How can I deny access to nginx if the path contains /local or /local-int to all networks except the local one?
For example https://example.com/api/local/settings. I tried this, but when accessed locally, the request goes to /etc/nginx/html/api/local/settings,and not to the desired backend
location = (local|local-int) {
allow 10.150.0.0/16;
allow 10.160.0.0/16;
allow 10.170.0.0/16;
deny all;
}
I have about 20 such sites, and I’m trying to come up with a solution that would not be tied to a specific location
I summarize: if I access a site from allowed ip, then it should show the page to which I am accessing, and if from a deny list, then 403
Config example:
server {
listen ip:80;
listen ip:443 ssl;
server_name test.com;
if_modified_since off;
location /api {
proxy_pass https://api.example.com;
}
location ~ (/local) {
allow 10.150.0.0/16;
allow 10.160.0.0/16;
allow 10.170.0.0/16;
deny all;
}
}
2
Answers
This will simply work with both of your
locations
, since both starts with/local
Nginx takes a
=
location modifier as an exact match (docs are here). If you want to make a location that will catch every URI containing/local
substring (obviously including/local-int
), you can use a regex one:The
^~
modifier makes the location block in @user973254 answer (original answer version, already fixed) a prefix one with the greater priority than any regex locations, so it will overtake only the URIs starting with/local
(obviously not including/api/local/settings
from your example).However if your web backend requires an additional URI processing (which is a most common case nowadays), you’ll need at least to replicate your main location behavior with this new location. Fortunately, there is a way to avoid such a problems, and can be easily applied to an arbitrary number of sites as you ask for in your original question. You can check required conditions to make a decision for blocking the request or not using the (very powerful)
map
block feature. And since we want to match address against a list of subnets, we will use a chain ofmap
andgeo
blocks. To use regexes (PRCE/PCRE2 syntax) for amap
block match use a~
string prefix (~*
for case-insensitive match), strings containing some special characters (e.g. curly braces) should be single- or double-qouted. Here is a generic example (you’ll need only the first line of the followingmap
block to fulfill your question requirements):You can swap the logic to check the URI first (it can be some performance impact since the regex matching will be performed for every request including requests from the non-restricted networks, however if the majority of requests come from public addresses, there will be no significant difference). That way you can have a common non-restricted subnes list and per-site URI lists:
Of course, you are not limited to use 403 return code using this solution (which is the case when you are using
allow
/deny
directives). It also has nothing to do with the famous "If is evil" article since thisif
is used inserver
context.