cis-nginx-v300-5-1-1

name	cis-nginx-v300-5-1-1
description	Ensure allow and deny filters limit access to specific IP addresses (Manual)
category	cis-nginx
version	3.0
author	cyberstrike-official
tags	["cis","nginx","web-server","reverse-proxy","access-control","request-filtering"]
cis_id	5.1.1
cis_benchmark	CIS NGINX Benchmark v3.0.0
tech_stack	["nginx","linux","web-server"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 5.1.1 — Ensure allow and deny filters limit access to specific IP addresses

Profile Applicability

• Level 2 - Webserver
• Level 2 - Proxy
• Level 2 - Loadbalancer

Description

Access control based on IP addresses is a fundamental defense-in-depth mechanism. By using NGINX's allow and deny directives, access to the entire server or specific location blocks can be restricted to trusted network sources, such as internal subnets, specific hosts, or VPN ranges. This is particularly effective for protecting non-public administrative interfaces or internal APIs from the public internet.

Rationale

Applying the principle of least privilege at the network layer is a highly effective security measure. By explicitly defining which IP addresses or CIDR ranges are permitted to access sensitive resources and implicitly denying all others with deny all;, the attack surface is significantly reduced. This prevents unauthorized network segments from even attempting to exploit potential application-layer vulnerabilities.

Impact

A misconfigured IP filter list can lead to service denial for legitimate users or services. In dynamic environments where IP addresses can change (e.g., cloud instances without static IPs), this can be a particular challenge. Maintaining accurate and up-to-date IP allow-lists requires operational discipline.

Audit Procedure

Run the following command to inspect the fully loaded NGINX configuration for allow and deny rules:

nginx -T 2>/dev/null | grep -E '^\s*(allow|deny)'

Then, manually review the active rules within the http, server, or location blocks. Verify that the configured IP addresses and CIDR ranges align with the documented list of trusted sources and that a deny all; rule is present to enforce a default-deny policy.

Remediation

Identify the specific location block you wish to protect (e.g., an admin login page or internal stats). Compile a list of trusted source IP addresses and network ranges. Add allow directives for each trusted source, followed by a final deny all; directive. NGINX processes rules in order, and stops at the first match.

location /admin_login/ {
    # Allow a specific monitoring server
    allow 192.168.1.100;

    # Allow the internal office network range
    allow 10.20.30.0/24;

    # Deny all other access to this location
    deny all;

    # ... other directives for the admin location, e.g., proxy_pass ...
}