本文介绍Nginx限制IP访问和限制目录访问的设置方法，希望对于初学Nginx服务器相关的朋友有帮助，更多Nginx安装、配置、报错处理等资源请本站内搜索。。
Nginx限制IP,限制目录访问的设置
根据nginx的文档：
ngx_http_access_module
This module provides a simple host-based access control.
Module ngx_http_access_module makes it possible to control access for specific IP-addresses of clients. Rules are checked in the order of their record to the first match.
Example configuration
location / {
deny 192.168.1.1;
allow 192.168.1.0/24;
allow 10.1.1.0/16;
deny all;
}
In the above example access is only granted to networks 10.1.1.0/16 and 192.168.1.0/24 with the exception of the address 192.168.1.1.
When implementing many rules, it is generally better to use the ngx_http_geo_module.
根据这个文档，比如我要限制private这个目录的访问，用如下规则
location /private {
allow 192.168.1.0/24;
deny all;
}
location ~ .php$ {
include fastcgi.conf;
}
这个时候实验会发现，private目录下的php之外的文件确实只有192.168.1.0这个网段的机器访问，但是php文件却依然可以访问，这是为什么哪？ 因为nginx的匹配方式是正则表达式优先级比较高。因此PHP解析用的是正则表达式进行匹配，而要限制的目录如果不是用正则表达式，所以，就算是要限制的目录，因为PHP还是能被匹配到，所以，还是解析PHP了。 所以，如果想解决的话，需要把目录也写成正则匹配，而且要放在PHP的前面，否则就会先匹配PHP。
location ~ ^/private/ {
allow 192.168.1.0/24;
deny all;
}
location ~ .php$ {
include fastcgi.conf;
}
改成这样以后，会发现php文件提示打开、保存，我点了保存以后，下载回来的文件就是明文的源代码。这又是为什么哪？ 根据nginx的文档：
location
syntax: location [=|~|~*|^~] /uri/ { ... }
default: no
context: server
This directive allows different configurations depending on the URI. It can be configured using both conventional strings and regular expressions. To use regular expressions, you must use the prefix ~* for case insensitive match and ~ for case sensitive match.
To determine which location directive matches a particular query, the conventional strings are checked first. Conventional strings match the beginning portion of the query and are case-sensitive - the most specific match will be used (see below on how nginx determines this). Afterwards, regular expressions are checked in the order defined in the configuration file. The first regular expression to match the query will stop the search. If no regular expression matches are found, the result from the convention string search is used.
在location中使用正则表达式去匹配的话，第一个匹配上的就不会再去匹配别的规则了，因此下面的那个匹配php文件的规则实际上被忽略了，因此php文件访问的时候就提示是打开还是保存了。
因此解决办法就是：单独把private目录下的php文件限制也写到规则里面，而且在php文件解析的规则之前：
location /private/ {
allow 192.168.1.0/24;
deny all;
}
location ~ ^/private/.*.php$ {
allow 192.168.1.0/24;
deny all; include fastcgi.conf;
}
location ~ .php$ {
include fastcgi.conf;
}
这样就可以实现我们的要求了，private目录下的文件都严格按照ip限制来访问，php文件也可以解析。
实例：
默认站点结构：
117.25.230.147 允许所有访问
117.25.230.147/test 限制访问
# Default site
server
{
listen 80;
server_name 117.25.230.147;
index index.html index.htm index.php;
root /usr/local/apache/htdocs/noexist/;
location ^~ /test {
allow 117.25.229.128/27;
allow 117.25.230.128/27;
allow 117.57.251.32/27;
deny all;
location ~ .*.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
include fcgi.conf;
}
}
location ~ .php$
{
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
#include fastcgi_params;
include fcgi.conf;
}
access_log off;
}
声明： 此文观点不代表本站立场；转载须要保留原文链接；版权疑问请联系我们。
