Nginx配置指定IP访问后台页面失效问题求助

Hey there! Let's troubleshoot why your IP restriction for the admin page isn't working as expected. Looking at your current Nginx config, I spot a couple of key issues that might be causing this:

1. Missing PHP request handling #

Your admin login page is a .php file (login.php), but there's no configuration in your server block to process PHP requests. By default, Nginx doesn't know how to handle PHP files, so when you hit that login page, it's probably falling back to the general location / rule instead of triggering your /en/admin/ IP restriction.

2. Location matching priority conflict #

Nginx uses specific priority rules for matching locations: regular expression locations (like those targeting .php files) have higher priority than prefix locations (like /en/admin/). Even if you added a PHP handler later, it would bypass your IP restriction because it would match first.

Here's a revised config that should fix the issue: #

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /var/www/html;
    # Add index.php to the default index list to handle PHP index pages
    index index.html index.htm index.nginx-debian.html index.php;

    server_name _;

    location / {
        try_files $uri $uri/ =404;
    }

    # Use ^~ to make this prefix location take priority over regex locations
    location ^~ /en/admin/ {
        # Apply IP restriction first
        allow 123.123.123.123;
        deny all;

        # Nested location to handle PHP files within /en/admin/
        location ~ \.php$ {
            include snippets/fastcgi-php.conf;
            # Update this path to match your PHP-FPM socket (check /run/php/ for your version)
            fastcgi_pass unix:/run/php/php7.4-fpm.sock;
        }
    }

    # Optional: Handle PHP requests outside the admin area (if needed)
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.4-fpm.sock;
    }

    autoindex off;
}

Key fixes explained: #

• ^~ /en/admin/: This makes the admin prefix location take precedence over any regular expression locations (like the PHP handler), ensuring all requests under /en/admin/ go through your IP restriction first.
• Nested PHP handler: By placing the .php location inside /en/admin/, we ensure only allowed IPs can execute PHP files in the admin directory.
• Added index.php: Ensures Nginx recognizes PHP index pages if needed.

Final steps to apply: #

1. Verify your PHP-FPM socket path: Check /run/php/ for your active PHP version (e.g., php8.2-fpm.sock for PHP 8.2) and update the fastcgi_pass line if needed.
2. Test the config for syntax errors: Run sudo nginx -t
3. Restart Nginx to apply changes: Run sudo systemctl restart nginx

That should get your IP restriction working for the admin page!

备注：内容来源于stack exchange，提问作者Elvin Mammadov