I'm running a few dockerized applications on a Digital Ocean server behind an nginx reverse proxy, this one to be exact: https://github.com/jwilder/nginx-proxy. I have it configured so that app1.domain.com goes to app1, app2.domain.com goes to app2, and etc. However, I noticed that if a user does public_ip:port they can still connect to my applications, even for the one that is configured through nginx to require a login through http authentication. Is there a way to configure nginx so that only they hostnames will be directed to the applications, and any port of the public ip is denied?


Depends on how you configured nginx.

Generally, the difference between the one and the other type of request is that one time the HTTP Host header is set, the other time it probably is not, or contains the IP (not sure). So you can filter on that.

Probably the following might work too (shamelessly copied from How can I block requests with the wrong Host header set?):

Define a default server

if you don't explicitly define a default server, nginx will implicitly use the first-found server. so, just create a server block to block unknown hosts:

server {   
  listen 80 default_server;
  return 444;
|improve this answer|||||
  • Yes, something along that worked! I saw that the nginx-proxy container had support for multiple conf files to add to the default configuration, so I added a file with a server block to return a 403. Thanks! – ROODAY Apr 6 '16 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.