IP-based access control (allow/deny) in Nginx - Commands & Configuration

Introduction

Sometimes you want to control who can visit your website by allowing or blocking certain IP addresses. IP-based access control lets you do this easily with nginx by specifying which IPs can or cannot access your site.

When you want to block a specific IP address that is causing trouble on your website.

When you want to allow only your office IP to access an internal web app.

When you want to restrict access to a sensitive admin page to certain IPs.

When you want to temporarily deny access to a region by blocking its IP range.

When you want to whitelist trusted IPs and deny all others for security.

Config File - nginx.conf

nginx.conf

server {
    listen 80;
    server_name example.com;

    location / {
        # Allow only 192.168.1.100 and 10.0.0.0/24
        allow 192.168.1.100;
        allow 10.0.0.0/24;
        deny all;

        root /var/www/html;
        index index.html;
    }
}

This nginx configuration sets up a server listening on port 80 for example.com.

Inside the location / block, it allows requests only from IP 192.168.1.100 and the IP range 10.0.0.0/24.

All other IPs are denied access with deny all;.

This controls who can access the website content served from /var/www/html.

Commands

This command tests the nginx configuration file for syntax errors before applying it. It helps catch mistakes early.

Terminal

sudo nginx -t

Expected Output

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

This command reloads nginx to apply the new configuration without stopping the server, so your site stays online.

Terminal

sudo systemctl reload nginx

Expected Output

No output (command runs silently)

This command sends a simple HTTP request to check if the site is accessible from your current IP after applying the access control.

Terminal

curl -I http://example.com

Expected Output

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 01 Jan 2025 12:00:00 GMT

Content-Type: text/html

Content-Length: 612

Connection: keep-alive

This command tries to access the site from a different network interface to simulate a denied IP and check if access is blocked.

Terminal

curl -I --interface eth1 http://example.com

Expected Output

HTTP/1.1 403 Forbidden

Server: nginx

Date: Wed, 01 Jan 2025 12:00:05 GMT

Content-Type: text/html

Content-Length: 162

Connection: keep-alive

Key Concept

If you remember nothing else from this pattern, remember: nginx processes allow and deny rules in order and stops at the first match to decide access.

Common Mistakes

Placing 'deny all;' before any 'allow' rules

nginx will deny all requests immediately, ignoring any allow rules after it.

Always list all 'allow' directives first, then end with 'deny all;' to block everyone else.

Not testing nginx configuration before reload

A syntax error can cause nginx to fail to reload, making the site unavailable.

Run 'sudo nginx -t' to check config syntax before reloading nginx.

Using incorrect IP format or missing subnet mask for ranges

nginx will not recognize the IP range and may allow or deny incorrectly.

Use correct IP or CIDR notation like '10.0.0.0/24' for ranges.

Summary

Write 'allow' rules first to specify permitted IPs, then 'deny all;' to block others.

Test your nginx config with 'nginx -t' before reloading to avoid downtime.

Reload nginx to apply changes without stopping the server.

Use curl or a browser to verify access control is working as expected.

Practice

1. What does the allow directive do in an nginx configuration?

easy

A. It permits access to specified IP addresses or ranges.

B. It blocks access to specified IP addresses or ranges.

C. It redirects users to another URL.

D. It logs the IP addresses of visitors.

Solution

1. Step 1: Understand the purpose of allow

   The allow directive in nginx is used to specify which IP addresses or ranges are permitted to access the server or location.

2. Step 2: Compare with other directives

   Unlike deny which blocks IPs, allow explicitly permits them.

3. Final Answer:

   It permits access to specified IP addresses or ranges. -> Option A

4. Quick Check:

   allow means permit access [OK]

Hint: Allow means permit access, deny means block access [OK]

Common Mistakes:

• Confusing allow with deny
• Thinking allow redirects users
• Assuming allow logs IPs

2. Which of the following is the correct syntax to deny access to IP 192.168.1.10 in nginx?

easy

A. allow 192.168.1.10;

B. deny 192.168.1.10;

C. block 192.168.1.10;

D. reject 192.168.1.10;

Solution

1. Step 1: Identify the correct directive for blocking IPs

   In nginx, the directive to block or deny access is deny.

2. Step 2: Check syntax correctness

   The correct syntax is deny IP_address; with a semicolon at the end.

3. Final Answer:

   deny 192.168.1.10; -> Option B

4. Quick Check:

   deny blocks IP = deny 192.168.1.10; [OK]

Hint: Use 'deny IP;' to block access in nginx [OK]

Common Mistakes:

• Using 'allow' instead of 'deny'
• Using invalid directives like 'block' or 'reject'
• Missing semicolon at the end

3. Given this nginx config snippet inside a location /admin block:

allow 10.0.0.0/24;
deny all;

What happens when a user with IP 10.0.0.15 tries to access /admin?

medium

A. Access is denied because the IP is not explicitly allowed.

B. Access is denied because deny all overrides allow.

C. Access is allowed only if the user has a valid cookie.

D. Access is allowed because the IP is in the allowed range.

Solution

1. Step 1: Understand the order of allow and deny

   nginx checks allow and deny rules in order. If an IP matches an allow rule, access is granted even if deny all follows.

2. Step 2: Check if IP matches allowed range

   IP 10.0.0.15 is inside 10.0.0.0/24, so it matches the allow rule.

3. Final Answer:

   Access is allowed because the IP is in the allowed range. -> Option D

4. Quick Check:

   Allow matched before deny all = access allowed [OK]

Hint: Allow rules take priority before deny all [OK]

Common Mistakes:

• Assuming deny all always blocks
• Ignoring IP range matching
• Thinking cookies affect IP access control

4. You wrote this nginx config inside a server block:

deny 192.168.0.0/16
allow all;

But all IPs are denied access. What is the problem?

medium

A. You need to reload nginx after changes.

B. The order of deny and allow is wrong; allow should come first.

C. Missing semicolon after deny directive causes config error.

D. The IP range 192.168.0.0/16 is invalid.

Solution

1. Step 1: Check syntax for missing semicolons

   nginx requires semicolons at the end of each directive. The deny line is missing a semicolon, causing the config to fail.

2. Step 2: Understand effect of syntax error

   Without proper syntax, nginx may ignore or misinterpret rules, leading to unexpected blocking of all IPs.

3. Final Answer:

   Missing semicolon after deny directive causes config error. -> Option C

4. Quick Check:

   Every directive needs semicolon [OK]

Hint: Always end nginx directives with semicolon [OK]

Common Mistakes:

• Ignoring missing semicolon errors
• Thinking order alone causes issue
• Assuming IP range is invalid

5. You want to allow access only from IP 203.0.113.5 and block everyone else for /secure location. Which nginx config snippet achieves this correctly?

hard

A. location /secure {
allow 203.0.113.5;
deny all;
}

B. location /secure {
deny all;
allow 203.0.113.5;
}

C. location /secure {
allow all;
deny 203.0.113.5;
}

D. location /secure {
deny 203.0.113.5;
allow all;
}

Solution

1. Step 1: Understand correct order of allow and deny

   nginx processes allow and deny in order. To allow one IP and block others, allow must come first, then deny all.

2. Step 2: Verify each option

   location /secure {
     allow 203.0.113.5;
     deny all;
   }

   correctly allows 203.0.113.5 then denies all others.

   location /secure {
     deny all;
     allow 203.0.113.5;
   }

   denies all first, so no one is allowed. Options A and D misuse allow and deny directives.

3. Final Answer:

   location /secure { allow 203.0.113.5; deny all; } -> Option A

4. Quick Check:

   Allow specific IP then deny all others [OK]

Hint: Allow first, then deny all to restrict access [OK]

Common Mistakes:

• Reversing allow and deny order
• Allowing all then denying one IP
• Misusing deny and allow directives