Issue in blocking access to URL

[aktk946]

Hey all, i'm setting up sftpgo via nginxproxy manager and want to block access to admin portal (located at /web/admin/login) from internet and allow from my local LAN subnet.

I have setup something like this in advanced tab:
location ~ ^/web/admin/login {
allow 10.10.10.0/24; # Allow access for this IP range
deny all; # Deny access for all other IPs
}

So this blocks access from internet - i get 403 when accessing that admin URL from internet which is good.

HOWEVER - when i try to hit that URL from local LAN i get 404... Here are the logs from nginx container:

==> dev/nginx-proxy-manager/docker/data/logs/proxy-host-20_error.log <==
2025/02/10 02:05:02 [error] 987#987: *8127 open() "/etc/nginx/nginx/html/web/admin/login" failed (2: No such file or directory), client: 10.10.10.100, server: sftpgo.mydomain.org, request: "GET /web/admin/login HTTP/2.0", host: "sftpgo.mydomain.org", referrer: "https://sftpgo.mydomain.org/web/client/login"

(bit puzzling why nginx is looking for a file rather than redirecting the request to upstream web server)

==> dev/nginx-proxy-manager/docker/data/logs/proxy-host-20_access.log <==
[10/Feb/2025:02:05:02 +0000] - - 404 - GET https sftpgo.mydomain.org "/web/admin/login" [Client 10.10.10.100] [Length 172] [Gzip 3.21] [Sent-to 10.10.10.8] "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/132.0.0.0" "https://sftpgo.mydomain.org/web/client/login"

I'm able to access admin URL just fine via same nginx proxy manager with a local LAN DNS name.

[tigran-sargsyan-w]

The allow / deny part is actually working.

The 404 comes from a different problem: by declaring your own location block, you replaced the location that NPM normally uses to proxy the request upstream.

Your block:

location ~ ^/web/admin/login {
    allow 10.10.10.0/24;
    deny all;
}

contains no proxy configuration.

So:

• external client -> rejected by deny all -> 403 as expected;
• LAN client -> allowed -> Nginx continues processing the request locally.

That explains this log:

open() "/etc/nginx/nginx/html/web/admin/login" failed

Nginx is looking for a local file because there is no proxy_pass in this location.

You need both the access restriction and the normal proxy behavior.

For NPM, you can include its generated proxy configuration:

location ^~ /web/admin/ {
    allow 10.10.10.0/24;
    deny all;

    include conf.d/include/proxy.conf;
}

Alternatively, create /web/admin/ as a Custom Location in the NPM UI, point it to the same SFTPGo upstream, and put only:

allow 10.10.10.0/24;
deny all;

in that location's advanced configuration.

I would also protect /web/admin/ rather than only /web/admin/login, otherwise another admin endpoint could remain publicly reachable.