<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<h4>Hello everyone,</h4>
<p>Hopefully this is a simple question with a simple answer.</p>
<h4>First my actual goal:</h4>
<p>I'm hosting one server: domain.net which at domain.net serves a
basic homepage and uses iframes to proxy several other services,
which are defined in location blocks: domain.net/service.</p>
<p>I want to allow all IPs to access domain.net and the services
proxied inside of it. However I want to restrict direct access to
domain.net/service from outside my LAN.</p>
<h4>What I've got so far:</h4>
<p>I've set up my location blocks for my services to begin with:<br>
allow 192.168.x.x/25;<br>
deny all;<br>
which very effectively blocks access from outside my LAN. However
it still blocks the services when proxied from within domain.net,
I think because I am using "proxy_set_header X-Real-IP
$remote_addr;" so the proxied request is arriving at the location
block with an external IP. I looked but could not find
documentation on the proxy_set_header X-Real-IP statement (I even
ventured to page 2 of google <span class="moz-smiley-s4"><span>:-P</span></span>)
to try to get it to proxy the request as if my server running
nginx had made the request.<br>
</p>
<h4>What I would like from y'all:</h4>
<ol>
<li>If there is a better way to achieve my goal, please tell me. I
don't have my heart set on this, its just all I could figure.</li>
<li>How do I use the proxy_set_header X-Real-IP $remote_addr; to
fake the internal IP? or is that even the correct header to be
using?</li>
</ol>
<p>Thanks very much for your time,<br>
Rhys Ferris</p>
<h5>Sample location block:</h5>
<p> location /service/ {<br>
allow 192.168.136.128/25;<br>
deny all;<br>
proxy_pass <a class="moz-txt-link-freetext" href="http://prometheus:1234/service/">http://prometheus:1234/service/</a>;<br>
proxy_set_header Host $host;<br>
proxy_set_header X-Real-IP $remote_addr;<br>
proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;<br>
}<br>
<br>
</p>
<pre class="moz-signature" cols="72">--
Sent from Thunderbird on Ubuntu 19.10</pre>
</body>
</html>