Streams from specific IP only

[jcl2005-afk]

Is it possible to setup Streams only from specific source ip-address?

[cyberdr1ft3r]

Yes. Nginx’s stream access module supports allow and deny, but NPM currently does not expose per-stream custom configuration in the UI.

If the restriction should apply to every TCP stream, create this file in NPM’s persistent data volume:

# /data/nginx/custom/server_stream_tcp.conf
allow 203.0.113.25;
allow 198.51.100.0/24;
deny all;

For UDP streams, use:

# /data/nginx/custom/server_stream_udp.conf
allow 203.0.113.25;
deny all;

Then validate and reload the configuration:

docker exec <npm-container> nginx -t
docker exec <npm-container> nginx -s reload

Important caveat: NPM includes these files in every TCP or UDP stream server block. Therefore, this method is unsuitable if you have several streams and only one of them should use that allow-list.

For a restriction on one specific stream, the cleaner option is to allow the source IP on the host firewall/router for that stream’s published port and reject other sources there. That also drops unwanted traffic before it reaches Nginx.

I would avoid editing /data/nginx/stream/*.conf directly because those files are generated and may be overwritten by NPM.

[tigran-sargsyan-w]

NGINX itself supports this for TCP/UDP streams through the ngx_stream_access_module.

A native Nginx stream configuration can do:

server {
    listen 12345;

    allow 192.168.1.100;
    # or a subnet:
    # allow 192.168.1.0/24;

    deny all;

    proxy_pass backend:12345;
}

The rules are evaluated against the source IP and the first matching rule wins.

The limitation is Nginx Proxy Manager: currently its Stream Host UI does not expose allow / deny access rules. There is actually an open enhancement request for IP-based access control on Stream Hosts.

So with NPM today I would use one of these:

• restrict the published stream port with the host firewall (nftables/iptables/firewalld);
• restrict it at the upstream service;
• or manage a separate custom Nginx stream configuration outside NPM.

For a single source IP, a host firewall rule is probably the simplest and most robust solution.

I would not manually edit an NPM-generated stream configuration because NPM may regenerate and overwrite it later.