Prevent access to load balancer through IP address

Heya,

You may consider setting up your DNS records so that your website can only be accessed via the domain name. This configuration deploys the Domain Name System (DNS) to resolve your site’s domain name to the IP address of your load balancer, hence rendering direct IP access non-permissible.

Please do note that this might not entirely prevent someone from bypassing DNS and directly accessing your site via the IP, however, they will encounter the SSL warning because the SSL certificate is issued for your domain and not for your IP address.

You can find more details about setting up DNS here: DigitalOcean DNS Documentation

I hope that this helps!

Hi Matthew,

Currently you can’t restrict the direct access to the IP address of your load balancer directly, but in this case, you can do that on the Droplet level by configuring your application or web server (NGINX in this case) to only respond to requests made to the domain name, and to ignore any requests made directly to the IP address.

Here is an example of how you can do this in NGINX:

server {
    listen 80 default_server;
    server_name _;
    return 444;
}

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    # the rest of your configuration goes here
}

The first server block listens for requests without a Host header or with a Host header which doesn’t match any other server blocks. It responds to such requests with a 444 status code, which tells NGINX to close the connection immediately.

The second server block listens for requests that are made to yourdomain.com or www.yourdomain.com. It will handle these requests according to the configuration specified in that block.

You can do the same thing for port 443 as well:

server {
    listen 443 ssl default_server;
    server_name _;
    ssl_certificate /etc/ssl/certs/dummy.crt;
    ssl_certificate_key /etc/ssl/private/dummy.key;
    return 444;
}

server {
    listen 443 ssl;
    server_name yourdomain.com www.yourdomain.com;
    ssl_certificate /etc/ssl/certs/yourdomain.crt;
    ssl_certificate_key /etc/ssl/private/yourdomain.key;
    # the rest of your configuration goes here
}

Let me know how it goes!

Best,

Bobby