Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a site running on Nginx (v1.0.14) serving as reverse proxy which proxies requests to Apache (v2.2.19). So Nginx runs on port 80, Apache is on 8080.

Overall site works fine except that i cannot block access to certain directories with .htaccess file.

For example i have 'my-protected-directory' on 'www.site.com' Inside it i have htaccess with following code:

<Files *>
order deny,allow
deny from all
allow from 1.2.3.4 <--- my ip address here
</Files>

When i try to access this page with my ip (1.2.3.4) i get 404 error which is not what i expect:

http://www.site.com/my-protected-directory

However everything works as expected when this page is served directly by Apache. I can see this page, everyone else can't.

http://www.site.com:8080/my-protected-directory

Update. Nginx config (7.1.3.7 is site ip.):

user  apache;
worker_processes  4;
error_log  logs/error.log;
pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    sendfile        on;
    keepalive_timeout  65;
    gzip  on;
    gzip_min_length 1024;
    gzip_http_version 1.1;
    gzip_proxied any;
    gzip_comp_level 5;
    gzip_types    text/plain text/css
                  application/x-javascript text/xml
                  application/xml application/xml+rss
                  text/javascript image/x-icon;

    server {
    listen       80;
    server_name  www.site.com site.com 7.1.3.7;
    access_log  logs/host.access.log  main;

    # serve static files
    location ~* ^.+.(jpg|jpeg|gif|png|ico|css|zip|tgz|gz|rar|bz2|doc|xls|exe|pdf|ppt|txt|tar|mid|midi|wav|bmp|rtf|js)$ {
      root    /var/www/vhosts/www.site.com/httpdocs;
      proxy_set_header Range "";
      expires 30d;
    }

    # pass requests for dynamic content to Apache
    location / {
      proxy_redirect               off;
      proxy_set_header X-Real-IP  $remote_addr;
      proxy_set_header Host $http_host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Range "";
      proxy_pass      http://7.1.3.7:8080;
    }
  }

Update 2: mod_rpaf is installed and ip address get determined correctly

Could please anyone tell me what is wrong and how this can be fixed ?

share|improve this question
    
Can you post the relevant section of your nginx config? –  Kyle Mar 25 '12 at 22:45
    
...and the Apache config, as well. Are you expecting the .htaccess file to be obeyed when nginx is serving the content? –  Shane Madden Mar 25 '12 at 22:47
    
2 Shane Madden - Actually i am accessing php file inside 'protected' directory. Nginx only serves static content and Apache serves dynamic. So in this config Apache should obey htaccess rules but it does that only when file is served directly from Apache (site.com:8080/protected/1.php), not proxied throught Nginx (site.com/protected/1.php). –  Termos Mar 25 '12 at 23:37

4 Answers 4

If nginx is proxying to apache, then the connection to apache is coming from nginx, not coming from you, and thus your IP never enters the equation.

You can set an environment variable based on your original IP (which will be stored in the x-forwarded-for header), and then allow requests with that variable set:

<Location "/">
    SetEnvIf X-Forwarded-For ^1\.2\.3\.4 proxy_env
    Order allow,deny
    Satisfy Any
    Allow from env=proxy_env
</Location>
share|improve this answer
    
You are not right. Apache mod_rpaf is installed so Apache sees user ip. I rechecked this and 1) deleted htaccess file 2) put php file which shows user ip (echo getenv('REMOTE_ADDR')). I see my ip when i delete htaccess file. When i enable it i get "Client denied by server configuration error" in logs. –  Termos Mar 26 '12 at 9:06
    
What Shish recommends is a much more generic way that does not rely on any modules. I'd much prefer this. –  Stefan Förster Sep 13 '13 at 10:35

You can try to add into nginx' server section error_log <path> debug;, run the request and see how is it parsed against location rules. Sometime it is not that obvious...

share|improve this answer
up vote 0 down vote accepted

I have managed to resolve this issue. The problem was in Rpaf module which under some condition works incorrectly. By 'conditions' i mean Apache version and OS. (Mine was Apache 2.2 on CentOS)

Anyway, to fix this you should disable rpaf module and install it's patched version from here: mod_realip2

Installation is clear and simple. Hope this helps someone because i have spent hours and hours looking for resolution.

share|improve this answer

You placed the root directive under location instead of server. This is one of the most common nginx misconfigurations. And in this case it will be directly responsible for your 404 error.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.