Body: <p>I am a novice to Nginx, but I have my app hosted on Heroku and I am using heroku-buildpack-nginx to add Nginx on my project. There is a Fastly layer in front of the app, but I am trying to use Nginx's deny functionality to block an IP. Though have found that nothing happens when I add it. My nginx code is below and I have tried adding the deny at the top of the file and in the location block. For both of those attempts nothing happened on the url. I also attempted adding a server block, but that broke everything and heroku threw an error stating that the server block is not meant for that file. Am I missing something?</p>
  <pre><code>client_max_body_size 0;
  deny 00.000.00.000; // My ip address
  
  location / {
      deny 00.000.00.000; // My ip address
      try_files $uri @rewriteapp;
  }
  
  location @rewriteapp {
      rewrite ^(.*)$ /index.php$1 last;
  }
  
  # php-fpm configuration
  location ~ [^/]\.php(/|$) {
      try_files $uri $uri/ /index.php?$query_string;
      fastcgi_split_path_info ^(.+\.php)(/.+)$;
  
      fastcgi_index index.php;
      include fastcgi_params;
      fastcgi_pass heroku-fcgi;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      fastcgi_param HTTPS on;
      fastcgi_param PATH_INFO $fastcgi_path_info;
  
  
      # Security headers via https://securityheaders.io
      add_header Strict-Transport-Security &quot;max-age=31536000; preload&quot;;
      add_header X-Frame-Options &quot;SAMEORIGIN&quot;;
      add_header X-XSS-Protection &quot;1; mode=block&quot;;
      add_header X-Content-Type-Options &quot;nosniff&quot;;
      add_header Referrer-Policy &quot;no-referrer-when-downgrade&quot;;
  
      fastcgi_intercept_errors off;
      fastcgi_buffer_size 16k;
      fastcgi_buffers 4 16k;
      fastcgi_connect_timeout 300;
      fastcgi_send_timeout 300;
      fastcgi_read_timeout 300;
  }
  </code></pre>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-05-17T18:09:58.840Z
Comments.Text: I have a suspicion that this might not be possible, at least with the regular `deny` directive. All traffic to your dynos will be via an invisible Heroku-operated load balancer, so nginx won't see the original IP. Check out [this answer](https://stackoverflow.com/a/18517550/2777954) about parsing the "forwarded" IP info!
Comments.UserDisplayName: August Miller
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-05-17T18:20:22.380Z
Comments.Text: @AugustMiller I was starting to get to that same conclusion too! Ah so even if I get the IP from Papertrail or Heroku logs nginx is still not able to properly see it?
Comments.UserDisplayName: abaird
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-05-18T03:14:26.090Z
Comments.Text: @abaird - Untested but the real IP module as mentioned [here](https://github.com/heroku/heroku-buildpack-nginx/issues/27#issuecomment-621220832) might work for you...
Comments.UserDisplayName: RitterKnight
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-05-20T17:47:07.070Z
Comments.Text: Ok thank you so much for the help!
Comments.UserDisplayName: abaird
Tags: <nginx><heroku>
Title: How to get the nginx deny functionality to work for Heroku using heroku-buildpack-nginx?
ThreadText: # How to get the nginx deny functionality to work for Heroku using heroku-buildpack-nginx?
  
  (Asked by: username_0 on 2021-05-17)
  
  I am a novice to Nginx, but I have my app hosted on Heroku and I am using heroku-buildpack-nginx to add Nginx on my project. There is a Fastly layer in front of the app, but I am trying to use Nginx's deny functionality to block an IP. Though have found that nothing happens when I add it. My nginx code is below and I have tried adding the deny at the top of the file and in the location block. For both of those attempts nothing happened on the url. I also attempted adding a server block, but that broke everything and heroku threw an error stating that the server block is not meant for that file. Am I missing something?
  
  ```
  client_max_body_size 0;
  deny 00.000.00.000; // My ip address
  
  location / {
      deny 00.000.00.000; // My ip address
      try_files $uri @rewriteapp;
  }
  
  location @rewriteapp {
      rewrite ^(.*)$ /index.php$1 last;
  }
  
  # php-fpm configuration
  location ~ [^/]\.php(/|$) {
      try_files $uri $uri/ /index.php?$query_string;
      fastcgi_split_path_info ^(.+\.php)(/.+)$;
  
      fastcgi_index index.php;
      include fastcgi_params;
      fastcgi_pass heroku-fcgi;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      fastcgi_param HTTPS on;
      fastcgi_param PATH_INFO $fastcgi_path_info;
  
      # Security headers via https://securityheaders.io
      add_header Strict-Transport-Security "max-age=31536000; preload";
      add_header X-Frame-Options "SAMEORIGIN";
      add_header X-XSS-Protection "1; mode=block";
      add_header X-Content-Type-Options "nosniff";
      add_header Referrer-Policy "no-referrer-when-downgrade";
  
      fastcgi_intercept_errors off;
      fastcgi_buffer_size 16k;
      fastcgi_buffers 4 16k;
      fastcgi_connect_timeout 300;
      fastcgi_send_timeout 300;
      fastcgi_read_timeout 300;
  }
  
  ```
  
  **Tags:** nginx, heroku
  
  > **Comments:**
  > **username_1**: I have a suspicion that this might not be possible, at least with the regular `deny` directive. All traffic to your dynos will be via an invisible Heroku-operated load balancer, so nginx won't see the original IP. Check out [this answer](https://stackoverflow.com/a/18517550/2777954) about parsing the "forwarded" IP info!  
  > **username_0**: @username_1 I was starting to get to that same conclusion too! Ah so even if I get the IP from Papertrail or Heroku logs nginx is still not able to properly see it?  
  > **username_2**: @username_0 - Untested but the real IP module as mentioned [here](https://github.com/heroku/heroku-buildpack-nginx/issues/27#issuecomment-621220832) might work for you...  
  > **username_0**: Ok thank you so much for the help!  
  
  ---
  
  ## 0 answers
  
  