title: Block direct IP access using nginx
body: <p>I have following nginx configurations</p>
  
  <pre><code>if ($host != mydomain.com) {
   return 403;
  }
  </code></pre>
  
  <p>When I hit the url <a href="http://127.0.0.1/test/test2/index.php" rel="nofollow noreferrer">http://127.0.0.1/test/test2/index.php</a> (from POSTMAN) I get 403. Fine. But  adding a Host -> mydomain.com in Headers I get 200. </p>
  
  <p>When I added <code>add_header Host "$host";</code> in nginx configurations I noticed in response that nginx has mydomain.com in its host variable. I know intentionally mentioning Host header in http request overrides 127.0.0.1 according to nginx documentation.</p>
  
  <p>But in this way an attacker can send requests direct to web server by bypassing Cloudflare WAF. so what's the solution to block such requests from nginx? </p>
  
  <p>I have tried following solutions but didn't work for me.<br>
  <a href="https://www.digitalocean.com/community/questions/how-to-block-access-using-the-server-ip-in-nginx" rel="nofollow noreferrer">https://www.digitalocean.com/community/questions/how-to-block-access-using-the-server-ip-in-nginx</a>
  <a href="https://blog.knoldus.com/nginx-disable-direct-access-via-http-and-https-to-a-website-using-ip/" rel="nofollow noreferrer">https://blog.knoldus.com/nginx-disable-direct-access-via-http-and-https-to-a-website-using-ip/</a></p>