starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-25 01:15:51 +03:00

[GH-ISSUE #5287] Bug Report: deny all; directive persists in proxy host configuration #3158

New issue

Open

opened 2026-02-26 07:37:59 +03:00 by kerem · 4 comments

kerem commented

2026-02-26 07:37:59 +03:00

Owner

Originally created by @ppetermans on GitHub (Feb 8, 2026).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5287

Description: There is an issue where a deny all; directive is automatically added or persists in the generated Nginx configuration file (e.g., data/nginx/proxy_host/3.conf), preventing any traffic from reaching the backend even when access is set to "Public".

Steps to Reproduce:

Create a new Proxy Host in the admin interface.

Configure it to forward traffic to a local or internal service.

Save the configuration.

Check the generated .conf file in the /data/nginx/proxy_host/ directory.

Expected Behavior: The configuration should only include deny all; if specific access restrictions are set. If the host is public, this directive should be absent or commented out.

Actual Behavior: The deny all; directive is present, causing a "403 Forbidden" error for all external users. The only way to fix it is to manually run: sed -i 's/deny all;/#deny all;/g' /data/nginx/proxy_host/3.conf && nginx -s reload

Environment:

Image: jc21/nginx-proxy-manager:latest

OS: Windows 10/11 (using Docker Desktop / WSL2)

Docker Compose:

YAML
version: '3.8'
services:
app:
image: 'jc21/nginx-proxy-manager:latest'
container_name: nginx-proxy-manager
restart: unless-stopped
ports:
- '80:80'
- '81:81'
- '443:443'
volumes:
- ./data:/data
- ./letsencrypt:/etc/letsencrypt

Originally created by @ppetermans on GitHub (Feb 8, 2026). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5287 Description: There is an issue where a deny all; directive is automatically added or persists in the generated Nginx configuration file (e.g., data/nginx/proxy_host/3.conf), preventing any traffic from reaching the backend even when access is set to "Public". Steps to Reproduce: Create a new Proxy Host in the admin interface. Configure it to forward traffic to a local or internal service. Save the configuration. Check the generated .conf file in the /data/nginx/proxy_host/ directory. Expected Behavior: The configuration should only include deny all; if specific access restrictions are set. If the host is public, this directive should be absent or commented out. Actual Behavior: The deny all; directive is present, causing a "403 Forbidden" error for all external users. The only way to fix it is to manually run: sed -i 's/deny all;/#deny all;/g' /data/nginx/proxy_host/3.conf && nginx -s reload Environment: Image: jc21/nginx-proxy-manager:latest OS: Windows 10/11 (using Docker Desktop / WSL2) Docker Compose: YAML version: '3.8' services: app: image: 'jc21/nginx-proxy-manager:latest' container_name: nginx-proxy-manager restart: unless-stopped ports: - '80:80' - '81:81' - '443:443' volumes: - ./data:/data - ./letsencrypt:/etc/letsencrypt

kerem added the

bug

label

2026-02-26 07:37:59 +03:00

kerem commented

2026-02-26 07:37:59 +03:00

Author

Owner

@jc21 commented on GitHub (Feb 17, 2026):

Thanks for the report, I'll get to this one soon.

@jc21 commented on GitHub (Feb 17, 2026): Thanks for the report, I'll get to this one soon.

kerem commented

2026-02-26 07:37:59 +03:00

Author

Owner

@jc21 commented on GitHub (Feb 18, 2026):

Ok so following your replication steps verbatim, using v2.14.0:

Create a new Proxy Host in the admin interface.
Configure it to forward traffic to a local or internal service.
Save the configuration.

It produces the following nginx config:

map $scheme $hsts_header {
    https   "max-age=63072000; preload";
}

server {
  set $forward_scheme http;
  set $server         "127.0.0.1";
  set $port           81;

  listen 80;
  listen [::]:80;

  server_name test.jc21.com;
  http2 off;
  access_log /data/logs/proxy-host-1_access.log proxy;
  error_log /data/logs/proxy-host-1_error.log warn;

  location / {
    # Proxy!
    include conf.d/include/proxy.conf;
  }

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

and does not contain any deny directives. You didn't specify to use an Access List or what the shape of that Access List data looks like.

@jc21 commented on GitHub (Feb 18, 2026): Ok so following your replication steps verbatim, using v2.14.0: 1. Create a new Proxy Host in the admin interface. 2. Configure it to forward traffic to a local or internal service. 3. Save the configuration. It produces the following nginx config: ``` map $scheme $hsts_header { https "max-age=63072000; preload"; } server { set $forward_scheme http; set $server "127.0.0.1"; set $port 81; listen 80; listen [::]:80; server_name test.jc21.com; http2 off; access_log /data/logs/proxy-host-1_access.log proxy; error_log /data/logs/proxy-host-1_error.log warn; location / { # Proxy! include conf.d/include/proxy.conf; } # Custom include /data/nginx/custom/server_proxy[.]conf; } ``` and does not contain any deny directives. You didn't specify to use an Access List or what the shape of that Access List data looks like.

kerem commented

2026-02-26 07:37:59 +03:00

Author

Owner

@jc21 commented on GitHub (Feb 18, 2026):

After assigning a standard user/pass access list:

map $scheme $hsts_header {
    https   "max-age=63072000; preload";
}

server {
  set $forward_scheme http;
  set $server         "127.0.0.1";
  set $port           81;

  listen 80;
  listen [::]:80;

  server_name test.jc21.com;
  http2 off;
  access_log /data/logs/proxy-host-1_access.log proxy;
  error_log /data/logs/proxy-host-1_error.log warn;

  location / {
    # Authorization
    auth_basic            "Authorization required";
    auth_basic_user_file  /data/access/1;

    proxy_set_header Authorization "";

    # Access Rules: 0 total
    deny all;

    # Access checks must...
    satisfy all;

    # Proxy!
    include conf.d/include/proxy.conf;
  }

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

And after assigning an IP-based access list:

map $scheme $hsts_header {
    https   "max-age=63072000; preload";
}

server {
  set $forward_scheme http;
  set $server         "127.0.0.1";
  set $port           81;

  listen 80;
  listen [::]:80;

  server_name test.jc21.com;
  http2 off;
  access_log /data/logs/proxy-host-1_access.log proxy;
  error_log /data/logs/proxy-host-1_error.log warn;

  location / {
    # Access Rules: 1 total
    allow 192.168.0.0/24;
    deny all;

    # Access checks must...
    satisfy all;

    # Proxy!
    include conf.d/include/proxy.conf;
  }


  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

And finally, after assigning Public back on the host:

map $scheme $hsts_header {
    https   "max-age=63072000; preload";
}

server {
  set $forward_scheme http;
  set $server         "127.0.0.1";
  set $port           81;

  listen 80;
  listen [::]:80;

  server_name test.jc21.com;
  http2 off;
  access_log /data/logs/proxy-host-1_access.log proxy;
  error_log /data/logs/proxy-host-1_error.log warn;

  location / {
    # Proxy!
    include conf.d/include/proxy.conf;
  }

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

I'm unable to see a persisting deny directive.

@jc21 commented on GitHub (Feb 18, 2026): After assigning a standard user/pass access list: ``` map $scheme $hsts_header { https "max-age=63072000; preload"; } server { set $forward_scheme http; set $server "127.0.0.1"; set $port 81; listen 80; listen [::]:80; server_name test.jc21.com; http2 off; access_log /data/logs/proxy-host-1_access.log proxy; error_log /data/logs/proxy-host-1_error.log warn; location / { # Authorization auth_basic "Authorization required"; auth_basic_user_file /data/access/1; proxy_set_header Authorization ""; # Access Rules: 0 total deny all; # Access checks must... satisfy all; # Proxy! include conf.d/include/proxy.conf; } # Custom include /data/nginx/custom/server_proxy[.]conf; } ``` And after assigning an IP-based access list: ``` map $scheme $hsts_header { https "max-age=63072000; preload"; } server { set $forward_scheme http; set $server "127.0.0.1"; set $port 81; listen 80; listen [::]:80; server_name test.jc21.com; http2 off; access_log /data/logs/proxy-host-1_access.log proxy; error_log /data/logs/proxy-host-1_error.log warn; location / { # Access Rules: 1 total allow 192.168.0.0/24; deny all; # Access checks must... satisfy all; # Proxy! include conf.d/include/proxy.conf; } # Custom include /data/nginx/custom/server_proxy[.]conf; } ``` And finally, after assigning Public back on the host: ``` map $scheme $hsts_header { https "max-age=63072000; preload"; } server { set $forward_scheme http; set $server "127.0.0.1"; set $port 81; listen 80; listen [::]:80; server_name test.jc21.com; http2 off; access_log /data/logs/proxy-host-1_access.log proxy; error_log /data/logs/proxy-host-1_error.log warn; location / { # Proxy! include conf.d/include/proxy.conf; } # Custom include /data/nginx/custom/server_proxy[.]conf; } ``` I'm unable to see a persisting deny directive.

kerem commented

2026-02-26 07:37:59 +03:00

Author

Owner

@deathblade666 commented on GitHub (Feb 19, 2026):

i found where if you disable and then re-enable the proxy host after assigning an access list it will default to deny all, not sure if the same issue, but seems similar. would expect it to re-apply the AC once re-enabled.

@deathblade666 commented on GitHub (Feb 19, 2026): i found where if you disable and then re-enable the proxy host after assigning an access list it will default to deny all, not sure if the same issue, but seems similar. would expect it to re-apply the AC once re-enabled.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#3158

No description provided.

Rows
Columns