1

I have a server with a main IP (the default one of the server) and two additional IPs.

The problem is that all the IP of my server redirects to my site.

I want only the main IP to redirect to my site in IPv6 and IPv4.

Here is my configuration :

$ sudo nano /etc/netplan/50-cloud-init.yaml

network:
    version: 2
    ethernets:
        ens3:
            dhcp4: true
            dhcp6: no
            addresses:
                - 2001:41d0:666:1000::a5e/64
                - 164.532.101.48/32
                - 164.532.101.49/32
            gateway6: 2001:41d0:666:1000::1
            routes:
                - to: 2001:41d0:666:1000::a5e/64
                  via: 2001:41d0:666:1000::1
            match:
                macaddress: fa:96:9e:f0:27:b2
            set-name: ens1

$ sudo nano /etc/nginx/sites-available/www-example-com

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name example.com www.example.com;

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://www.example.com$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.example.com;
    root /var/www/www-example-com/web;
    index index.php;

    ssl_certificate /etc/letsencrypt/live/www.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;

    brotli on;
    brotli_comp_level 6;
    brotli_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;

    expires 1209600s;

    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    location ~* \.(txt|log)$ {
        deny all;
    }

    location ~ \..*/.*\.php$ {
        return 403;
    }

    location ~ ^/sites/.*/private/ {
        return 403;
    }

    location ~ ^/sites/[^/]+/files/.*\.php$ {
        deny all;
    }

    location ~* ^/.well-known/ {
        allow all;
    }

    location ~ (^|/)\. {
        return 403;
    }

    location / {
        try_files $uri /index.php?$query_string;
    }

    location @rewrite {
        rewrite ^/(.*)$ /index.php?q=$1;
    }

    location ~ /vendor/.*\.php$ {
        deny all;
        return 404;
    }

    location ~ '\.php$|^/update.php' {
        expires off;
        fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
        include fastcgi_params;
        fastcgi_param HTTP_PROXY "";
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_intercept_errors on;
        fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
    }

    location ~ ^/sites/.*/files/styles/ {
        try_files $uri @rewrite;
    }

    location ~ ^(/[a-z\-]+)?/system/files/ {
        try_files $uri /index.php?$query_string;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
        try_files $uri @rewrite;
        expires max;
        log_not_found off;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/letsencrypt/live/www.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    location / {
        return 301 https://www.example.com$request_uri;
    }
}
  • Where is your default server block that was included with nginx? You need to have this enabled in order to do what you want. – Michael Hampton Mar 12 '19 at 18:59
  • @MichaelHampton If I turn on the default server, I have this error nginx: [emerg] a duplicate default server for 0.0.0.0:80 in /etc/nginx/sites-enabled/www-example-com:2 nginx: configuration file /etc/nginx/nginx.conf test failed – ML61 Mar 12 '19 at 19:04
  • 1
    That's because you specifically chose a default server which is the one you redirected everything to, instead of the original default server. – Michael Hampton Mar 12 '19 at 19:11
2

You should re-enable the default server that came with your Debian build of nginx, and remove default_server from the server block of your host that you don't want to actually be the default server. After this, requests to your IP addresses will only get the "It works" page (which you can change later if needed).

  • thank you so much it works now. But phpmyadmin displays a 404 error it's complicated http://51.68.41.141/phpmyadmin. A small question, if the IP does not redirect to the site, does this have an impact on SEO ? – ML61 Mar 12 '19 at 19:35
  • It has no real effect on your SEO but is a minor improvement in your security. – Michael Hampton Mar 13 '19 at 0:37
-1

It appears Nginx is listening on ALL your interfaces:

Understanding different values for nginx 'listen' directive

If you require your web server to only listen on certain address, specify them via the listen directive per the docs here:

http://nginx.org/en/docs/http/ngx_http_core_module.html#listen

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.