I want to restrict the access for some VHosts so that only 127.0.0.1 can access it. I always used something like this to bind the VHost to the localhost and not the external IP:

server {
    listen 127.0.0.1;
    server_name myvhost.local;
    location / {
        ....
    }
}

But I noticed that some tutorials also include explicit allow directives for the localhost and expicitly deny all others:

server {
    listen 127.0.0.1;
    server_name myvhost.local;
    location / {
        allow 127.0.0.1;
        deny all;
        ...
    }
}

Are these allow/deny directives really needed when I already listen only at 127.0.0.1?

  • Try changing the allow line to: allow 127.0.0.1/32; – Itai Ganot Feb 15 '15 at 14:07
  • My question is whether I need that allow at all because I set listen to 127.0.0.1. – Biggie Feb 15 '15 at 18:08
up vote 11 down vote accepted

The listen directive tells the operating system on what interface the web server binds itself. So, when you look at netstat -a after starting nginx, you will see that nginx listens only on 127.0.0.1 IP port 80, which means that the nginx server cannot be reached via any other interface.

Binding to a specific IP address works in a lower level in the actual network stack than the allow / deny directives inside nginx configuration.

This means that you don't need separate allow / deny directives inside your configuration with your use case, because the connections are limited lower in the network stack.

If you specify listen 80; only, and use allow / deny directives, then nginx will send a HTTP error code to the client, tellng that access is denied.

With the listen 127.0.0.1; case, the browser cannot connect to the server at all, because there is no TCP port open for the browser to connect to.

  • 1
    Okay, I forgot to mention that I have some more VHosts and some of them are bound not only to localhost. All of them (local-only and non-local) are running on the same nginx-instance. Thus netstat shows a local address of 0.0.0.0:80 (all interfaces). Can I then still omit deny/allow on the local-only servers? – Biggie Feb 15 '15 at 20:48
  • In this case, nginx will show the contents of the virtual host that has been defined with listen 80 default_server; directive when a client asks for a vhost bound to 127.0.0.1:80. If you don't have a default_server defined, then it will show a server that has listen 80; defined. – Tero Kilkanen Feb 15 '15 at 22:45
  • OK, so there is no possibility that non-local users can access listen 127.0.0.1-servers and I don't even need allow/deny on these servers? – Biggie Feb 17 '15 at 9:01
  • Yes, there is no possibility for that. – Tero Kilkanen Feb 17 '15 at 10:26

Let's say your network ID is 192.168.1.0, edit your conf file like so:

location / {
  # block one workstation
  deny    192.168.1.1;
  # allow anyone in 192.168.1.0/24
  allow   192.168.1.0/24;
  # drop rest of the world
  deny    all;
}

Please let me know how it works for you.

Edit #1:

Yes, the allow directive is a must according to the Official Nginx wiki. Their example is:

location / {
    allow 192.168.1.1/24;
    allow 127.0.0.1;
    deny 192.168.1.2;
    deny all;
}
  • I really want to limit the access to 127.0.0.1 ;) My question is whether I need that allow at all because I already set listen to 127.0.0.1. – Biggie Feb 15 '15 at 18:10
  • Please check Edit #1. – Itai Ganot Feb 15 '15 at 18:15
  • Sry, I don't think you understand my question ;) What you've posted is (more or less) already what I've wrote in my question above. But that's not an answer to my question. – Biggie Feb 15 '15 at 18:18
  • 1
    @Biggie You don't have to limit access to 127.0.0.1, it is only available on the local machine. – Iain Feb 15 '15 at 18:25

I wanted to achieve the same functionality ( allow only local users in nginx ) and I figured out that I can do something simple like this:

server {
    listen 127.0.0.1:80;

    index index.html index.htm index.nginx-debian.html;

    location = /favicon.ico { access_log off; log_not_found off; }

    location /static/ {
        root /path/to/folder;
    }       

    location / {
        include proxy_params;
    }
}

This config file works fine for me, I am not using any allow directive, but only 127.0.0.1:80, and with that I am able to restrict nginx access to local users only!

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.