Tag: 2016

I have had Nginx (1.15.8) running for quite some time as a reverse proxy that serves some pages hosted within our organization from separate servers. Today I was trying to add some white list features and I noticed that it didn't work as expected. After checking the records, all traffic shows the $remote_addr as our internal portal (10.1.0.1).

Here is my nginx.conf, excluding all production sites. The server entry you see is my test for the whitelists.

worker_processes    1;

error_log           logs/error.log;
error_log           logs/error.log  warn;

events {
    worker_connections  1024;
}

http {
    log_format          main  '($time_iso8601) $remote_addr - $server_name:$server_port > $proxy_host:$proxy_port ($request - $status)';
    access_log          logs/access.log  main;
    server_names_hash_bucket_size  64;
    include             mime.types;
    default_type        application/octet-stream;
    client_max_body_size 2000M;
    client_header_timeout 120s;         
    client_body_timeout 120s;   

    sendfile            on;
    keepalive_timeout   65;

    server {
        listen      80;
        server_name whitelisttest.domain.com;
        location / {
            #allow 10.1.0.0/16; #internal
            deny all;
            root c:/webroot/;
            index index.html;
        }
    }
}

With the previous configuration, nobody can access the site (403). If I recommend the allow command, EVERYONE can access the site. I am testing this from an AWS server, as well as from a remote user's desktop. If I look at the records, the two requests (internal and external) are identical.

Here are the internal and external records with the allow Commented:

(2019-09-17T12:22:01-07:00) 10.1.0.1 - whitelisttest.domain.com:80 > -:- (GET / HTTP/1.1 - 403)
(2019-09-17T12:22:02-07:00) 10.1.0.1 - whitelisttest.domain.com:80 > -:- (GET /favicon.ico HTTP/1.1 - 403)
(2019-09-17T12:22:10-07:00) 10.1.0.1 - whitelisttest.domain.com:80 > -:- (GET / HTTP/1.1 - 403)
(2019-09-17T12:22:10-07:00) 10.1.0.1 - whitelisttest.domain.com:80 > -:- (GET /favicon.ico HTTP/1.1 - 403)

And here are the records with the allow NOT commented:

(2019-09-17T12:29:34-07:00) 10.1.0.1 - whitelisttest.domain.com:80 > -:- (GET / HTTP/1.1 - 200)
(2019-09-17T12:29:34-07:00) 10.1.0.1 - whitelisttest.domain.com:80 > -:- (GET /favicon.ico HTTP/1.1 - 404)
(2019-09-17T12:29:38-07:00) 10.1.0.1 - whitelisttest.domain.com:80 > -:- (GET / HTTP/1.1 - 200)
(2019-09-17T12:29:38-07:00) 10.1.0.1 - whitelisttest.domain.com:80 > -:- (GET /favicon.ico HTTP/1.1 - 404)

Why is this happening? Is this a network configuration problem?