使用Nginx反向代理限制SOAP调用

Question

我们有一个Nginx服务器配置为反向代理，以保护无法修补的老化SOAP服务器。

我被要求限制客户可以从特定IP范围调用的内容。

我不知道如何允许一些SOAP调用但过滤掉其他调用。

Nginux配置是

server  {
  listen 443;
  listen [::]:443;
  server_name shiny.nginx.server;
  ssl on;
  ssl_certificate "/public/directory/proxy.pem";
  ssl_certificate_key "/secret/directory/proxy.key";
  location / {
    proxy_pass http://very.old.server:80/;
    proxy_buffering                     off;
    proxy_set_header Host               $http_host;
    proxy_set_header X-Real-IP          $remote_addr;
    proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto  $scheme;
    auth_basic                          "Username and Password Required";
    auth_basic_user_file                /etc/nginx/.htpasswd;
  }
}

我是如何实现这一目标的？

谢谢

Answer 1

我找到了解决方案。

server  {
    listen 443;
    listen [::]:443;
    server_name shiny.nginx.server;
    ssl on;
    ssl_certificate "/public/directory/proxy.pem";
    ssl_certificate_key "/secret/directory/proxy.key";
    location / {
    proxy_pass http://very.old.server:80/;
    proxy_buffering                     off;
    proxy_set_header Host               $http_host;
    proxy_set_header X-Real-IP          $remote_addr;
    proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto  $scheme;
    auth_basic                          "Username and Password Required";
    auth_basic_user_file                /etc/nginx/.htpasswd;

    if ($remote_addr ~ 192.168.1.1) {
        set $is_user Y;
    }
    if ($http_soapaction ~ SOAP/Request/Goes/Here) {
        set $user_allowed Y;
    }
    set $user_test "${is_user}${user_allowed}";
    if ($user_test = YY) {
        set $good yes;
    }

    if ($good != yes) {
        return 403;
    }
}

无法进行嵌套或复杂测试使得它有点棘手......