Nginx: Block Direct IP Access

I like to enforce strict SNI on my servers, preferring to reject requests to domain names that I don't host or the IP address of the server itself. If a default_server isn't configured, Nginx will choose the first server block when there isn't a matching server_name. To avoid this, I've configured an SSL default_server in Nginx that uses a dummy certificate and the NULL cipher. By using the NULL cipher, the web browser won't continue with the request (otherwise, an untrusted certificate warning will appear). The 444 response code tells Nginx to close the connection without sending a response.

server {
        listen      443 ssl default_server;
        listen [::]:443 ssl default_server;

        # Disable logging
        error_log  /dev/null;
        access_log off;

        # Snakeoil TLS to appease Nginx
        ssl_certificate     /etc/ssl/certs/ssl-cert-snakeoil.pem;
        ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
        ssl_stapling        off;
        ssl_ciphers         NULL;

        # Close the connection without sending a response
        return 444;
}

Now, if you try to connect directly using the server IP address or a domain name that isn't defined, the connection is closed almost immediatly, saving a bit of bandwidth.

What About HTTP?

I've stopped enabling unencrypted HTTP on my servers, leaving only HTTPS available. Cloudflare takes care of the redirection from HTTP to HTTPS for the few clients that make unencrypted requests.