0

This is my configuration of the subdomain dev.mypage.com:

server {
        listen 80;

        server_name dev.mypage.com;      
        root /home/user/web/dev;
        index index.html index.htm index.php;

        access_log /home/user/logs/dev/access.log;
        error_log /home/user/logs/dev/error.log;

        location / {
                try_files $uri $uri/ /index.html;
                allow   xxx.xxx.xxx.xxx;
                deny    all;
        }

        location ~ \.php$ {
                fastcgi_pass unix:/var/run/php5-fpm/dev.sock;
                fastcgi_index index.php;
                include fastcgi_params;
        }
}

I want to forbid access to all of the files and subdirs under / except for me (xxx.xxx.xxx.xxx).

Running this config and

  1. accessing dev.mypage.com with other IP turns into a 403 error.
  2. accessing dev.mypage.com/subdir with other IP turns into a 403 error.
  3. accessing dev.mypage.com/index.php with other IP returns the page.
  4. accessing dev.mypage.com/subdir/index.php with other IP returns the page.

So the cases 3 and 4 are not working as expected. I had assumed that

location / {}

would mean all files and directories. What do I have to do to block all other IPs for all contents in this subdomain?

1 Answer 1

2

I believe nginx will process php addresses with the php location block and ignore the root location block. I believe it is also good practice to include allow 127.0.0.1 when using deny all statements.

Try adding to your php location block, as the first four entries:

try_files $uri =404;
allow xxx.xxx.xxx.xxx;
allow 127.0.0.1;
deny all;

Edit: I didn't state that quite correctly, at least based on my understanding, nginx will process the location block that matches the request. So requests for php addresses will be processed based on the configuration of that block. Similarly, if a location block is created for a specific subdirectory, those rules would be applied instead of the root directory location block.

2
  • At first, your code works like a charm. Thank you! I hope I get that right: nginx is processing the block for the root directory if there is no other block it can assign, and while in this case there is an existing block for accessing php-files, it does not process the root-block, but only the php-block. Is that correct?
    – 32bitfloat
    Aug 20, 2013 at 21:21
  • @32bitfloat As I understand it, yes, what you state is correct.
    – Paul
    Aug 20, 2013 at 21:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .