setting up nginx rule to restrict access based on IP addresses

Question

I have a url which I can restrict based on IP Address given below. However, what I would like to do is apply the rule to all url's (not included in the rule below) such that if the url request does not match those URL's, the allow/deny in whitelist.conf is applied.

**Current rule in default file in sites-available:**
 ##  restrict admin access to IP address in whitelist.conf file
  location ^~ /admin {
    proxy_pass        http://127.0.0.1:9000;
    proxy_redirect    off;
    proxy_set_header  Host             $host;
    proxy_set_header  X-Real_IP        $remote_addr;
    proxy_set_header  X-Forwarded_For  $proxy_add_x_forwarded_for;
    proxy_read_timeout                 240;
    proxy_connect_timeout              120;
   include whitelist.conf;  
}

Whitelist.conf

##assuming 127.0.0.1 is the only ip address I want with access to the url '/admin' 
       allow 127.0.0.1;
       deny all;

I would like to change this such that if the url is anything but '/admin', then I "allow" traffic but if its not, then I restrict access to the IP address that I want access for. Thanks in advance

Answer 1

You could write your restriction based on directory. Something like below to manage it. In case you use php you may need a nested block. And /admin shouldnt be just something that appears anywhere in the uri:

# everything that starts with /admin is handled,
# and regex location will not override it
location ^~ /admin {
  allow 1.2.3.4;
  deny all;

  # Inherits the allow/deny from the outer location
  location ~ \.php$ {
    include fastcgi.conf;
    fastcgi_pass backend;
  }
}