3

I want to avoid nginx from processing requests and hiding the fact that it even exists at a certain IP by not answering at all. The requests should be dropped and the client's browser should time out on it's own. Is that possible?

My guess is that a proxy_pass could help, but I'm not sure if that alone will do it.

I could configure a return 50x;, but that would reveal a server running.

8

Make nginx drop requests to timeout client on purpose

It is not possible to drop HTTP requests to hide the server, no matter if using nginx or another server. The HTTP request will only be sent after establishing the TCP connection. This connection can then only be closed with or without a response. You could also keep it open so that the browser times out but each open connections needs resources at the server.

You can only hide the server for clients based on the source IP, not on the contents of the HTTP request (i.e. specific URL). But this would not be done in the webserver but in the firewall (i.e. iptables, ipfw, pf or whatever you have).

if your intend is to annoy the typical bots testing for possible exploits then you might try it with a redirect to a nonexisting IP or port. Any access to this port could then be dropped by the firewall so that the bot runs into a timeout. I do this on my site and in my experience this will slow down bots because most will happily follow such redirects.

  • Thanks, really clear answer and exactly the goal I'm trying to accomplish - keep as much bots as possible away. – berbt Mar 4 '16 at 12:24
1

On servers that need only limited access I simply use iptables to restrict access to the IP addresses that are allowed to see the site. Other IP addresses will behave exactly as you'd like, timing out as if there's nothing there.

For each (range of) IP address(es) allowed define and run:

# /sbin/iptables -A INPUT -p tcp -s $ip --dport 80 -j ACCEPT

(replacing $ip with the desired IP (range))

For IPv6 you can do the same thing except run /sbin/ip6tables.

Then drop everything else:

# /sbin/iptables -P INPUT DROP
# /sbin/ip6tables -P INPUT DROP

Make sure to allow SSH from your IP as well of course, or you'll lock yourself out if the machine is remote.

Also remember that by default, these rules don't survive a reboot. Where to save the rules differs even between Linux distributions but on Debian I use:

# /sbin/iptables-save > /etc/iptables/rules.v4
# /sbin/ip6tables-save > /etc/iptables/rules.v6
  • Thanks, but black/whitelisting IPs is not an option in my case, requests need to reach the server. – berbt Mar 4 '16 at 12:26
  • OK. You might try to have a script at the URL that will just sleep endlessly. It will in the end be killed by the web server and that might look just like a timeout. Haven't tried this though, but it's the direction I would look at. – Mark Koek Mar 8 '16 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.