Below is our (scrubbed) configuration...

What we are trying to do is show an HTTP password prompt for people
from IPs that are not "whitelisted"

We had found a blog post that had said this was possible using
allow/deny/satisfy but it's not working.

Basically, can we get it so that it will show an HTTP auth prompt for
all IPs other than:

10.10.10.0/24
10.10.11.0/24

?

Thanks!


server {
listen 80;
server_name mysweetsite.com;
root /home/agate/web/mysweetsite;
index index.php index.html;

access_log /home/awesome/log/access.log;
error_log /home/awesome/log/error.log debug;

# set error_pages
error_page 500 /500.html;
error_page 501 /501.html;
error_page 502 /502.html;
error_page 503 /503.html;
error_page 504 /504.html;
error_page 550 /550.html;

set $translated_error_page en-us;

if ($request_uri ~ ^/fr-fr) { set $translated_error_page fr-fr; }
if ($request_uri ~ ^/ru-ru) { set $translated_error_page ru-ru; }

location = /500.html { try_files
/error_page/$translated_error_page$uri /error_page/en-us$uri; }
location = /501.html { try_files
/error_page/$translated_error_page$uri /error_page/en-us$uri; }
location = /502.html { try_files
/error_page/$translated_error_page$uri /error_page/en-us$uri; }
location = /503.html { try_files
/error_page/$translated_error_page$uri /error_page/en-us$uri; }
location = /504.html { try_files
/error_page/$translated_error_page$uri /error_page/en-us$uri; }
location = /550.html { try_files
/error_page/$translated_error_page$uri /error_page/en-us$uri; }

#set_real_ip_from 0.0.0.0/0;
real_ip_header X-Real-IP;

location / {
log_not_found off;
server_name_in_redirect off;

# try_files doesn’t work properly with drupal 6, so for now we use this
if (!-e $request_filename) {
rewrite ^/(.*)$ /index.php?q=$1 last;
}

location ~ /\.ht { deny all; }
location ~*
\.(engine|inc|info|install|module|profile|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(code-style\.pl|Entries.*|Repository|Root|Tag|Template)$
{
internal;
}

location ~ /blocked3/.* { internal; }
location ~ /blocked2/.* { internal; }
location ~ /blocked1/.* { internal; }

# expires
location ~* \.(jpg|jpeg|gif|css|png|js|ico|html)$ {
expires max;
access_log off;
}

location /.hidden {
auth_basic "hidden";
auth_basic_user_file /etc/nginx/confs/htpasswd.hidden;
expires epoch;
add_header Cache-Control private;
}

satisfy any;
deny all;
allow 10.10.10.0/24;
allow 10.10.11.0/24;
auth_basic "test”
auth_basic_user_file /etc/nginx/confs/htpasswd.test;
}

location ~ \.php$ {
include /etc/nginx/confs/fastcgi.conf;
fastcgi_pass 127.0.0.1:11039;
}

rewrite ^/awesome$ /awesome/ permanent;
rewrite ^/$ /en-us/ permanent;
}

_______________________________________________
nginx mailing list
nginx@nginx.org
http://nginx.org/mailman/listinfo/nginx