Make nginx drop requests to timeout client on purpose

Question

I want to avoid nginx from processing requests and hiding the fact that it even exists at a certain IP by not answering at all. The requests should be dropped and the client's browser should time out on it's own. Is that possible?

My guess is that a proxy_pass could help, but I'm not sure if that alone will do it.

I could configure a return 50x;, but that would reveal a server running.

Answer 1

Make nginx drop requests to timeout client on purpose

It is not possible to drop HTTP requests to hide the server, no matter if using nginx or another server. The HTTP request will only be sent after establishing the TCP connection. This connection can then only be closed with or without a response. You could also keep it open so that the browser times out but each open connections needs resources at the server.

You can only hide the server for clients based on the source IP, not on the contents of the HTTP request (i.e. specific URL). But this would not be done in the webserver but in the firewall (i.e. iptables, ipfw, pf or whatever you have).

if your intend is to annoy the typical bots testing for possible exploits then you might try it with a redirect to a nonexisting IP or port. Any access to this port could then be dropped by the firewall so that the bot runs into a timeout. I do this on my site and in my experience this will slow down bots because most will happily follow such redirects.

Answer 2

On servers that need only limited access I simply use iptables to restrict access to the IP addresses that are allowed to see the site. Other IP addresses will behave exactly as you'd like, timing out as if there's nothing there.

For each (range of) IP address(es) allowed define and run:

# /sbin/iptables -A INPUT -p tcp -s $ip --dport 80 -j ACCEPT

(replacing $ip with the desired IP (range))

For IPv6 you can do the same thing except run /sbin/ip6tables.

Then drop everything else:

# /sbin/iptables -P INPUT DROP
# /sbin/ip6tables -P INPUT DROP

Make sure to allow SSH from your IP as well of course, or you'll lock yourself out if the machine is remote.

Also remember that by default, these rules don't survive a reboot. Where to save the rules differs even between Linux distributions but on Debian I use:

# /sbin/iptables-save > /etc/iptables/rules.v4
# /sbin/ip6tables-save > /etc/iptables/rules.v6