在 NGINX 上通过 HTTP/HTTPS 拒绝所有非 443 或 80 端口的连接

Question

I'm running a server on Nginx and Ubuntu, the site has a domain. I have an issue where if someone navigates to the IP and an appended port ( https://<ip-addr>:<port> ) it will load up a service that should not be accessed directly like that, the ports can be figured out with nmap.

I'm trying to return a 444 to these types of connections. I've tried adding these under the 'server' block:

if ($host != "domain.tld") {
          return 444;
                   }

and

    location / {

        return 444;
   }

now these work pretty well for denying connections to the IP and restricting it to the domain, but if you do the ip and the port it loads up just fine. if some of these services did not have some form of authentication then they are exposed to anyone and everyone.

I tried using iptables to block the port but that would also block the ` https://domain.tld/service , But that needs to work.

Service should be only accessible through this URL and not the IP and port.

Answer 1

Try this

server { # Will redirect all http to https
    listen      80 default_server;
    server_name _; # will catch everything

    return 301 https://domain.tld$request_uri;
}

server{ # Will redirect everything that is not "domain.tld" to http://domain.tld
    listen      443 ssl http2;
    server_name _; # will catch everything

    ssl_...

    return 301 http://domain.tld$request_uri;
}

server { # Do normal behavior
    listen      443 default_server;
    server_name *.domain.tld; # will catch everything

    ssl_...

    location / {
        ...
    }

    ...
}