ACLs have no effect for root location with `return 301 ...` or `rewrite ... permanent`

[tiandrey@…]

I had to configure new server entry for simply redirecting clients with IPs from whitelist to another URL, and the rest of clients should have seen 403 Forbidden answer. Obvious configuration:

server {
  listen 80;
  server_name someserver.ru;
  allow 10.0.0.0/8;
  deny all;
  location {
    return 301 http://anotherurl.com;
  }
}

However, nginx with this configuration was returning 301 to all clients, even those not in allowed list.
Tried using rewrite ^/.*$ http://anotherurl.com permanent; instead of return 301 - same results.
Tried moving allow/deny into location / {}, moving return/rewrite outside location / {} (e.g. into server context) - same results.
The only thing that changed this behavior was removing allow line, leaving deny all - after that server began answering 403 to all requests.

Finally I came to the following workaround:

server {
    listen 127.0.5.6:321;
    return 301 http://anotherurl.com;
}

server {
  listen 80;
  server_name someserver.ru;

  allow 10.0.0.0/8;
  deny all;

  location / {
    proxy_pass http://127.0.5.6:321;
  }
}

But that looks crutchy, doesn't it?

There are no exceptions described in documentation, so I guess this behavior of nginx is wrong and should be fixed to respect ACLs.

[Maxim Dounin]

The rewrite module directives are used to conditionally select appropriate configurations, see ​docs. As such, they are executed before any other module checks, including allow/deny and auth_basic.

Removing allow line won't help either - if it does in your case, you probably missed something.

If you want to do checks before given rewrite directives, you can do so by using if (which is a rewrite module directive, and hence are executed sequentially as specified in the configuration). Something like this should work:

geo $blocked {
    default 1;
    10.0.0.0/8 0;
}

server {
    listen 80;
    server_name example.com;

    if ($blocked) {
        return 403;
    }

    return 301 http://secret.example.com/;
}