HttpAccessModule - Revision history

Admin: /* Directives */

2012-05-02T19:25:54Z

‎Directives

Admin: /* Directives */

2012-04-30T06:47:04Z

‎Directives

VBart: /* References */ update link

2012-04-21T15:15:47Z

‎References: update link

Jim: /* Synopsis */

2011-06-09T14:52:00Z

‎Synopsis

New page

= Synopsis =
This module provides a simple host-based access control.

Module nginx_http_access_module makes it possible to control access
for specific IP-addresses of clients. Since nginx 08.22 IPv6 is supported.

Access rules are checked according to the order of their declaration. The first rule that matches a particular address or set of addresses is the one that is obeyed.

Example configuration:
<geshi lang="nginx">
location / {
deny 192.168.1.1;
allow 192.168.1.0/24;
allow 10.1.1.0/16;
allow 2620:100:e000::8001;
deny all;
}
</geshi>

In this example access is granted to networks 10.1.1.0/16
and 192.168.1.0/24 with the exception of address 192.168.1.1, which is denied access together with all other addresses as defined by the deny all rule that is matched last in this location block. In addition it allows one specific IPv6 address. All others would be denied.

Note that the '''order''' of the deny/allow is of the '''utmost importance'''. If you're coming from the Apache world you might be tempted to think that you can switch the access directives order and everything will work. In fact it doesn't. Switching the order in the above example has the result of denying access to all addresses. Consider the following incorrect situation:

<geshi lang="nginx">
location / {
# This always returns a 403. Probably it isn't what you want.
deny all;
# These directives are never reached. Since there's deny all as the first one.
deny 192.168.1.1;
allow 192.168.1.0/24;
allow 10.1.1.0/1
}
</geshi>

If you are using many access rules you should consider that the
[[NginxHttpGeoModule|GeoIP module]] is a preferred alternative to the Access module.

= Directives =

== allow ==

{{Directive|name=allow|args=[ address {{!}} CIDR {{!}} all ]|default=none|context=http, server, location, limit_except|vars=no|phase=access}}

Directive grants access for the network or addresses indicated.

== deny ==

{{Directive|name=deny|args=[ address {{!}} CIDR {{!}} all ]|default=none|context=http, server, location, limit_except|vars=no|phase=access}}

Directive forbids access for the network or addresses indicated.

= Tips & Tricks =

The NginxHttpAccessModule can be used in conjunction with the ''error_page'' directive to redirect unauthorised visitors to an alternative site:

<geshi lang="nginx">
error_page 403 http://example.com/forbidden.html;
location / {
deny 192.168.1.1;
allow 192.168.1.0/24;
allow 10.1.1.0/16;
deny all;
}
</geshi>

= References =
[http://sysoev.ru/nginx/docs/http/ngx_http_access_module.html Original Documentation]

@@ Line 40: / Line 40: @@
 == allow ==
-<include wikitext nopre src="http://wiki.nginx.org/nginx.org/ngx_http_access_module/allow.txt" />
+<include wikitext nopre src="http://wiki.nginx.org/nginx.org/http/ngx_http_access_module/allow.txt" />
 Directive grants access for the network or addresses indicated.
 == deny ==
-<include wikitext nopre src="http://wiki.nginx.org/nginx.org/ngx_http_access_module/deny.txt" />
+<include wikitext nopre src="http://wiki.nginx.org/nginx.org/http/ngx_http_access_module/deny.txt" />
 Directive forbids access for the network or addresses indicated.

← Older revision		Revision as of 15:15, 21 April 2012
Line 67:		Line 67:

	= References =		= References =
−	[http://~~sysoev~~.ru/~~nginx~~/docs/http/ngx_http_access_module.html Original Documentation]	+	[http://nginx.org/en/docs/http/ngx_http_access_module.html Original Documentation]