrong, because inside NPM's container, localhost means NPM itself. For container-to-container traffic, put both containers on the same Docker network and use the other container's name as the hostname. Using the server's LAN IP also works, if that container's port is published on the host. Pick one method per service and stay consistent.
Type the port the service actually listens on — 8080, 8123, 2283, whatever its own documentation says. Not 80, not 443: those are NPM's doors, not the service's. The classic first-timer mistake is forwarding to the port the service 'should' use instead of the one it does use; the symptom is a clean 502 Bad Gateway from NPM, which is actually NPM telling you the truth — it knocked and nobody answered. A 502 is good news, by the way: DNS, ports and NPM all work, and only this last internal hop is wrong.
Block Common Exploits — leave it on; it filters well-known attack patterns in URLs at no cost to normal apps. Cache Assets — makes NPM store static files like images and scripts; helps busy public sites, but during setup and troubleshooting leave it off, because a cache that serves yesterday's broken page will gaslight you for hours. Websockets Support — off by default and the subject of its own guide in this series; turn it on when an app has live, never-refreshing screens. Access List — lets you password-protect or IP-restrict this host; use it for anything private you publish out of necessity.
Save the host and immediately open the name in a browser — ideally from your phone with Wi-Fi off, so you are testing the real public path. If the app loads, finish the job in the SSL tab of the same host: request the Let's Encrypt certificate and enable Force SSL, covered fully in the HTTPS guide in this series. Test in this order — plain first, certificate second — because if you bolt HTTPS onto a host that does not work yet, you will have two problems wearing one coat.
Watch the first proxy host being created live in the video — the fields take thirty seconds once you have seen them filled in once.
▶️ Watch Full VideoYes. Use the server's LAN IP and the service's port, or put both containers on one Docker network and use the container name. Just never use localhost — inside the NPM container that points at NPM itself.
Create the host for the main web port. Most apps serve everything through one port; if a second port is genuinely separate traffic (for example a stream), it usually needs its own subdomain and its own proxy host.
For a finished, busy public site it can help. For anything you are still setting up, and for apps that update themselves, keep it off — stale cached files cause stranger bugs than slow pages do.