NGINX 过滤请求到 lan IP

Question

我收到了几个通过 NGINX 发出的请求，这些请求似乎是针对我的 LAN IP 192.168.0.1 的，如下所示：

nginx.vhost.access.log:

192.227.134.73 - - [29/Jul/2021:10:33:47 +0000] "POST /GponForm/diag_Form?style/       HTTP/1.1" 400 154 "-" "curl/7.3.2"

来自 Django：

Invalid HTTP_HOST header: '192.168.0.1:443'. You may need to add '192.168.0.1' to ALLOWED_HOSTS.

我的NGINX配置如下：

upstream django_server {
    server 127.0.0.1:8000;
}

# Catch all requests with an invalid HOST header
server {
    server_name "";
    listen 80;
        return 301 https://backoffice.example.com$request_uri;
    }

server {
    listen 80;
    # Redirect www to https
    server_name www.backoffice.example.com;
    modsecurity on;
    modsecurity_rules_file /some_directory/nginx/modsec/modsec_includes.conf;
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains;" always;
    add_header X-Frame-Options "deny" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    #add_header Content-Security-Policy "script-src 'self' https://example.com https://backoffice.example.com https://fonts.gstatic.com https://code.jquery.com";
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    return 301 https://backoffice.example.com$request_uri;
}

server {
      listen 443 ssl http2;
      server_name www.backoffice.example.com backoffice.example.com;
      modsecurity on;
      modsecurity_rules_file /some_directory/nginx/modsec/modsec_includes.conf;
      add_header Strict-Transport-Security "max-age=63072000; includeSubdomains;" always;
      add_header X-Frame-Options "deny" always;
      add_header X-XSS-Protection "1; mode=block" always;
      add_header X-Content-Type-Options "nosniff" always;
      #add_header Content-Security-Policy "script-src 'self' https://example.com https://backoffice.example.com https://fonts.gstatic.com https://code.jquery.com";
      add_header Referrer-Policy "strict-origin-when-cross-origin"; 

      ssl_certificate    /etc/ssl/nginx-ssl/backofficebundle.crt;
      ssl_certificate_key    /etc/ssl/nginx-ssl/backoffice.key;
      
      access_log /some_directory/nginx/nginx.vhost.access.log;
      error_log /some_directory/nginx/nginx.vhost.error.log;

    location / {
        proxy_pass http://localhost:8000;
        proxy_pass_header Server;
            proxy_redirect off;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Scheme $scheme;
            proxy_set_header REMOTE_ADDR $remote_addr;        
}


      location /media/ {
        alias /some_directory/backoffice/media/;
        }

        location /static/ {
        alias /some_directory/backoffice/static/;
    }

}

我的问题：

有什么方法可以配置 NGINX 来阻止对所有 LAN IP 的请求吗？
ModSecurity 可以做得更好吗？

Answer 1

Is there any way of configuring NGINX to block requests to all LAN IP's?

有，只在 public IP 上设置 nginx listen（例如 listen backoffice.example.com:443 ssl http2;）。虽然我不知道你为什么想要这个……

因为如果它是一个内部 IP，它不能从外部访问（根据定义——否则你不会称它为内部）。如果是这样的话，你的 network/firewall.

更像是一个问题

关于nginx的访问日志，我查不出有什么问题。 192.227.134.73 不是私有 IP。

关于Django日志，curl -H "Host: 192.168.0.1:443" https://backoffice.example.com会引起这样的请求。毕竟“宿主”header 只是一个 header，它可以包含任何内容。

NGINX 过滤请求到 lan IP

NGINX filter requests to lan IP

django

nginx

mod-security