2

I have nginx setup as a reverse-proxy for a group of apache (LAMP) backends listening on port 8080.

I've also configured each backend servers' mod_rpaf.conf file to include the proxy IP of the nginx server:

<IfModule mod_rpaf.c>
  RPAF_Enable       On
  RPAF_ProxyIPs     127.0.0.1 192.168.0.1 # <- nginx server IP
  RPAF_Header       X-Forwarded-For
  RPAF_SetHostName  On
  RPAF_SetHTTPS     On
  RPAF_SetPort      On
</IfModule>

How can i configure httpd.conf to refuse any connection that does not come from nginx?

I've tried the following:

<Directory "/var/www/html">

    Order allow,deny
    Allow from 192.168.0.1
    Allow from 127
    Deny from all

</Directory>

But this seems to restrict access to the nginx proxy itself as well as any other IPs.

Is this due mod_rpaf forwarding the client IP? If so how do I get arround this?

6
  • Have you kept port 8080 to be accessible from the entire internet? Oct 12 '13 at 3:51
  • @Pothi Yes. Can I restrict access to the port to only the nginx proxy? Do you know where/how would i configure that? Oct 12 '13 at 3:57
  • Actually, you'd need work with your firewall to block access to port 8080. It is not something that you should work at Apache / Nginx level. What OS you use? In Debian / Ubuntu, there is UFW. Ref: help.ubuntu.com/community/UFW . Oct 12 '13 at 3:59
  • I'm using CentOS 6.4 Oct 12 '13 at 4:05
  • 1
    @Pothi Thanks for the info. Managed to successfully setup IPtable rules to block access. Oct 13 '13 at 4:23
2

Because the mod_rpaf module forwards the real client IP, you can't block public access to the apache backend server via its own httpd.conf file.

Setting up a couple of IPtables rules will block access to port 8080 for everyone (public access) except the nginx reverse-proxy without affecting the forwarding of the clients real IP:

Run:

#iptables -A INPUT -p tcp --dport 8080 -s 192.168.0.1 -j ACCEPT
#iptables -A INPUT -p tcp --dport 8080 -j DROP

#service iptables save
#service iptables restart

Access to the apache backend server on port 8080 is now restricted to the nginx proxy only.

0

i think you should change the order of your allow/deny_statements like this:

<Directory "/var/www/html">

    Order deny,allow
    Deny from all
    Allow from 192.168.0.1
    Allow from 127

</Directory>

because (order-docs)

  • Ordering is one of:

    Allow,Deny - First, all Allow directives are evaluated; at least one must match, or the request is rejected. Next, all Deny directives are evaluated. If any matches, the request is rejected. Last, any requests which do not match an Allow or a Deny directive are denied by default.

    Deny,Allow - First, all Deny directives are evaluated; if any match, the request is denied unless it also matches an Allow directive. Any requests which do not match any Allow or Deny directives are permitted.

exemple from the docs:

Using Order will let you be sure that you are actually restricting things to the group that you want to let in, by combining a Deny and an Allow directive:

Order deny,allow
Deny from all
Allow from dev.example.com
4
  • Unfortunately I receive the following error if I reconfigure the allow/deny_statements as above: [error] [client xx.xx.xx.xxx] client denied by server configuration: /var/www/html/ with the client IP being that which nginx has forwarded on rather than the nginx reverse proxy IP. Oct 13 '13 at 1:17
  • ah ... ok; maybe because of mod_rpaf; i'm not used to use it. then i'd favourite a iptables-solution too. Oct 13 '13 at 7:58
  • maybe related: bugs.debian.org/cgi-bin/bugreport.cgi?bug=697644 (not the bug, but the config later in description) Oct 13 '13 at 8:00
  • Yep. iptables solved the issue. thanks for your comments. Oct 13 '13 at 12:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.