# Trying to show http password for only certain IP blocks

**URL:** <https://www.ruby-forum.com/t/trying-to-show-http-password-for-only-certain-ip-blocks/198989>\
**Category:** NGINX\
**Created:** [November 12, 2010, 12:31am UTC](https://www.ruby-forum.com/t/trying-to-show-http-password-for-only-certain-ip-blocks/198989 "2010-11-12T00:31:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/77aa72/32.png) [@Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/u/Dobai-Pataky_BSSSSl)\
**Post date:** [November 12, 2010, 12:31am UTC](https://www.ruby-forum.com/t/trying-to-show-http-password-for-only-certain-ip-blocks/198989/1 "2010-11-12T00:31:14Z")

</div>

Below is our (scrubbed) configuration…

What we are trying to do is show an HTTP password prompt for people  
from IPs that are not “whitelisted”

We had found a blog post that had said this was possible using  
allow/deny/satisfy but it’s not working.

Basically, can we get it so that it will show an HTTP auth prompt for  
all IPs other than:

10.10.10.0/24  
10.10.11.0/24

?

Thanks!

server {  
listen 80;  
server\_name [mysweetsite.com](http://mysweetsite.com);  
root /home/agate/web/mysweetsite;  
index index.php index.html;

access\_log /home/awesome/log/access.log;  
error\_log /home/awesome/log/error.log debug;

# set error\_pages

error\_page 500 /500.html;  
error\_page 501 /501.html;  
error\_page 502 /502.html;  
error\_page 503 /503.html;  
error\_page 504 /504.html;  
error\_page 550 /550.html;

set $translated\_error\_page en-us;

if ($request\_uri ~ ^/fr-fr) { set $translated\_error\_page fr-fr; }  
if ($request\_uri ~ ^/ru-ru) { set $translated\_error\_page ru-ru; }

location = /500.html { try\_files  
/error\_page/$translated\_error\_page$uri /error\_page/en-us$uri; }  
location = /501.html { try\_files  
/error\_page/$translated\_error\_page$uri /error\_page/en-us$uri; }  
location = /502.html { try\_files  
/error\_page/$translated\_error\_page$uri /error\_page/en-us$uri; }  
location = /503.html { try\_files  
/error\_page/$translated\_error\_page$uri /error\_page/en-us$uri; }  
location = /504.html { try\_files  
/error\_page/$translated\_error\_page$uri /error\_page/en-us$uri; }  
location = /550.html { try\_files  
/error\_page/$translated\_error\_page$uri /error\_page/en-us$uri; }

#set\_real\_ip\_from 0.0.0.0/0;  
real\_ip\_header X-Real-IP;

location / {  
log\_not\_found off;  
server\_name\_in\_redirect off;

```
# try_files doesn’t work properly with drupal 6, so for now we use 

```

this  
if (!-e $request\_filename) {  
rewrite ^/(.\*)$ /index.php?q=$1 last;  
}

```
location ~ /\.ht { deny all; }
location ~*

```

.(engine|inc|info|install|module|profile|po|sh|._sql|theme|tpl(.php)?|xtmpl)$|^(code-style.pl|Entries._|Repository|Root|Tag|Template)$  
{  
internal;  
}

```
location ~ /blocked3/.* { internal; }
location ~ /blocked2/.* { internal; }
location ~ /blocked1/.* { internal; }

# expires
location ~* \.(jpg|jpeg|gif|css|png|js|ico|html)$ {
  expires max;
  access_log off;
}

location /.hidden {
  auth_basic "hidden";
  auth_basic_user_file /etc/nginx/confs/htpasswd.hidden;
  expires epoch;
  add_header Cache-Control private;
}

satisfy any;
deny all;
allow 10.10.10.0/24;
allow 10.10.11.0/24;
auth_basic "test”
auth_basic_user_file /etc/nginx/confs/htpasswd.test;

```

}

location ~ .php$ {  
include /etc/nginx/confs/fastcgi.conf;  
fastcgi\_pass 127.0.0.1:11039;  
}

rewrite ^/awesome$ /awesome/ permanent;  
rewrite ^/$ /en-us/ permanent;  
}

---

<div class="post-metadata">

**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\
**Post date:** [November 12, 2010, 1:24am UTC](https://www.ruby-forum.com/t/trying-to-show-http-password-for-only-certain-ip-blocks/198989/2 "2010-11-12T01:24:30Z")

</div>

Hello!

On Thu, Nov 11, 2010 at 03:30:19PM -0800, Michael S. wrote:

> 10.10.10.0/24  
> 10.10.11.0/24
> 
> ?

[…]

> ```
> satisfy any;
> deny all;
> 
> ```

- 

```
deny all;
allow 10.10.10.0/24;
allow 10.10.11.0/24;

```

- 

```
deny all;

```

Access module instructions are executed in order, so “deny all”  
specified first will just deny all. If you want to allow some  
addresses - you have to do “allow” before “deny all”.

> ```
> allow 10.10.10.0/24;
> allow 10.10.11.0/24;
> auth_basic "test”
> auth_basic_user_file /etc/nginx/confs/htpasswd.test;
> 
> ```
> 
> }

Maxim D.