Nginx 反向代理，只允许从主机名而不是 ip 连接

Question

是否可以仅允许用户输入 xxxxxx.com（虚构），因此他们应该进行 DNS 查找并连接。并阻止使用我的 public ip 连接的用户？

配置：

server {
listen 80;
return 301 https://$host$request_uri;
}

server {

listen 443;
server_name xxxxxxx.com;

ssl_certificate           /etc/nginx/ssl/server.crt;
ssl_certificate_key       /etc/nginx/ssl/server.key;

ssl on;
ssl_session_cache  builtin:1000  shared:SSL:10m;
ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;

access_log            /var/log/nginx/jenkins.access.log;

location / {

  proxy_set_header        Host $host;
  proxy_set_header        X-Real-IP $remote_addr;
  proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header        X-Forwarded-Proto $scheme;

  # Fix the “It appears that your reverse proxy set up is broken" error.
  proxy_pass          http://10.0.11.32:80;
  proxy_read_tenter code hereimeout  360;

  proxy_redirect      http://10.0.11.32:80 https://xxxxxxx.com;
}
}

Answer 1

$http_host参数设置为Host请求头的值。 nginx 将该值用于 select 一个 server 块。如果未找到 server 块，则使用默认服务器，标记为 default_server 或者是遇到的第一个 server 块。参见 this documentation。

要强制 nginx 只接受指定的请求，请使用 catch all 服务器块来拒绝任何其他请求，例如：

server {
    listen 80 default_server;
    return 403;
}

server {
    listen 80;
    server_name www.example.com;
    ...
}

使用SSL协议，具体要看你有没有SNI enabled. If you are not using SNI, then all SSL requests pass through the same server block, in which case you will need to use an if directive to test the value of the $http_host value. See this and this

Nginx 反向代理，只允许从主机名而不是 ip 连接

Nginx reverse proxy, only allow connection from hostname not ip

nginx

dns

reverse-proxy

hostname