1

I'm using ubuntu x64 server with nginx as webserver.

In my company, we configured intranet (local) dns server so that, when you enter domain1.com, it goes directly into defined LAN ip adress.

We need global access for domain2.com, which located in same server. When we open global access for domain2.com, occurred following problem:

As you know, anyone can detect ip adress of domain2.com (our server).

The problem is, when you access directly using server's global ip adress, server opens automatically domain1.com which must be restricted for global access. Here is nginx config of domain1.com:

server
{
set $host_path "/var/www/domain1";

server_name domain1.com;

root $host_path;
set $yii_bootstrap "index.php";

client_max_body_size 2000M;
client_body_buffer_size 1024k;

listen       80;

    charset utf-8;
    index index.php index.html;

access_log  /var/access_log;
error_log /var/error_log;

location ~ /(protected|framework|nbproject) {
        deny all;
        access_log off;
        log_not_found off;
    }

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        fastcgi_split_path_info  ^(.+\.php)(.*)$;
        #let yii catch the calls to unexising PHP files
        set $fsn /$yii_bootstrap;
        if (-f $document_root$fastcgi_script_name){
            set $fsn $fastcgi_script_name;
        }
        fastcgi_pass unix:/var/run/php5-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny  all;
    }


}

How to make domain1.com only for LAN (restrict global access)?

1 Answer 1

1

Relying on obscurity (an unknown host name) is insecure here. Anyone can set the host name, even from the outside:

curl -H "Host: example.com" http://the.ip.here/

A better way to restrict access it by setting access controls:

location / {
    try_files $uri $uri/ /index.php?$args;
    # Adjust the IP range if necessary
    allow   192.168.1.0/24;
    deny    all;
}

Documentation:

5
  • what does 192.168.1.0/24; mean?
    – Tural Ali
    May 6, 2013 at 9:36
  • The problem is, server's ip adress is: 192.168.5.35 and there are about 1500-2000 pc's in company. So I suggest it must allow access to 192.168.%.%
    – Tural Ali
    May 6, 2013 at 9:39
  • @TuralTeyyubogluAliyev in that case, use 192.168.0.0/16. See [serverfault.com/q/49765/51929](How does IPv4 Subnetting Work?) for basic network theory on this subject. To get tighter bounds, use ifconfig to determine the netmask.
    – Lekensteyn
    May 6, 2013 at 11:09
  • Doesn't worked for me
    – Tural Ali
    May 6, 2013 at 12:47
  • @TuralTeyyubogluAliyev More details would be nice, are you still able to access the server from inside? Are you now unable to access the server from the outside? Do not forget to reload the configuration and consult the error/access logs.
    – Lekensteyn
    May 6, 2013 at 12:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .