We use a number of application-servers fronted by NGinx. We now wish to restrict access to some of the apps by the proxy, but still allow the scripts running on the same host and internal LAN to bypass the new authentication.
To this end we added the following to the config:
satisfy any; allow 192.168.32.0/24; allow 192.168.29.29; allow 127.0.0.1; deny all; proxy_pass http://127.0.0.1...
However, this allows all requests to get in -- presumably, because the proxying is done to 127.0.0.1 and thus all requests match the above "allow 127.0.0.1" rule.
What are we doing wrong? What the right approach?