<p>I am a novice to Nginx, but I have my app hosted on Heroku and I am using heroku-buildpack-nginx to add Nginx on my project. There is a Fastly layer in front of the app, but I am trying to use Nginx's deny functionality to block an IP. Though have found that nothing happens when I add it. My nginx code is below and I have tried adding the deny at the top of the file and in the location block. For both of those attempts nothing happened on the url. I also attempted adding a server block, but that broke everything and heroku threw an error stating that the server block is not meant for that file. Am I missing something?</p>
<pre><code>client_max_body_size 0;
deny 00.000.00.000; // My ip address

location / {
    deny 00.000.00.000; // My ip address
    try_files $uri @rewriteapp;
}

location @rewriteapp {
    rewrite ^(.*)$ /index.php$1 last;
}

# php-fpm configuration
location ~ [^/]\.php(/|$) {
    try_files $uri $uri/ /index.php?$query_string;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;

    fastcgi_index index.php;
    include fastcgi_params;
    fastcgi_pass heroku-fcgi;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param HTTPS on;
    fastcgi_param PATH_INFO $fastcgi_path_info;


    # Security headers via https://securityheaders.io
    add_header Strict-Transport-Security &quot;max-age=31536000; preload&quot;;
    add_header X-Frame-Options &quot;SAMEORIGIN&quot;;
    add_header X-XSS-Protection &quot;1; mode=block&quot;;
    add_header X-Content-Type-Options &quot;nosniff&quot;;
    add_header Referrer-Policy &quot;no-referrer-when-downgrade&quot;;

    fastcgi_intercept_errors off;
    fastcgi_buffer_size 16k;
    fastcgi_buffers 4 16k;
    fastcgi_connect_timeout 300;
    fastcgi_send_timeout 300;
    fastcgi_read_timeout 300;
}
</code></pre>

CC BY-SA 4.0
2021-05-17T18:09:58.840Z
I have a suspicion that this might not be possible, at least with the regular `deny` directive. All traffic to your dynos will be via an invisible Heroku-operated load balancer, so nginx won't see the original IP. Check out [this answer](https://stackoverflow.com/a/18517550/2777954) about parsing the "forwarded" IP info!
August Miller
CC BY-SA 4.0
2021-05-17T18:20:22.380Z
@AugustMiller I was starting to get to that same conclusion too! Ah so even if I get the IP from Papertrail or Heroku logs nginx is still not able to properly see it?
abaird
CC BY-SA 4.0
2021-05-18T03:14:26.090Z
@abaird - Untested but the real IP module as mentioned [here](https://github.com/heroku/heroku-buildpack-nginx/issues/27#issuecomment-621220832) might work for you...
RitterKnight
CC BY-SA 4.0
2021-05-20T17:47:07.070Z
Ok thank you so much for the help!
abaird
<nginx><heroku>
How to get the nginx deny functionality to work for Heroku using heroku-buildpack-nginx?
# How to get the nginx deny functionality to work for Heroku using heroku-buildpack-nginx?

(Asked by: username_0 on 2021-05-17)

I am a novice to Nginx, but I have my app hosted on Heroku and I am using heroku-buildpack-nginx to add Nginx on my project. There is a Fastly layer in front of the app, but I am trying to use Nginx's deny functionality to block an IP. Though have found that nothing happens when I add it. My nginx code is below and I have tried adding the deny at the top of the file and in the location block. For both of those attempts nothing happened on the url. I also attempted adding a server block, but that broke everything and heroku threw an error stating that the server block is not meant for that file. Am I missing something?
client_max_body_size 0;
deny 00.000.00.000; // My ip address

location / {
    deny 00.000.00.000; // My ip address
    try_files $uri @rewriteapp;
}

location @rewriteapp {
    rewrite ^(.*)$ /index.php$1 last;
}

# php-fpm configuration
location ~ [^/]\.php(/|$) {
    try_files $uri $uri/ /index.php?$query_string;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;

    fastcgi_index index.php;
    include fastcgi_params;
    fastcgi_pass heroku-fcgi;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param HTTPS on;
    fastcgi_param PATH_INFO $fastcgi_path_info;


    # Security headers via https://securityheaders.io
    add_header Strict-Transport-Security "max-age=31536000; preload";
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";
    add_header Referrer-Policy "no-referrer-when-downgrade";

    fastcgi_intercept_errors off;
    fastcgi_buffer_size 16k;
    fastcgi_buffers 4 16k;
    fastcgi_connect_timeout 300;
    fastcgi_send_timeout 300;
    fastcgi_read_timeout 300;
}

**Tags:** nginx, heroku
> **Comments:**
> **username_1**: I have a suspicion that this might not be possible, at least with the regular `deny` directive. All traffic to your dynos will be via an invisible Heroku-operated load balancer, so nginx won't see the original IP. Check out [this answer](https://stackoverflow.com/a/18517550/2777954) about parsing the "forwarded" IP info!  
> **username_0**: @AugustMiller I was starting to get to that same conclusion too! Ah so even if I get the IP from Papertrail or Heroku logs nginx is still not able to properly see it?  
> **username_2**: @abaird - Untested but the real IP module as mentioned [here](https://github.com/heroku/heroku-buildpack-nginx/issues/27#issuecomment-621220832) might work for you...  
> **username_0**: Ok thank you so much for the help!  

---

## 0 answers

