En esta entrada veremos como restringir el acceso a unas determinadas ip’s a una URL mediante NGINX:
En esta ocasión veremos como bloquear las siguientes entradas de JBOSS para denegar el acceso a todas las redes excepto: 192.168.1.0/24
location ~ ^/(admin-console|jbossws|jmx-console) {
allow 192.168.1.0/24;
deny all;
proxy_pass http://backend_servers;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
Ejemplo:
upstream backend_servers {
least_conn;
server 192.168.1.33;}
server {
listen 80;server_name red-orbita.com;
location / {
add_header Front-End-Https on;
add_header Cache-Control «public, must-revalidate»;
add_header Strict-Transport-Security «max-age=2592000; includeSubdomains»;
proxy_pass http://backend_servers;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
access_log /var/log/nginx/proxy.access.log;
error_log /var/log/nginx/proxy.error.log;}
}
server {
listen 443 ssl;
server_name red-orbita.com;
access_log /var/log/nginx/red-orbita.access.log;
error_log /var/log/nginx/red-orbita.error.log;ssl on;
ssl_certificate /etc/nginx/ssl/red-orbita.com-cert.pem;
ssl_certificate_key /etc/nginx/ssl/red-orbita.com-privatekey.key;
keepalive_timeout 60;ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
ssl_protocols SSLv3 TLSv1;
ssl_prefer_server_ciphers on;
ssl_verify_client off;proxy_buffers 16 64k;
proxy_buffer_size 128k;location / {
add_header Front-End-Https on;
add_header Cache-Control «public, must-revalidate»;
add_header Strict-Transport-Security «max-age=2592000; includeSubdomains»;
proxy_pass http://backend_servers_mrg;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;}
location ~ ^/(admin-console|jbossws|jmx-console) {
allow 192.168.1.0/24;
deny all;
proxy_pass http://backend_servers;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}}
:wq!
