In an Nginx config we have the following code to allow viewing the site from inside the LAN without a login, otherwise require a login if outside the LAN:

real_ip_header X-Forwarded-For;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 192.168.1.1;

location / {
    satisfy               any;
    allow                 10.0.0.0/8;
    allow                 127.0.0.1/32;
    allow                 172.16.0.0/12;
    allow                 192.168.0.0/16;
    deny                  all;
    auth_basic            "Login required";
    auth_basic_user_file  /etc/nginx/.htpasswd;
    root                  /usr/share/nginx/html;
    index                 index.html;
}

Nginx is running inside a Docker container. Visits to the site are made through pfSense using the HaProxy reverse proxy.

Initially we were using Docker Desktop. Visits to the site from an external internet IP would show up as being made from 172.17.0.1 – which I understand is the IP address of the gateway between the Docker host and the bridge network on default networking. This required the use of set_real_ip_from 172.16.0.0/12 in order to show the real IP of the visitor and therefore require him to login.

When we switched to another server, running Docker Engine (not Docker Desktop), visits to the site now show up as being made from 192.168.1.1 – the IP address of our pfSense router. This meant we had to switch it to set_real_ip_from 192.168.1.1; in order for external visitors to be shown a login prompt. Otherwise internet users would be able to access the site without a login.

How can we flip this so that it denies by default? Currently if for any reason the IP address changes again, visits to the site would be allowed to all users, without requiring a login – since the reverse proxy is inside the LAN.

As an aside, should real_ip_recursive be set to on?