title: NGINX whitelist internal docker IP
body: <p>I have a server that runs 2 docker containers, a Node.js API container, and an NGINX-RTMP container. The server itself also uses NGINX as a reverse proxy to sort traffic between these two containers based on port.</p>
  
  <p>The NGINX-RTMP server accesses the API server via it's network alias like so:</p>
  
  <pre><code>on_publish http://api-server:3000/authorize
  </code></pre>
  
  <p>Which works great to communicate container-to-container. I can also go the other way by using urls like </p>
  
  <pre><code>http://nginx-server:8080/some-endpoint
  </code></pre>
  
  <p>Now I have a route on the <code>NGINX</code> server that I would like to restrict to just local traffic (i.e. only the API server should be able to hit this location). Now normally I can do this with a simple </p>
  
  <pre><code># nginx conf file
  location /restricted {
      allow 127.0.0.1;
      deny all;
  }
  </code></pre>
  
  <p>What I would <em>like</em> to do is something like this:</p>
  
  <pre><code># nginx conf file
  location /restricted {
      allow api-server;
      deny all;
  }
  </code></pre>
  
  <p>But I need to use the actual IP of the container. Now I can get the IP of the container by inspecting it, and I see the IP is <code>172.17.0.1</code>. However when I look at other instances of this server I see some servers are <code>172.18.0.1</code> and <code>17.14.0.2</code> so it's not 100% consistent across servers. Now I could just write out all 256 variations of <code>172.*.0.0/24</code> but I imagine there must be a 'proper' way to wildcard this in nginx, or even a better way of specifying the container IP in my NGINX conf file. The only information I have found so far is to modify the type of network I'm using for my containers, but I don't want to do that.</p>
  
  <p>How do I properly handle this?</p>
  
  <pre><code># nginx conf file
  location /restricted {
      allow 172.*.0.0/24;
      deny all;
  }
  </code></pre>