|
| 1 | +--- |
| 2 | +title: ngx_http_access_module |
| 3 | +description: ngx_http_access_module |
| 4 | +toc: true |
| 5 | +nd-org-source: http/ngx_http_access_module.xml |
| 6 | +nd-plus: false |
| 7 | +nd-partial-plus: false |
| 8 | +--- |
| 9 | + |
| 10 | + |
| 11 | +<!-- |
| 12 | + ******************************************************************************** |
| 13 | + 🛑 WARNING: AUTOGENERATED FILE - DO NOT EDIT 🛑 This Markdown file was |
| 14 | + automatically generated from the source XML documentation. Any manual |
| 15 | + changes made directly to this file will be overwritten. To request or |
| 16 | + suggest changes, please edit the source XML files instead. |
| 17 | + https://github.com/nginx/nginx.org/tree/main/xml/en |
| 18 | + ******************************************************************************** |
| 19 | + --> |
| 20 | + |
| 21 | + |
| 22 | +The `ngx_http_access_module` module allows |
| 23 | +limiting access to certain client addresses. |
| 24 | + |
| 25 | +Access can also be limited by |
| 26 | +[password](/nginx/module-reference/http/ngx_http_auth_basic_module), by the |
| 27 | +[result of subrequest](/nginx/module-reference/http/ngx_http_auth_request_module), |
| 28 | +or by [JWT](/nginx/module-reference/http/ngx_http_auth_jwt_module). |
| 29 | +Simultaneous limitation of access by address and by password is controlled |
| 30 | +by the [satisfy](/nginx/module-reference/http/ngx_http_core_module#satisfy) directive. |
| 31 | +## Example Configuration |
| 32 | + |
| 33 | + |
| 34 | +```nginx |
| 35 | +location / { |
| 36 | + deny 192.168.1.1; |
| 37 | + allow 192.168.1.0/24; |
| 38 | + allow 10.1.1.0/16; |
| 39 | + allow 2001:0db8::/32; |
| 40 | + deny all; |
| 41 | +} |
| 42 | +
|
| 43 | +``` |
| 44 | + |
| 45 | + |
| 46 | +The rules are checked in sequence until the first match is found. |
| 47 | +In this example, access is allowed only for IPv4 networks |
| 48 | +`10.1.1.0/16` and `192.168.1.0/24` |
| 49 | +excluding the address `192.168.1.1`, |
| 50 | +and for IPv6 network `2001:0db8::/32`. |
| 51 | +In case of a lot of rules, the use of the |
| 52 | +[ngx_http_geo_module](/nginx/module-reference/http/ngx_http_geo_module) |
| 53 | +module variables is preferable. |
| 54 | +## Directives |
| 55 | + |
| 56 | +### allow |
| 57 | + |
| 58 | +{{< call-out >}} |
| 59 | + |
| 60 | +**Syntax:** allow `address` | `CIDR` | `unix:` | `all` |
| 61 | + |
| 62 | +**Default:** - |
| 63 | + |
| 64 | +**Context:** http, server, location, limit_except |
| 65 | + |
| 66 | + |
| 67 | +{{</call-out>}} |
| 68 | + |
| 69 | + |
| 70 | +Allows access for the specified network or address. |
| 71 | +If the special value `unix:` is specified (1.5.1), |
| 72 | +allows access for all UNIX-domain sockets. |
| 73 | +### deny |
| 74 | + |
| 75 | +{{< call-out >}} |
| 76 | + |
| 77 | +**Syntax:** deny `address` | `CIDR` | `unix:` | `all` |
| 78 | + |
| 79 | +**Default:** - |
| 80 | + |
| 81 | +**Context:** http, server, location, limit_except |
| 82 | + |
| 83 | + |
| 84 | +{{</call-out>}} |
| 85 | + |
| 86 | + |
| 87 | +Denies access for the specified network or address. |
| 88 | +If the special value `unix:` is specified (1.5.1), |
| 89 | +denies access for all UNIX-domain sockets. |
0 commit comments