Nginx · The edge of your stack
How do you restrict access by IP or path?
Short answer
Use allow and deny in a location or server; rules are evaluated in order and the first match wins. For paths, use internal or deny hidden files, and configure real_ip behind a proxy.
allow and deny are simple but easy to get wrong because order matters. Nginx stops at the first matching rule. A trailing deny all blocks everything not explicitly allowed before it.
location /admin/ {
allow 10.0.0.0/8;
allow 192.168.1.0/24;
deny all;
}
location ~ /\.(?!well-known) {
deny all;
}
location = /metrics {
internal;
}Related controls
- Use satisfy any to combine IP rules with basic auth using OR semantics
- Use the geo module to map address ranges to named values
- Use internal for endpoints that should only be reached by internal redirects
- Behind a proxy, configure set_real_ip_from and real_ip_header so allow and deny see the client IP
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1In what order are allow and deny evaluated?
- 2What does satisfy any change?
- 3Why is an IP allowlist ineffective behind an untrusted proxy header?
- 4How do you block access to dotfiles?
Say it in the interview
I use allow and deny in order, ending with deny all so only listed ranges pass. For path protection I use internal or explicit deny rules, and I block dotfiles except well-known challenges. Behind a load balancer I configure real_ip with trusted proxy ranges first, otherwise every request looks like it came from the proxy and the allowlist is meaningless.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Nginx mock interview and get scored feedback on depth, clarity and confidence.