如何在Nginx中禁止通过HTTPS IP访问站点 仅允许指定域名访问

解决方法 #

你只需要新增两个默认拦截用的server块，所有未匹配到your-domain、www.your-domain的请求（包括直接IP访问）都会被拦截返回444状态码，原有配置不需要修改。
完整配置如下：

# 新增：80端口默认拦截块，所有非你的域名的80请求直接返回444
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    return 444;
}

# 新增：443端口默认拦截块，所有非你的域名的HTTPS请求直接返回444
server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    server_name _;
    # 这里复用你已申请的SSL证书即可，也可以替换为自签证书
    ssl_certificate /etc/letsencrypt/live/your-domain/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain/privkey.pem;
    return 444;
}

# 以下为你原有的配置，无需修改
server {
    server_name your-domain  www.your-domain;
    
    location / {
        proxy_pass http://localhost:5000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection keep-alive;
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/your-domain/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/your-domain/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = www.your-domain) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    if ($host = your-domain) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    listen [::]:80;
    server_name your-domain  www.your-domain;
    return 404; # managed by Certbot
}

配置生效步骤 #

• 修改完成后执行 nginx -t 校验配置语法是否正确
• 校验通过后执行 systemctl reload nginx 重载Nginx配置即可生效

内容的提问来源于stack exchange，提问作者raklos