Nginx access control allow and deny (ngx_http_access_module)

The nginx module name ngx_http_access_module is a stranger to many people, but no one knows about deny and allow. In fact, deny and allow commands belong to ngx_http_access_module. we want to control a uri or a path that is not accessible to anyone. nginx has to rely on it.

The syntax of the nginx access control module is very simple, at least better than apache. The order of apache allow and deny allows many beginners to capture the header. Well, let's take a look at the usage of this plug-in.

1. Installation module

This module is built in nginx unless you use the-without-http_access_module during installation. If you have not installed nginx, refer to the nginx installation written before ttlsa.

2. Commands

Allow
Syntax: allow address | CIDR | unix: | all;
Default value :-
Configuration segment: http, server, location, limit_0000t

Allow access from an ip address or an ip address segment. if unix: is specified, socket access is allowed. note: If your version is lower than this, do not use this method.

Deny
Syntax: deny address | CIDR | unix: | all;
Default value :-
Configuration segment: http, server, location, limit_0000t

Prohibit access from an ip address or an ip address segment. if unix: is specified, socket access is prohibited. note: If your version is lower than this, do not use this method.

3. allow and deny instances

The code is as follows:	Copy code
Location /{ Deny 192.168.1.1; Allow 192.168.1.0/24; Allow 10.1.1.0/16; Allow 2001: 0db8:/32; Deny all; }

The order from top to bottom, similar to iptables. After matching, the system jumps out. In the preceding example, 192.16.1.1 is disabled, and three CIDR blocks are allowed, including an ipv6 instance. All unmatched IP addresses are not allowed to access the instance. in the actual production environment, we will also use the nginx geo module. For more information, see the ttlsa article nginx geo usage.

4. Conclusion

The nginx access control module requires the simplest commands in nginx. You only need to remember who you want to deny access and add IP addresses to deny. If you want to allow access, add the allow ip address. If you want to disable or allow all the commands, then allow all or deny all.