5

Is it possible to configure nginx so that ALL websites are only accessible from the office IP address only?

This is a development server that, on some sites (too many to block one by one) accidentaly has some views and activity going and I want to block everyones' access except the people in the office which come from the office IP.

Is there any way to that?

6
  • How you define 'office ip'?
    – Alexey Ten
    Jun 6, 2015 at 8:16
  • A dynamic ip that very rarely changes
    – wadge
    Jun 6, 2015 at 8:21
  • So how you want to declare ip that 'rarely changes' in nginx or firewall?
    – Alexey Ten
    Jun 6, 2015 at 8:23
  • By following its pattern, up until now isp only has changed the last segment of the ip, I was considering an ip range for it.
    – wadge
    Jun 6, 2015 at 8:30
  • So why don't you want to stick with iptables?
    – Alexey Ten
    Jun 6, 2015 at 8:38

4 Answers 4

11

Why it needs firewall? allow/deny directives can be used not only in location sections, but in http section too.

http {
  allow 192.168.1.10; # office ip
  deny all;

  server {
    server_name acme1.com;
    # ...
  }

  server {
    server_name acme2.com;
    # ...
  }

}
2
  • I still have to check, but if the config uses a catch all server style configuration I can use the allow directive on the http block in the "main configuration file" and do the same as iptables?
    – wadge
    Jun 8, 2015 at 10:44
  • @ddrjm yes, of course
    – cadmi
    Jul 9, 2015 at 6:10
1

Sounds more like a work for a firewall. Assuming you are running Linux you could use iptables.

iptables -A INPUT -p tcp --src source_address --dport destination_port -j ACCEPT
iptables -A INPUT -p tcp --dport destination_port -j DROP
0

I'd use iptables to block port 80 for all IPs except your office.

4
  • That can't be done since our ip is dynamic and we can't afford being locked out of that server.
    – wadge
    Jun 5, 2015 at 18:39
  • it's basically doing the same as you want. you'll still have ssh access, ftp access etc. even if your ip changes, you just blocking web access for everyone else.
    – Ubertone
    Jun 5, 2015 at 18:41
  • I might consider this but blocking every port except port 80 and 22 both inbound and outbound, or is that a bit extreme? Also, can you point me to a tutorial or something regarding ip tables configuration?
    – wadge
    Jun 5, 2015 at 18:47
  • I'd not block anything outbound. What you can do to start is to block port 80 for anyone except your office. It would be also good for security reason to block port 22 same way but you'll be locked out when your dynamic IP changes. So ultimately it will be this way: 1. Block everything except for established connections 2. Allow port 22 for anyone 3. Allow port 80 just for your office Here's a good tutorial for CentOS but you can find other OS there as well digitalocean.com/community/tutorials/…
    – Ubertone
    Jun 5, 2015 at 18:56
0

As mentionned, iptables is an option.

As an alternative you can use the Nginx ngx_http_access_module to restrict access.

E.g assuming your office network is 192.168.1.0/24 :

location / {
    allow 192.168.1.0/24; # Office network
    deny  all;
    ...
    ...
}

Or

location / {
    allow 192.168.1.10; # James
    allow 192.168.1.11; # John
    deny  all;
    ...
    ...
}

Note : using this approach, users with IPs not allowed will get a 403, not a "site unreachable".

http://nginx.org/en/docs/http/ngx_http_access_module.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .