how to disable direct access to a web site by ip address

Question

I have a website on a VPS.

The issue I am having is that when I enter the IP of the server, it links to the website.
Even when entering mail.domain.com, it does the same thing.

How do I disable that, so a visitor would get a message or be directed to the domain?

I tried disabling the IP and mail a record on cloud flare but it didn't work.

My setup is:

VPS on Linux Debian 
Nginx
no control panel just command line
Cloudflare
DNS setup with BIND

Answer 1

server {
    listen      80 default_server;
    listen      [::]:80 default_server;
    server_name "";
    return      444;
}

You need to specify default_server parameter so that all non available server requests goes to this server block which throws 444 error.

444 : CONNECTION CLOSED WITHOUT RESPONSE

ref: https://httpstatuses.com/444

Answer 2

You can use redirect, nginx config:

server {
        listen 80;
        server_name IP_ADDRESS;
        return 301 http://YOUR.DOMAIN;
}

Answer 3

You can just add a server directive before others.

server {
    listen 80;
    server_name _;
    return 404;
}

Answer 4

Neither of above helped in my case - IP connection to http works as expected but https was redirecting to alphabetically first https virtual site. What was working witn nginx below 1.19.4 was to add null certificate to block:

server {
  listen 80 default_server;
  listen [::]:80 default_server;
  listen 443 default_server;
  listen [::]:443 default_server;

  ssl_certificate /etc/ssl/null.crt;
  ssl_certificate_key /etc/ssl/null.key;

  server_name "";
  return 444;
}

Certificte can be generated with empty CN so you need no worry about fill it.

openssl req -x509 -newkey rsa:2048 -days 10000 -nodes  -subj '/CN=' -keyout null.key -out null.crt

Then http/https returns 444 (ERR_EMPTY_RESPONSE), in different configurations https returns ERR_HTTP2_PROTOCOL_ERROR with your null certificate which is also fine to show there is nothing there.

For nginx 1.19.4 it is simpler. It introduced ssl_reject_handshake on | off (http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_reject_handshake) you can replace certificates 'stuff' with:

server {
  listen 80 default_server;
  listen [::]:80 default_server;
  listen 443 default_server;
  listen [::]:443 default_server;

  ssl_reject_handshake on;

  server_name "";
  return 444;
}

And now you get http 444 (ERR_EMPTY_RESPONSE) and for https ERR_SSL_UNRECOGNIZED_NAME_ALERT. No null certificates are needed.

Answer 5

You can use redirect, nginx config:

server {
        listen 80;`enter code here`
        server_name IP_ADDRESS;
        return 301 http://YOUR.DOMAIN;
}

Answer 6

you can return any error you find suitable. A list of errors can be found here List_of_HTTP_status_codes

server {
    listen      x.x.x.x:80;
    server_name x.x.x.x;
    return      404;
}  

Answer 7

You may try to set the server IP address in:

/etc/nginx/conf.d/default.conf

So it looks like this:

server {
    listen 80;
    server_name localhost IP.OF.VPS.HERE;

Then you can specify the subdomain vhost, like:

server {
        listen 80;
        server_name subdomain.domain.com;

And the main domain, like:

server {
        listen 80;
        server_name www.domain.com domain.com;

Then restart Nginx:

/etc/init.d/nginx restart

Each vhost should have its own *.conf file (for better organization), like:

/etc/nginx/conf.d/subdomain.domain.com.conf
/etc/nginx/conf.d/domain.com.conf
/etc/nginx/conf.d/default.conf

Answer 8

Put this at top of your /etc/nginx/conf.d/SERVER_IP_ADDRESS.conf file and comment everything what is below it.

#disabling accesing server by ip address
server {
        listen SERVER_IP_ADDRESS:80 default;
        server_name _;
        return 404;
}

Then restart your Nginx server (on Ubuntu it is done by service nginx restart this command)

Now when you will put your server's ip address to browser url field you will get 404 error.

Answer 9

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    listen 443 default_server;
    listen [::]:443 default_server;
    return 444;
}

Don't bother supporting HTTP/2 or SSL connection for a sink. It does catch-all without those unnecesities. For the unsupported, it just refuses such connections.

See https://stackoverflow.com/a/68042877/4510033.

Answer 10

if ($http_host != "example.com") {
    return 301 https://example.com;
}