Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm using ubuntu x64 server with nginx as webserver.

In my company, we configured intranet (local) dns server so that, when you enter domain1.com, it goes directly into defined LAN ip adress.

We need global access for domain2.com, which located in same server. When we open global access for domain2.com, occurred following problem:

As you know, anyone can detect ip adress of domain2.com (our server).

The problem is, when you access directly using server's global ip adress, server opens automatically domain1.com which must be restricted for global access. Here is nginx config of domain1.com:

server
{
set $host_path "/var/www/domain1";

server_name domain1.com;

root $host_path;
set $yii_bootstrap "index.php";

client_max_body_size 2000M;
client_body_buffer_size 1024k;

listen       80;

    charset utf-8;
    index index.php index.html;

access_log  /var/access_log;
error_log /var/error_log;

location ~ /(protected|framework|nbproject) {
        deny all;
        access_log off;
        log_not_found off;
    }

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        fastcgi_split_path_info  ^(.+\.php)(.*)$;
        #let yii catch the calls to unexising PHP files
        set $fsn /$yii_bootstrap;
        if (-f $document_root$fastcgi_script_name){
            set $fsn $fastcgi_script_name;
        }
        fastcgi_pass unix:/var/run/php5-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny  all;
    }


}

How to make domain1.com only for LAN (restrict global access)?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Relying on obscurity (an unknown host name) is insecure here. Anyone can set the host name, even from the outside:

curl -H "Host: example.com" http://the.ip.here/

A better way to restrict access it by setting access controls:

location / {
    try_files $uri $uri/ /index.php?$args;
    # Adjust the IP range if necessary
    allow   192.168.1.0/24;
    deny    all;
}

Documentation:

share|improve this answer
    
what does 192.168.1.0/24; mean? –  Tural Aliyev May 6 '13 at 9:36
    
The problem is, server's ip adress is: 192.168.5.35 and there are about 1500-2000 pc's in company. So I suggest it must allow access to 192.168.%.% –  Tural Aliyev May 6 '13 at 9:39
    
@TuralTeyyubogluAliyev in that case, use 192.168.0.0/16. See [serverfault.com/q/49765/51929](How does IPv4 Subnetting Work?) for basic network theory on this subject. To get tighter bounds, use ifconfig to determine the netmask. –  Lekensteyn May 6 '13 at 11:09
    
Doesn't worked for me –  Tural Aliyev May 6 '13 at 12:47
    
@TuralTeyyubogluAliyev More details would be nice, are you still able to access the server from inside? Are you now unable to access the server from the outside? Do not forget to reload the configuration and consult the error/access logs. –  Lekensteyn May 6 '13 at 12:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.