0

We use a number of application-servers fronted by NGinx. We now wish to restrict access to some of the apps by the proxy, but still allow the scripts running on the same host and internal LAN to bypass the new authentication.

To this end we added the following to the config:

satisfy any;
allow 192.168.32.0/24;
allow 192.168.29.29;
allow 127.0.0.1;
deny all;
proxy_pass http://127.0.0.1...

However, this allows all requests to get in -- presumably, because the proxying is done to 127.0.0.1 and thus all requests match the above "allow 127.0.0.1" rule.

What are we doing wrong? What the right approach?

2
  • Have you tried using another loopback IP address for the proxied connections instead; e.g. set the proxy to forward to 127.0.0.2... instead of 127.0.0.1...? That way, you can distinguish between the two and filter accordingly.
    – Pak
    Aug 15 '17 at 21:20
  • proxy_pass has nothing to do with allow. Show full config
    – Alexey Ten
    Aug 16 '17 at 5:48
0

Ok, we found the reason and NGinx is innocent. A (seemingly) unrelated change to the setup was introduced recently redirecting HTTP to HTTPS. In our setup -- for reasons that are hard to explain -- the SSL-connections are terminated by HAProxy running on the same machine.

So, all HTTP connections are redirected to HTTPS first and then the SSL ones all appear (to NGinx) to originate from 127.0.0.1. Sorry for the noise and thanks to all trying to help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.