How to require client-side SSL certificate only for exern IPs in nginx server configuration?

Question

I would like to configure nginx this way, that only extern page visitors (not 192.169.1.0/24) need to authenticate using client-side SSL certificates.

I already found, that extern and intern users can be distinguished by the geo module:

http {
  geo $isintern {
    default 0;
    192.169.1.0/24 1;
}

via: https://stackoverflow.com/questions/14811532/client-authentication-when-using-nginx-proxy-pass

How do I have to configure the server? I got to know, that one should try to circumvent if statements. Finally I would like to redirect people with access to an 403/401 error page.

upstream serverapp {
    server unix:/opt/a.socket;
}

server {
    listen        443;
    ssl on;
    server_name example.com;

    ssl_certificate      /etc/nginx/certs/server.crt;
    ssl_certificate_key  /etc/nginx/certs/server.key;
    ssl_client_certificate /etc/nginx/certs/ca.crt;
    ssl_verify_client optional;

    if(!$isintern) {
        if($ssl_client_verify != SUCCESS) {
            return 403;
        }
    }

    error_page 403 401 /401.html

    location / {
      proxy_pass http://serverapp;
    }
}

The config above is not tested. How is it meant to be implemented?

Resources:

• http://wiki.nginx.org/HttpCoreModule#error_page
• http://wiki.nginx.org/HttpRewriteModule#if

Answer 1

You need two server {} blocks, one for external and one for internal access. Nginx won't care if they point to the same root on the filesystem. Ideally make a separate .conf file for each and put it in a directory included by the main nginx.conf or other config file.

Each server {} block can have its own certificates, its own server_name directive for SNI to work properly, and you can limit access by IP of the internal site with location / { allow IP/netmask; allow IP/netmask; deny all; }