Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am a Linux/Unix noob, so please bear with me. Here is my situation:

I have a server (Debian Squeeze) on a LAN. I have installed Nginx web server on it. The server has Internet access to download and install packages.

My question:

Can I host a website so that when users on the LAN type:

http://abcd (no .com, .net, etc.) 

into their browser, the website opens? Note that they also have full Internet access, so it should not go straight to Google or some other default search engine instead.

At the same time, anyone outside the LAN must not be able to access it, no matter what URL they type.

Is this possible?

share|improve this question
1  
Do you have access to the users computers in the LAN to add an entry in the hosts file? Does the LAN have a DNS server under your control? –  Marco Oct 15 '12 at 6:40
    
No, the LAN is maintained by heavily bureaucratic network administrators. I do not have access to the DNS. –  Spartanblogger Oct 15 '12 at 6:44
2  
Got it. That makes sense. So I should get in touch with the LAN admins, ask them to point requests for 'abcd'; to my server's IP adddress. And, of course, configure nginx to have abcd as an available website. Thanks! (Don't know how to give credit to your answer, as you posted it in the comment section... –  Spartanblogger Oct 15 '12 at 11:32
    
I converted my comment to an answer. You don't have to configure abcd as web site on nginx, abcd is the host name. The web site would probably be index.html. You just have an IP address and the DNS (which you don't have control over, but your admin has) points to your IP, not to your host name. –  Marco Oct 15 '12 at 11:45
add comment

3 Answers

up vote 1 down vote accepted

What controls whether other computers have access to a server running on your computer is not the name: that's a matter of convenience only. If you want to make your computer, or at least your web server, inaccessible outside the LAN, you need to take measures to block it at the IP or HTTP level.

It's possible that your LAN administrator is already blocking incoming connections to web servers inside the LAN, in which case you have nothing to do. But you might want to set up a filter on your machine anyway, just in case.

If you don't want to serve any web traffic outside the LAN, block incoming web traffic at the IP level. Use iptables for that, or some higher-level tool that sets up iptables rules such as ufw. To block all incoming HTTP and HTTPS traffic, block TCP ports 80 and 443, assuming your LAN corresponds to the address range 203.0.113.0/24 (i.e. 203.0.113.*):

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 80,443 -s \!203.0.113.0/24 -j REJECT

You might as well block all incoming ports except the ones you know you need. For example, to allow only incoming SSH requests, as well as incoming traffic from the LAN and exclude all other incoming traffic:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport http,https -s 203.0.113.0/24 -j ACCEPT
iptables -A INPUT -j REJECT

See also Is there a standard way to configure what policy iptables loads on startup under Debian?, iptables: allow certain ips and block all other connection and Set some firewall ports to only accept local network connections?.

If you want to allow web connections to your machine from anywhere, but allow a certain virtual host to be reached only from the LAN, you'll need to do the filtering at the level of the Apache server (I assume you're using Apache). This is done in the virtualhost configuration file or in a .htaccess file, with the Allow and Deny directives.

Order deny,allow
Deny from all
Allow from 203.0.113.0/24

Turning to the name, if you want to give a dotless name to your server, this needs the cooperation of the client machines. But you can give a globally-valid name to your server. This is compeltely independent of whether your server can be reached from everywhere. What you need is a DNS entry for your machine. You can buy a domain name and basic DNS service on it for about $10/year, so your machine's IP address would be recorded on a name like www.spartanblogger.net. It doesn't matter if your IP address is in a private range such as 10.x.y.z or 192.168.x.y. If your machine's IP address varies, you'll need a provider that supports Dynamic DNS. For a single address for personal use, if you don't mind not having your own domain name, you can use a free service such as DynDNS (whether your IP address is in fact dynamic or not); you can choose a name like spartanblogger.dyndns.org.

share|improve this answer
add comment

If you have no control over the network whatsoever and also no control over the clients computers and your server is not accessible from outside, I'm afraid it not possible. Imagine it would be, what would prevent you from redirecting google or stackexchange to your server?

What you can do is to ask the administrator to create a DNS entry for abcd to point to your IP address. Then, all you need is a web server listening on the standard ports. If he refuses all you can do is access your web server via IP address instead of host name.

share|improve this answer
add comment

In your question you didn't directly mentioned that you want to use domain name or just ip access. Because with direct ip access its possible to do that what you want, otherwise not so trivial( see in comments ).

Just check your ip with: ifconfig then your college ( if they are in the same network ) can see what You are rendering trough nginx by entering your IP adress into the browser. However from outside this won't be accessible because the router won't forward requests from outside the network to you computer. ( If you wan't it though you can add a forward rule into your router config )

Not sure what is in the default nginx config file but such a simple configuration I insert here witch you can add to the config file ( /etc/nginx/nginx.conf ):

server {
  listen       80;
  server_name  _;
  # path to your folder what you want to render
  root   /usr/share/nginx/html;
  index index.php index.htm index.html;
}

However, it is important that the user who runs nginx has permission to read that root folder. You can check what user is nginx using with: ps aux | egrep nginx, and set it in your config with the directive: user nginx;

On the official configuration site you can read more!

When you access to your colleges computer you could however insert a custom domain to point on your machine by editing the hosts file on theire machine under /etc/hosts:

<your_ip> something.com
share|improve this answer
    
I think the line http://abcd (no .com, .net, etc.) clearly states access via hostname and not IP address. –  Marco Oct 15 '12 at 10:17
    
@burninggramma I have full access to the server running nginx, but not to the DNS server on the LAN. And as Macro pointed out, I want to use 'abcd';, not an IP address. –  Spartanblogger Oct 15 '12 at 11:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.