diff --git a/internal/native/native.go b/internal/native/native.go
index 4e85048..49d201c 100644
--- a/internal/native/native.go
+++ b/internal/native/native.go
@@ -31,9 +31,41 @@ func InstallNode(node state.Node, apiToken, apiHost, labels string) error {
 	instanceDir := filepath.Join(BaseDir, node.Name, "wallarm")
 	installerPath := filepath.Join(BaseDir, "wallarm-aio.sh")
 
-	// 1. Per-instance NGINX
+	// 1. Per-instance NGINX: copy binary, write config, start
+	nginxDir := filepath.Join(instanceDir, "nginx")
 	copyNginx(instanceDir)
 
+	// Write nginx.conf for this instance
+	port := "80"
+	if idx := strings.LastIndex(node.Address, ":"); idx != -1 {
+		port = node.Address[idx+1:]
+	}
+	nginxConf := filepath.Join(nginxDir, "conf", "nginx.conf")
+	os.MkdirAll(filepath.Dir(nginxConf), 0755)
+	os.WriteFile(nginxConf, []byte(fmt.Sprintf(`
+worker_processes auto;
+pid %s/nginx.pid;
+error_log %s/error.log;
+events { worker_connections 10240; }
+http {
+    access_log %s/access.log;
+    server {
+        listen %s;
+        server_name _;
+        allow 127.0.0.0/8;
+        deny all;
+        wallarm_mode off;
+        access_log off;
+        location /wallarm-status { wallarm_status on; }
+    }
+}
+`, nginxDir, nginxDir, nginxDir, port)), 0644)
+
+	// Start NGINX for this instance
+	exec.Command(filepath.Join(nginxDir, "sbin", "nginx"),
+		"-c", nginxConf, "-p", nginxDir).Run()
+	fmt.Printf("[%s] NGINX started on port %s\n", node.Name, port)
+
 	// 2. Download AIO once
 	if _, err := os.Stat(installerPath); os.IsNotExist(err) {
 		fmt.Printf("[%s] Downloading installer...\n", node.Name)