{"id":131,"date":"2014-04-30T11:11:56","date_gmt":"2014-04-30T16:11:56","guid":{"rendered":"http:\/\/etapien.com\/guides\/?p=131"},"modified":"2020-08-24T14:22:36","modified_gmt":"2020-08-24T19:22:36","slug":"nginx-allow-access-certain-ips","status":"publish","type":"post","link":"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/","title":{"rendered":"NGINX – Allow access only to certain IPs"},"content":{"rendered":"

Nginx has a nice\u00a0module that not many people know about, it basically enables us to\u00a0allow or deny access to directories served by the webserver. The module is named<\/span>\u00a0<\/em>ngx_http_access_module<\/strong><\/em>\u00a0to allow or deny access to IP address. The syntax looks like this:<\/span><\/p>\n

location \/ {
\ndeny 192.168.1.1;
\nallow 192.168.1.0\/24;
\nallow 10.1.1.0\/16;
\nallow 2001:0db8::\/32;
\ndeny all;
\n}<\/p><\/blockquote>\n

The rules are checked in sequence from top to bottom until the first match is found. In this particular\u00a0example subnets 10.1.1.0\/16 and 192.168.1.0\/24 are allowed with the exception of 192.168.1.1.<\/p>\n

IPv6 range 2001:0db8::\/32 is also allowed, rest of the world is denied access.<\/span><\/p>\n

So, how to use this to secure your site?<\/strong><\/p>\n

Your access list should be included in the\u00a0nginx.conf<\/strong><\/em>\u00a0file but you should never add the IP directly into that file, instead you should create a blocklist file with all the IP\u2019s that I want to block or allow and include this file into the nginx.conf file.<\/p>\n

That way you can add the file without being root and the file is checked every time a user tries to access the website.<\/p>\n

Here it goes, first of we need to edit the\u00a0nginx.conf<\/strong><\/em>\u00a0file once and for all.<\/p>\n

nano \/etc\/nginx\/nginx.conf<\/p><\/blockquote>\n

\u00a0Find the\u00a0<\/span>http<\/strong>\u00a0<\/em>sectionand add the following lines inside that block<\/span><\/p>\n

### Include a blocklist file
\ninclude \/home\/mikho\/nginx-blockips-inthisfile.conf;<\/p><\/blockquote>\n

Save and exit with\u00a0Ctrl+X<\/strong><\/em><\/p>\n

Time to create the include file itself.<\/p>\n

\n

nano \/home\/mikho\/nginx-blockips-inthisfile.conf<\/p>\n<\/blockquote>\n

add IPs as you wish, if there is no explicit deny row, it will allow the connection:<\/p>\n

\n

deny 192.168.1.1;
\ndeny 192.168.1.2;
\ndeny 192.168.2.1\/24;<\/p>\n<\/blockquote>\n

if you want it to work the other way around and deny everyone that is\u00a0NOT<\/strong>\u00a0explicitly allowed in the file you could add these lines:<\/p>\n

\n

# allow the internal subnet 192.168.1.0\/24
\nallow 192.168.1.0\/24;
\n# drop rest of the world
\ndeny all;<\/p>\n<\/blockquote>\n

When you are done, Save and Exit with\u00a0Ctrl+X<\/strong><\/em>.<\/p>\n

test the configuration for spelling errors other configuration errors with:<\/p>\n

\/etc\/init.d\/nginx configtest<\/p><\/blockquote>\n

If you get an error message, troubleshoot the error and test again until everything is fine.<\/p>\n

Reload the configuration with:<\/p>\n

\n

\/etc\/init.d\/nginx force-reload<\/p>\n<\/blockquote>\n

Try it out from different IPs and see the difference.<\/p>\n

Customize the HTTP 403 Forbidden Error Message<\/h2>\n

 <\/p>\n

The default 403 error page is, well very “default” and plain so let’s create something nicer.<\/p>\n

create an html file in your webroot folder that we should load when the error occurs, paste this into the file:<\/p>\n

\n

<html>
\n<head><title>Error 403 – Access denied!<\/title><\/head>
\n<body>
\nYou do not have access to this page. There’s no need to try again.
\n<\/body>
\n<\/html><\/p>\n<\/blockquote>\n

then edit your Nginx config file and add this<\/p>\n

\n

error_page 403 \/error403.html;
\nlocation \/error403.html {
\nallow all;
\n}<\/p>\n<\/blockquote>\n

inside the server block. The example above tells Nginx to display the file error403.html everytime a 403 error occurs. We do need to make the exemption in the configuration file that everyone will be allowed to read this file, otherwise a default 403 error page would be displayed.<\/p>\n

Now\u00a0you know how to easily block access to your website and only allow a few selected IPs.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Nginx has a nice\u00a0module that not many people know about, it basically enables us to\u00a0allow or deny access to directories served by the webserver. The module is named\u00a0ngx_http_access_module\u00a0to allow or deny access to IP address. The syntax looks like this: location \/ { deny 192.168.1.1; allow 192.168.1.0\/24; allow 10.1.1.0\/16; allow 2001:0db8::\/32; deny all; } The […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"yoast_head":"\nNGINX - Allow access only to certain IPs - Tech Howtos<\/title>\n<meta name=\"description\" content=\"block or allow access per ip to nginx\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"NGINX - Allow access only to certain IPs - Tech Howtos\" \/>\n<meta property=\"og:description\" content=\"block or allow access per ip to nginx\" \/>\n<meta property=\"og:url\" content=\"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/\" \/>\n<meta property=\"og:site_name\" content=\"Tech Howtos\" \/>\n<meta property=\"article:published_time\" content=\"2014-04-30T16:11:56+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-08-24T19:22:36+00:00\" \/>\n<meta name=\"author\" content=\"Etapien\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Etapien\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/\",\"url\":\"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/\",\"name\":\"NGINX - Allow access only to certain IPs - Tech Howtos\",\"isPartOf\":{\"@id\":\"https:\/\/etapien.com\/guides\/#website\"},\"datePublished\":\"2014-04-30T16:11:56+00:00\",\"dateModified\":\"2020-08-24T19:22:36+00:00\",\"author\":{\"@id\":\"https:\/\/etapien.com\/guides\/#\/schema\/person\/c67f514649b78dbb5ef0c254a0521424\"},\"description\":\"block or allow access per ip to nginx\",\"breadcrumb\":{\"@id\":\"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/etapien.com\/guides\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"NGINX – Allow access only to certain IPs\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/etapien.com\/guides\/#website\",\"url\":\"https:\/\/etapien.com\/guides\/\",\"name\":\"Tech Howtos\",\"description\":\"Tech related useful howtos\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/etapien.com\/guides\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/etapien.com\/guides\/#\/schema\/person\/c67f514649b78dbb5ef0c254a0521424\",\"name\":\"Etapien\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/etapien.com\/guides\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/55021fd8fb4a829ad64ffab0a92d3b90?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/55021fd8fb4a829ad64ffab0a92d3b90?s=96&d=mm&r=g\",\"caption\":\"Etapien\"},\"url\":\"https:\/\/etapien.com\/guides\/author\/Etapien\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"NGINX - Allow access only to certain IPs - Tech Howtos","description":"block or allow access per ip to nginx","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/","og_locale":"en_US","og_type":"article","og_title":"NGINX - Allow access only to certain IPs - Tech Howtos","og_description":"block or allow access per ip to nginx","og_url":"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/","og_site_name":"Tech Howtos","article_published_time":"2014-04-30T16:11:56+00:00","article_modified_time":"2020-08-24T19:22:36+00:00","author":"Etapien","twitter_misc":{"Written by":"Etapien","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/","url":"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/","name":"NGINX - Allow access only to certain IPs - Tech Howtos","isPartOf":{"@id":"https:\/\/etapien.com\/guides\/#website"},"datePublished":"2014-04-30T16:11:56+00:00","dateModified":"2020-08-24T19:22:36+00:00","author":{"@id":"https:\/\/etapien.com\/guides\/#\/schema\/person\/c67f514649b78dbb5ef0c254a0521424"},"description":"block or allow access per ip to nginx","breadcrumb":{"@id":"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/etapien.com\/guides\/nginx-allow-access-certain-ips\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/etapien.com\/guides\/"},{"@type":"ListItem","position":2,"name":"NGINX – Allow access only to certain IPs"}]},{"@type":"WebSite","@id":"https:\/\/etapien.com\/guides\/#website","url":"https:\/\/etapien.com\/guides\/","name":"Tech Howtos","description":"Tech related useful howtos","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/etapien.com\/guides\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/etapien.com\/guides\/#\/schema\/person\/c67f514649b78dbb5ef0c254a0521424","name":"Etapien","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/etapien.com\/guides\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/55021fd8fb4a829ad64ffab0a92d3b90?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/55021fd8fb4a829ad64ffab0a92d3b90?s=96&d=mm&r=g","caption":"Etapien"},"url":"https:\/\/etapien.com\/guides\/author\/Etapien\/"}]}},"_links":{"self":[{"href":"https:\/\/etapien.com\/guides\/wp-json\/wp\/v2\/posts\/131"}],"collection":[{"href":"https:\/\/etapien.com\/guides\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/etapien.com\/guides\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/etapien.com\/guides\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/etapien.com\/guides\/wp-json\/wp\/v2\/comments?post=131"}],"version-history":[{"count":1,"href":"https:\/\/etapien.com\/guides\/wp-json\/wp\/v2\/posts\/131\/revisions"}],"predecessor-version":[{"id":132,"href":"https:\/\/etapien.com\/guides\/wp-json\/wp\/v2\/posts\/131\/revisions\/132"}],"wp:attachment":[{"href":"https:\/\/etapien.com\/guides\/wp-json\/wp\/v2\/media?parent=131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/etapien.com\/guides\/wp-json\/wp\/v2\/categories?post=131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/etapien.com\/guides\/wp-json\/wp\/v2\/tags?post=131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}