Sign up ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

I'm using ubuntu x64 server with nginx as webserver.

In my company, we configured intranet (local) dns server so that, when you enter, it goes directly into defined LAN ip adress.

We need global access for, which located in same server. When we open global access for, occurred following problem:

As you know, anyone can detect ip adress of (our server).

The problem is, when you access directly using server's global ip adress, server opens automatically which must be restricted for global access. Here is nginx config of

set $host_path "/var/www/domain1";


root $host_path;
set $yii_bootstrap "index.php";

client_max_body_size 2000M;
client_body_buffer_size 1024k;

listen       80;

    charset utf-8;
    index index.php index.html;

access_log  /var/access_log;
error_log /var/error_log;

location ~ /(protected|framework|nbproject) {
        deny all;
        access_log off;
        log_not_found off;

    location / {
        try_files $uri $uri/ /index.php?$args;

    location ~ \.php$ {
        fastcgi_split_path_info  ^(.+\.php)(.*)$;
        #let yii catch the calls to unexising PHP files
        set $fsn /$yii_bootstrap;
        if (-f $document_root$fastcgi_script_name){
            set $fsn $fastcgi_script_name;
        fastcgi_pass unix:/var/run/php5-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;

    location ~ /\.ht {
        deny  all;


How to make only for LAN (restrict global access)?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Relying on obscurity (an unknown host name) is insecure here. Anyone can set the host name, even from the outside:

curl -H "Host:"

A better way to restrict access it by setting access controls:

location / {
    try_files $uri $uri/ /index.php?$args;
    # Adjust the IP range if necessary
    deny    all;


share|improve this answer
what does; mean? – Tural Aliyev May 6 '13 at 9:36
The problem is, server's ip adress is: and there are about 1500-2000 pc's in company. So I suggest it must allow access to 192.168.%.% – Tural Aliyev May 6 '13 at 9:39
@TuralTeyyubogluAliyev in that case, use See [](How does IPv4 Subnetting Work?) for basic network theory on this subject. To get tighter bounds, use ifconfig to determine the netmask. – Lekensteyn May 6 '13 at 11:09
Doesn't worked for me – Tural Aliyev May 6 '13 at 12:47
@TuralTeyyubogluAliyev More details would be nice, are you still able to access the server from inside? Are you now unable to access the server from the outside? Do not forget to reload the configuration and consult the error/access logs. – Lekensteyn May 6 '13 at 12:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.