Access#
The modulecontrols access to server resources based on client IP addresses or networks. It allows to permit or block specific IPs, IP ranges, or UNIX domain sockets to enhance security by restricting access to sensitive areas of a website or application.
Access can also be restricted by using a password with the Auth Basic module or based on the result of a subrequest with the Auth Request module. To apply both address and password restrictions at the same time, use the satisfy directive.
Configuration Example#
location / {
deny 192.168.1.1;
allow 192.168.1.0/24;
allow 10.1.1.0/16;
allow 2001:0db8::/32;
deny all;
}
Rules are evaluated sequentially until a match is found. In this example, access
is allowed only for the IPv4 networks 10.1.1.0/16
and
192.168.1.0/24
, excluding the specific address 192.168.1.1
, and
for the IPv6 network 2001:0db8::/32
. When there are many rules, it is
preferable to use variables from the Geo module.
Directives#
allow#
Allows access for a specified network or address.
The special value all
means all client IPs.
Added in version 1.5.1: The special value unix:
allows access for any UNIX domain sockets.
deny#
Denies access for a specified network or address.
The special value all
means all client IPs.
Added in version 1.5.1: The special value unix:
denies access for any UNIX domain sockets.