1

I am trying to proxy_pass users with certain IPs to http://server1 and certain other users to http://server2. I'd like to return 403 if the user doesn't match any IP. Here's what I have:

geo $userGroup1 {
        default 0;
        192.168.178.2 1;
}
geo $userGroup2 {
        default 0;
        192.168.178.3 1;
}

server {
        listen 80 default_server;
        listen [::]:80 default_server;


    server_tokens off;
    server_name _;

    index index.html index.htm index.nginx-debian.html;

    server_name _;

    location / {
        if ($userGroup1) {
                proxy_pass http://server1 
        }
        if ($userGroup2) {
                proxy_pass http://server2
        }

        # return 403 <-- returns 403 for all users

    }



}

How would my config need to be changed?

dmuensterer
  • 143

2 Answers2

2

Have finally gotten around testing this, do keep in mind that "proxy_pass" cannot contain a URI in example below, use an IP address.

If you want to forwad to another server by URI, you could maybe use "return" or "rewrite" instead of "proxy_pass"; For more information click here.

geo $remote_addr $userGroup {
        default             0;
        192.168.178.2       1;
        192.168.178.3       2;
}

server {
    listen 80;
    listen [::]:80;


server_name _;
server_tokens off;

index index.html index.htm index.nginx-debian.html;

location / {
        if ($userGroup = 1) {
                proxy_pass https://192.168.178.201;
        }
        if ($userGroup = 2) {
                proxy_pass https://192.168.178.202;
        }

        return 403; # Anyone else would get a 403
}



}
Nuno Chaves
  • 131
0

Try to use the directive 'break' inside the 'if' statement, like this:

geo $userGroup1 {
       default 0;
       192.168.178.2 1;
}

geo $userGroup2 {
        default 0;
        192.168.178.3 1;
}


server {
        listen 80 default_server;
        listen [::]:80 default_server;


    server_tokens off;
    server_name _;

    index index.html index.htm index.nginx-debian.html;

    server_name _;

    location / {
        if ($userGroup1) {
                proxy_pass http://server1;
                break; # <-------- HERE
        }
        if ($userGroup2) {
                proxy_pass http://server2;
                break; # <-------- HERE
        }

        return 403; # <-- returns 403 for all users

    }



}
Jose
  • 1