title: Deny access to route outside of kubernetes cluster
body: <p>I'm working with a large monolithic application with some private routes. These private routes are currently managed by an plain classic nginx  server.</p>
  
  <p>I need to migrate this to Kubernetes, and I must deny all external access to these routes. I'm using GKE, and AFAIK, privatize routes can be done inside the nginx-ingress controller.</p>
  
  <p>I'm trying with server-snippet, but it doesn't seems to work.
  Here's the current code:</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    annotations:
      kubernetes.io/ingress.class: nginx
      kubernetes.io/tls-acme: "true"
      nginx.org/websocket-services: service-ws
      nginx.org/server-snippet: |
        location /private {
          allow 10.100.0.0/16; #Pods IPs
          allow 10.200.0.0/16; #Pods IPs
          deny all; 
        }
    generation: 3
  </code></pre>
  
  <p>The result is that /private routes always return 200 instead of 401/403.
  I've also tried to create a redirection instead of allow/deny, and also get 200 instead of 301 redirections.</p>
  
  <p>Do you have some ideas or tips to make this work?</p>