Prevent access from internet router IP (not source IP)

Projects NGINX
,
1

Please use this template for troubleshooting questions.

My issue: I have an internal network of 192.168.2.x, my nginx is on .2.2. I have some websites that I do NOT want to be accessed from the internet. My internet router is on .2.1. How do I deny traffic coming through the router since the router address is not the source address?

How I encountered the problem:

Solutions I’ve tried: various allow / deny configurations.

Deployment environment: Latest nginx on debian 13.

2

You’re on the right track with the access module (allow/deny directives). This sort of thing should do it.

server {
    listen …;
    server_name private.example.org;

    allow 192.168.2.0/24;
    deny all;

    root …;
}
1 Like
3

I’d additionally make sure that your inbound wan->lan port forwarding applies DNAT only and that SNAT/masquerade is not applied, otherwise, nginx will see your router’s IP as the source => allow rule will incorrectly match