Which directive order ensures a default-deny posture in ngx_http_access_module?

Answer

The canonical way to guarantee a default‑deny posture is to place the deny all; directive after every allow rule that you want to whitelist, inside the same configuration block. For example:

allow 192.168.1.0/24;
allow 10.0.0.5;
deny all;

Because the ngx_http_access_module evaluates rules sequentially and stops at the first match, any client IP that does not match an earlier allow will hit the final deny all; and receive a 403 Forbidden response. Placing deny all; before an allow would block everything, including the whitelisted addresses.

How Levels Interact

• Location blocks override any allow/deny directives defined in higher levels. If a location contains its own allow or deny statements, the rules from the enclosing server or http block are discarded for that request.
• If a location has no access directives, it inherits the rules from the nearest enclosing server block. If the server also has none, it inherits from the http block.
• Thus the precedence order is: location > server > http. The first level that defines any access rule completely replaces the rules from higher levels for that request.

Practical Verification

1. Place the default‑deny block at the http level to serve as a base policy.
2. For each location that needs a different whitelist, duplicate the allow list and add a trailing deny all; inside that location.
3. Run nginx -t to validate syntax, then systemctl reload nginx.
4. From a non‑whitelisted IP, send a request to the location and confirm a 403 status. From a whitelisted IP, confirm normal response.

Note: If Nginx sits behind a proxy, ensure $remote_addr reflects the client IP by configuring set_real_ip_from and real_ip_header before applying access rules.

Missing Diagnostic Detail

Do you have a single location that currently contains only one allow directive? If so, the inherited deny all; from the server level will be discarded, potentially opening that location to the world. Adding the full whitelist plus deny all; to that location will restore the default‑deny posture.