Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The following code is throwing a 403 even if I connect from the allowed IP

location /railo-context/admin {
    allow #my ip 
    deny all;

this is the whole file:

server {
  listen 8080;

  server_name $hostname;

  # root should be out of location blocks according to Nginx best practices
  root   /opt/railo/tomcat/webapps/$host;

  # index files
  index index.htm index.html index.cfm index.cfml; 

  location / {
    try_files $uri @rewrite;

  # This block will catch static file requests, such as images, css, js
  # The ?: prefix is a 'non-capturing' mark, meaning we do not require
  # the pattern to be captured into $1 which should help improve performance
  location ~* \.(?:ico|css|js|gif|jpe?g|png|bmp|html|htm)$ {
    # Some basic cache-control for static files to be sent to the browser
    expires max;
    add_header Pragma public;
    add_header Cache-Control "public, must-revalidate, proxy-revalidate";

  location /railo-context/admin {
    # include the external ip of the server or any other fixed ip 
    # in order to prevent access to Railo Admin by others
    deny all;
    # include all proxy related settings from the proxy_params file
    include proxy_params;

  location @rewrite {

    rewrite ^ /rewrite.cfm/$request_uri break;

    #include all proxy related settings from the proxy_params file
    include proxy_params;

  # this prevents any aspx,php,jsp,cgi or perl files from being served
  location ~ \.(aspx|php|jsp|pl|cgi|perl|prl)$ {
    return 410;

  # this prevents hidden files (beginning with a period) from being served
  location ~ /\. { 
    access_log off; log_not_found off; deny all; 

share|improve this question
up vote 1 down vote accepted

It's a bit unclear on what the exact intent is, but as to my best interpretation as possible: allow #my ip to allow; #my ip as it's missing semicolon.


location /railo-context/admin {


location /railo-context/admin/ {

that way it matches the folder and all under it.

share|improve this answer
I forgot the ; but that wasn't the problem since in reality I used an include that had it correct. I did change the path as you suggested but that doesn't seem to change anything. – Stofke Nov 14 '12 at 22:01
The intent is to be able to ssh to the server and open the admin part only for people on the server not from outside. This way the admin part is effectively unreachable for any hacker unless he already has access to the server in which case it doesn't really matter as he would be able to do anything already if he has ssh access. – Stofke Nov 14 '12 at 22:04
Got it working now. Must have been the slash at the end. Thanks – Stofke Nov 14 '12 at 22:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.