nginx针对某个url限制ip访问，常用于后台访问限制

nginx针对某个url限制ip访问，常用于后台访问限制

    假如我的站点后台地址为： http://www.abc.net/admin.php 那么我想限制只有个别ip可以访问后台，那么需要在配置文件中增加：location ~ .*admin.* {allow 1.1.1.1;allow 12.12.12.0/24;deny all;location ~ \.php$ {include fastcgi_params;fastcgi_pass  unix:/tmp/php-fcgi.sock;fastcgi_index index.php;fastcgi_param SCRIPT_FILENAME /data/www$fastcgi_script_name;}}需要注意的是，在这个location下也得加入php解析相关的配置，否则php文件无法解析。

 

 

 

upstream market-api{  server 127.0.0.1:3000;
}server {listen 80;listen 443 ssl;server_name  btc.btc.com;add_header Access-Control-Allow-Origin *;ssl_certificate  /etc/nginx/cert_sql/15.pem;ssl_certificate_key /etc/nginx/cert_sql/15.key;ssl_session_timeout 5m;ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;ssl_protocols TLSv1 TLSv1.1 TLSv1.2;ssl_prefer_server_ciphers on;#root  /var/www/api2;root  /var/www/apis;index index.php index.html index.htm;location / {try_files $uri $uri/ =404;}location /apis/{proxy_pass http://market-api;
         proxy_set_header Host $host;}location /api/ {if ( !-e $request_filename){rewrite ^/(.*)$ /api/web/index.php?s=$1 last;}}location ^~ /res/ {alias /data/api/;}include fastcgi-php.conf;
}

 

 

    location ~ .*index.php* {allow 12.12.12.0/24;deny all;location ~ \.php$ {include fastcgi_params;fastcgi_intercept_errors on;fastcgi_pass unix:/var/run/php/php5.6-fpm.sock;fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;}}

 

Nginx配置location限制IP访问策略

1.配置如下

server {listen       80;server_name  localhost;large_client_header_buffers 4 16k;client_max_body_size 300m;client_body_buffer_size 128k;proxy_connect_timeout 600;proxy_read_timeout 600;proxy_send_timeout 600;proxy_buffer_size 64k;proxy_buffers   4 32k;proxy_busy_buffers_size 64k;proxy_temp_file_write_size 64k;location / {root   html;index  index.html index.htm;}location /project {allow    220.178.25.22;allow    172.2.2.0/24;allow    192.2.2.0/24;deny    all;proxy_pass http://172.2.2.20:8080/project/;
            proxy_set_header   Host    $host:$server_port;proxy_set_header   X-Real-IP   $remote_addr; proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;client_max_body_size    10m;}error_page   500 502 503 504  /50x.html;location = /50x.html {root   html;}}

 

 

 

2.配置说明

 

以上配置的作用是允许IP为220.178.25.22，以及172和192网段的机器可以访问这个location地址，其他IP的客户端访问均是403。

其中，24是指子网掩码为255.255.255.0。

3.对照表(子网掩码/CIDR值)

255.0.0.0/8
255.128.0./9
255.192.0./10
255.224.0./11
255.240.0./12
255.248.0./13
255.252.0./14
255.254.0./15
255.255.0./16
255.255.128/17
255.255.192/18
255.255.224/19
255.255.240/20
255.255.248/21
255.255.252/22
255.255.254/23
255.255.255/24
255.255.255.128/25
255.255.255.192/26
255.255.255.224/27
255.255.255.240/28
255.255.255.248/29
255.255.255.252/30