Secure backend access only through the reverse proxy

Question

I have two servers with public ips , one hosting the backend services and the other is the reverse proxy. I want to make sure that all traffic is only coming from the reverse proxy (nginx) . for example if the user put the ip address and port in the browser he won't be able to access the services, only if he uses the subdomain which points to the reverse proxy and the reverse peoxy will server him the content. How can i achieve this? Please help me ! NOTE: The servers OS is Debian 12

I tried using iptables to allow only the reverse proxy ip to access the services ports and it didn't work