# Restrict direct link file access

**URL:** <https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232>\
**Category:** NGINX\
**Created:** [August 13, 2010, 7:48pm UTC](https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232 "2010-08-13T19:48:59Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![antituhan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/6bbea6/32.png) [@antituhan](https://www.ruby-forum.com/u/antituhan)\
**Post date:** [August 13, 2010, 7:48pm UTC](https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232/1 "2010-08-13T19:48:59Z")

</div>

Hi,

Could nginx restrict direct link access / hotlink access to specified  
file/extension ?

I try to write the rules like this :

location ~ ^/\*(.exe)$ {  
deny ip.ad.dr.es;  
}

But nothing happen, the files still can be downloaded by denied ip  
address.

Somebody help me please 🙂

---

<div class="post-metadata">

**Author:** ![antituhan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/6bbea6/32.png) [@antituhan](https://www.ruby-forum.com/u/antituhan)\
**Post date:** [August 14, 2010, 1:02am UTC](https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232/2 "2010-08-14T01:02:12Z")

</div>

On Fri, Aug 13, 2010 at 3:44 AM, antituhan [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hi, Could nginx restrict direct link access / hotlink access to specified  
> file/extension ?  
> I try to write the rules like this :
> 
> location ~ ^/\*(.exe)$ {  
> deny ip.ad.dr.es;  
> }
> 
> But nothing happen, the files still can be downloaded by denied ip address.  
> Somebody help me please 🙂

at least, you forgot a dot.

location ~ ^/.\*(.exe)$ {  
deny ip.ad.dr.es;  
}

(note that I’m not too familiar with deny directive)

–  
O\< ascii ribbon campaign - stop html mail - [www.asciiribbon.org](http://www.asciiribbon.org)

---

<div class="post-metadata">

**Author:** ![antituhan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/6bbea6/32.png) [@antituhan](https://www.ruby-forum.com/u/antituhan)\
**Post date:** [August 16, 2010, 7:08am UTC](https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232/3 "2010-08-16T07:08:06Z")

</div>

I’ve added a dot in front of \*, like this :

location ~ ^/.\*(.exe)$ {  
deny ip.ad.dr.es;  
}

And still not working ☹

---

<div class="post-metadata">

**Author:** ![antituhan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/6bbea6/32.png) [@antituhan](https://www.ruby-forum.com/u/antituhan)\
**Post date:** [August 16, 2010, 7:28pm UTC](https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232/4 "2010-08-16T19:28:41Z")

</div>

## Thanks, but this rules will show 404 not found on my site ☹ Unlisted IP (allowed IP) will be redirected to 404 not found page.

View this message in context:  
[http://nginx.2469901.n2.nabble.com/ASK-Restrict-direct-link-file-access-tp5417795p5428735.html](http://nginx.2469901.n2.nabble.com/ASK-Restrict-direct-link-file-access-tp5417795p5428735.html)  
Sent from the nginx mailing list archive at [Nabble.com](http://Nabble.com).

---

<div class="post-metadata">

**Author:** ![antituhan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/6bbea6/32.png) [@antituhan](https://www.ruby-forum.com/u/antituhan)\
**Post date:** [August 16, 2010, 7:36pm UTC](https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232/5 "2010-08-16T19:36:18Z")

</div>

May be, this example of URL can explain more …

[http://www.mydomain.com/e107\_files/downloads/OS/81xx/8100\_PBr4.5.0\_rel174\_PL2.7.0.92\_A4.5.0.124.exe](http://www.mydomain.com/e107_files/downloads/OS/81xx/8100_PBr4.5.0_rel174_PL2.7.0.92_A4.5.0.124.exe)  
(for .exe files)  
[http://www.mydomain.com/e107\_files/downloads/DM/600\_b042\_multilanguage.exe](http://www.mydomain.com/e107_files/downloads/DM/600_b042_multilanguage.exe)  
(the same .exe files but in different directory)

Thanks  
antituhan

---

<div class="post-metadata">

**Author:** ![antituhan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/6bbea6/32.png) [@antituhan](https://www.ruby-forum.com/u/antituhan)\
**Post date:** [August 16, 2010, 12:34pm UTC](https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232/6 "2010-08-16T12:34:07Z")

</div>

On Thu, 2010-08-12 at 13:44 -0700, antituhan wrote:

> Hi, Could nginx restrict direct link access / hotlink access to  
> specified file/extension ?  
> I try to write the rules like this :  
> location ~ ^/\*(.exe)$ {  
> deny ip.ad.dr.es;  
> }

location ~ .exe$ {  
deny ip.ad.dr.es;  
}

## Cliff

---

<div class="post-metadata">

**Author:** ![antituhan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/6bbea6/32.png) [@antituhan](https://www.ruby-forum.com/u/antituhan)\
**Post date:** [August 16, 2010, 11:51pm UTC](https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232/7 "2010-08-16T23:51:00Z")

</div>

On Mon, 2010-08-16 at 10:27 -0700, antituhan wrote:

> Thanks, but this rules will show 404 not found on my site ☹  
> Unlisted IP (allowed IP) will be redirected to 404 not found page.

You need to have a root directive. Either put one in the server section  
(generally preferred) or if your .exe’s are in a particular place, you  
can put it in the location directive.

If that doesn’t fix it then you will need to post your config so someone  
can help you debug it.

Cliff

–

---

<div class="post-metadata">

**Author:** ![antituhan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/6bbea6/32.png) [@antituhan](https://www.ruby-forum.com/u/antituhan)\
**Post date:** [August 17, 2010, 12:02am UTC](https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232/8 "2010-08-17T00:02:42Z")

</div>

You should look into x-file-redirect. That way you can have a backend  
script handle the authentication and then let Nginx handle the streaming  
part if the user is allowed to download .

Posted at Nginx Forum:

> **[Re: \[ASK\] Restrict direct link file access](https://forum.nginx.org/read.php?2,119550,120491#msg-120491)**
>
> Hi, Could nginx restrict direct link access / hotlink access to specified file/extension ? I try to write the rules like this : location ~ ^/\*(\\.exe)$ { deny ip.ad.dr.es; } But nothing happen, the files still

---

<div class="post-metadata">

**Author:** ![antituhan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/6bbea6/32.png) [@antituhan](https://www.ruby-forum.com/u/antituhan)\
**Post date:** [August 18, 2010, 2:40am UTC](https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232/9 "2010-08-18T02:40:00Z")

</div>

## If I put the deny rules on a root directive, the rule will blocked all access. But I just want to block the specified extension. ☹ I’ve tried many regular expression, but I can’t find the right one ☹

View this message in context:  
[http://nginx.2469901.n2.nabble.com/ASK-Restrict-direct-link-file-access-tp5417795p5434627.html](http://nginx.2469901.n2.nabble.com/ASK-Restrict-direct-link-file-access-tp5417795p5434627.html)  
Sent from the nginx mailing list archive at [Nabble.com](http://Nabble.com).

---

<div class="post-metadata">

**Author:** ![antituhan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/6bbea6/32.png) [@antituhan](https://www.ruby-forum.com/u/antituhan)\
**Post date:** [August 18, 2010, 3:54am UTC](https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232/10 "2010-08-18T03:54:21Z")

</div>

On Tue, 2010-08-17 at 17:38 -0700, antituhan wrote:

> If I put the deny rules on a root directive, the rule will blocked all  
> access.

Not a root location, a root _directive_:

> **[GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki...](https://github.com/nginxinc/nginx-wiki)**
>
> ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com

Since you now get 404’s for authorized clients, then it appears you are  
not properly setting your root for this location.

> But I just want to block the specified extension. ☹ I’ve tried many  
> regular expression, but I can’t find the right one ☹

–

---

<div class="post-metadata">

**Author:** ![antituhan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/6bbea6/32.png) [@antituhan](https://www.ruby-forum.com/u/antituhan)\
**Post date:** [August 18, 2010, 8:56am UTC](https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232/11 "2010-08-18T08:56:20Z")

</div>

On Tue, Aug 17, 2010 at 05:38:55PM -0700, antituhan wrote:

> If I put the deny rules on a root directive, the rule will blocked all  
> access. But I just want to block the specified extension. ☹ I’ve tried many  
> regular expression, but I can’t find the right one ☹

What is in error\_log ?

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![antituhan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/6bbea6/32.png) [@antituhan](https://www.ruby-forum.com/u/antituhan)\
**Post date:** [August 19, 2010, 5:54am UTC](https://www.ruby-forum.com/t/restrict-direct-link-file-access/193232/12 "2010-08-19T05:54:29Z")

</div>

This is the error\_log from my nginx :  
2010/08/19 10:15:24 [error] 10941#0: \*56 open()  
“/usr/share/nginx/html/e107\_files/downloads/OS/89xx/OFFICIAL\_8900M\_PBr5.0.0\_rel1004\_PL5.2.0.58\_A5.0.0.592\_Wind\_Hellas.exe”  
failed (2: No such file or directory), client: ip.ad.dr.es, server:  
[antituhan.com](http://antituhan.com), request: “GET  
/e107\_files/downloads/OS/89xx/OFFICIAL\_8900M\_PBr5.0.0\_rel1004\_PL5.2.0.58\_A5.0.0.592\_Wind\_Hellas.exe  
HTTP/1.1”, host: “[antituhan.com](http://antituhan.com)”

I know why nginx shows 404’s error code, the root path is changed from

/var/www/antituhan/

to

/usr/share/nginx/html/

And this is the latest configuration :

```
location ~ ^/.*(\.exe|\.rar)$ {
    root /path/to/dir/;
    deny ip.ad.dr.es/19;
    allow all;
}

```

And, it’s works 🙂 Thanks Igor for remind me to read the error\_log ^^v  
Thanks all, case solved 🙂