Sometimes we need to restrict access to a specific path based on IP. To do this, we can use a combination of the allow and deny directives.

With the allow directive, we can specify who's allowed access, and with deny, we can restrict access for everyone else. Along with the allow and deny directives, we can use a single IP, a CIDR range, or the value all. (documentation)

server {
    listen 9050 default_server;

    location / {
        deny all;
        allow 192.168.1.0/24;
        allow 10.1.1.0/16;
        allow 2001:0db8::/32;

        root /var/www/public;
        index index.html;
    }
}

In the example above, we first restricted all access with deny all, and then, with allow directives, granted access only to the IPs we wanted.

Sometimes we only need to restrict access for a specific HTTP method; in that case, we can use the limit_except directive. This directive specifies which methods should NOT be restricted!

server {
    listen 9051 default_server;

    location / {
    	limit_except GET {
            deny all;
            allow 192.168.1.0/24;
            allow 10.1.1.0/16;
            allow 2001:0db8::/32;
        }

        root /var/www/public;
        index index.html;
    }
}

Note: not restricting GET also means the HEAD method won't be restricted.

According to the documentation, the following methods can be used with the limit_except directive:

GET HEAD POST PUT DELETE MKCOL COPY MOVE OPTIONS PROPFIND PROPPATCH LOCK UNLOCK PATCH

Using the satisfy directive, we can create several restrictions and specify whether the user is granted access if just one of them passes or if all of them need to pass (documentation). This directive is used together with any or all.

server {
    listen 9052 default_server;

    location / {
        satisfy any;

        allow 192.168.1.0/32;
        deny  all;

        auth_basic           "Restricted Access";
        auth_basic_user_file /etc/nginx/.htpasswd;

        root /var/www/public;
        index index.html;
    }
}

In the example above, we used any. This means that if the user's IP falls within the range we specified, or if they provide a correct username and password, they can access the content.