I'm implementing authentication for the sites hosted inside the office, I have a PAM auth module that authenticates the users, that's working good so far.
The problem is that I need to authenticate ONLY the users that come from the Internet (external), in this case the IP 192.168.12.1 which is the gateway device that routes all external traffic to the internal web server.
The relevant config I have so far is this:
server {
listen 80;
server_name xxxxxxxxxx;
access_log /var/log/nginx/xxxxxxxx.log;
location / {
satisfy any;
allow 192.168.1.0/24; ##Office subnet
allow 192.168.11.0/24; ##Office subnet
##Inside this subnet is the IP that needs to have auth 192.160.12.1
allow 192.168.12.0/24; ## Office subnet
auth_pam "XXXXXXXXXX";
auth_pam_service_name "nginx";
proxy_pass http://xx.xx.xx.xx/; ## Redirects to desired web server
}
}
If I use
satisfy all;
That will require every user (internal and external) to auth, that's not what I need
If I put deny 192.168.12.1 like this:
deny 192.168.12.1;
allow 192.168.1.0/24; ##Office subnet
allow 192.168.11.0/24; ##Office subnet
allow 192.168.12.0/24; ## Office subnet
I get 403 forbidden instantly
If I put deny 192.168.12.1 like this:
allow 192.168.1.0/24; ##Office subnet
allow 192.168.11.0/24; ##Office subnet
allow 192.168.12.0/24; ## Office subnet
deny 192.168.12.1;
It just bypass the authentication
I need a way to force 192.168.12.1 to go through authentication but without blocking the whole subnet 192.168.12.0/24 since there are other devices there that should be able to log without auth.