Nginx help please

gwnd1989

I have this block in the nginx.conf. IP stands for actual IPs.

What I need is to IP restrict requests to /admin/ and /admin/whateverpath

location ~ ^/admin(/.*)?$ {
            allow IP;
            allow IP;
            allow IP;
            allow IP;
            allow IP;
            deny all;
}

But when this is in effect, it blocks all ips including the allowed IPs.

What am I doing wrong here? Thank you for any help.

tototo

location ^~ /admin/ {
    allow IP;
    deny all;
}

how about this?

gwnd1989

@tototo said:

location ^~ /admin/ {
    allow IP;
    deny all;
}

how about this?

Thank you, this is what I initially had, same issue. Will try again and post here.

FatGrizzly

@gwnd1989 said:

@tototo said:

location ^~ /admin/ {
    allow IP;
    deny all;
}

how about this?

Thank you, this is what I initially had, same issue. Will try again and post here.

is it a php application? are you handling .php seperately?

gwnd1989

@FatGrizzly said:

@gwnd1989 said:

@tototo said:

location ^~ /admin/ {
    allow IP;
    deny all;
}

how about this?

Thank you, this is what I initially had, same issue. Will try again and post here.

is it a php application? are you handling .php seperately?

Thank you

Ruby app, yes handling Ruby here

server {
    listen       8080;
    server_name  redacted;
    root '/home/redacted/api3-0/current/public';
    passenger_enabled on;
    passenger_ruby /usr/local/rvm/wrappers/ruby-2.7.2/ruby;
    passenger_app_root '/home/redacted/api3-0/current';
    passenger_app_env production;
    passenger_spawn_method smart;
    passenger_min_instances 24;
    passenger_friendly_error_pages off;

    location ~ ^/admin(/.*)?$ {
                allow IP;
                allow IP;
                allow IP;
                allow IP;
                deny all;
    }

    # Rails asset pipeline support.
    location ~ "^/assets/.+-[0-9a-f]{32}\..+" {
            error_page 490 = @static_asset;
            error_page 491 = @dynamic_request;
            recursive_error_pages on;

            if (-f $request_filename) {
                    return 490;
            }
            if (!-f $request_filename) {
                    return 491;
            }
    }
    location @static_asset {
            gzip_static on;
            expires max;
            add_header Cache-Control public;
            add_header ETag "";
    }
    location @dynamic_request {
            passenger_enabled on;
            passenger_ruby /usr/local/rvm/wrappers/ruby-2.7.2/ruby;
    }

}

Andreix

Make sure you're not behind a proxy.

Or use something like:
set_real_ip_from proxy_server_ip;

real_ip_header X-Forwarded-For;

amarc

How about:

1. deny all
2. allow what IP's you want

So.. it reads from top to bottom so invert that and put deny all on top

gwnd1989

@Andreix said:
Make sure you're not behind a proxy.

Or use something like:
set_real_ip_from proxy_server_ip;

real_ip_header X-Forwarded-For;

Thank you

amarc

@gwnd1989 said: Thank you

So, did you try any of options posted here and did any work ?

gwnd1989

@amarc said:

@gwnd1989 said: Thank you

So, did you try any of options posted here and did any work ?

The maintenance window is not up yet. Tomorrow morning I will.

amarc

Oh wow, did not know that.. Do you expect that '/etc/init.d/nginx reload' would cause downtime ?

marian

@amarc said: Oh wow, did not know that.. Do you expect that '/etc/init.d/nginx reload' would cause downtime ?

also, before reloading/restarting you can run "nginx -t" to check if there are any config errors.

gwnd1989

@amarc said:
Oh wow, did not know that.. Do you expect that '/etc/init.d/nginx reload' would cause downtime ?

No, but we have to follow the protocol. If the new edits break access for people its not ideal.

gwnd1989

@Andreix said:
Make sure you're not behind a proxy.

Or use something like:
set_real_ip_from proxy_server_ip;

real_ip_header X-Forwarded-For;

This worked

bolle

Or use something like:
set_real_ip_from proxy_server_ip;

real_ip_header X-Forwarded-For;

This worked

Was that inside location section, like so:

location ^~ /admin/ {
    allow IP;
    deny all;
    set_real_ip_from proxy_server_ip;
    eal_ip_header X-Forwarded-For;
}

Or did you put it before?

gwnd1989

@bolle said:

Or use something like:
set_real_ip_from proxy_server_ip;

real_ip_header X-Forwarded-For;

This worked

Was that inside location section, like so:

location ^~ /admin/ {
    allow IP;
    deny all;
    set_real_ip_from proxy_server_ip;
    eal_ip_header X-Forwarded-For;
}

Or did you put it before?

Before allow IP