# How to forbid direct IP visit to discourse?
**URL:** https://meta.discourse.org/t/how-to-forbid-direct-ip-visit-to-discourse/27797
**Category:** Self-hosting
**Created:** [April 21, 2015, 12:48pm UTC](https://meta.discourse.org/t/how-to-forbid-direct-ip-visit-to-discourse/27797 "2015-04-21T12:48:46Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@doudou](https://meta.discourse.org/u/doudou)
#### Post date: [April 21, 2015, 12:48pm UTC](https://meta.discourse.org/t/how-to-forbid-direct-ip-visit-to-discourse/27797/1 "2015-04-21T12:48:46Z")
If just only discourse installed on a server, and expose 80 to host, how to forbid direct IP visit to discourse?
If someone visit the direct ip address, how to make it return 500 error.
like:
```plaintext
server {
listen 80 default;
server name _;
return 500;
}
```
If the nginx/conf.d/discourse.conf in the docker changed, is it permanent?
@codinghorror
@sam
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [April 21, 2015, 1:55pm UTC](https://meta.discourse.org/t/how-to-forbid-direct-ip-visit-to-discourse/27797/2 "2015-04-21T13:55:27Z")
look at our ssl template it demonstrates how to make a replace rule in pups that amends nginx config.
---
### Author:  [@doudou](https://meta.discourse.org/u/doudou)
#### Post date: [April 21, 2015, 2:33pm UTC](https://meta.discourse.org/t/how-to-forbid-direct-ip-visit-to-discourse/27797/3 "2015-04-21T14:33:15Z")
> [@sam](#):
>
> ssl template
where, in the docker?
but when I add ‘return 500’ in the docker nginx configure file, it shows error either visit IP or domain name.
How to do?
---
### Author:  [@Lee\_Ars](https://meta.discourse.org/u/Lee_Ars)
#### Post date: [April 21, 2015, 3:51pm UTC](https://meta.discourse.org/t/how-to-forbid-direct-ip-visit-to-discourse/27797/4 "2015-04-21T15:51:25Z")
Why do you want to return a 500 error and not a 403 forbidden?
If you control the firewall this server is behind, dropping the offending IP address there might be easier. Or, you could use iptables on the server itself and drop the IP addresses there without having to bother with Discourse’s configuration—just add a rule onto the input chain, substituting the address or CIDR range you want to block in place of “1.2.3.4”:
```plaintext
iptables -A INPUT -s 1.2.3.4 -j DROP
```
IMO, if you’re not going to use Discourse’s built-in IP address blacklisting, it’s better to do this kind of thing outside of the Discourse docker container. You get more control and you don’t have to screw with the base DIscourse configuration in ways that might conflict with the DIscourse team’s future developments.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [April 21, 2015, 6:47pm UTC](https://meta.discourse.org/t/how-to-forbid-direct-ip-visit-to-discourse/27797/5 "2015-04-21T18:47:14Z")
host header needs to be parsed though, so its not doable in iptables.
---
### Author:  [@Lee\_Ars](https://meta.discourse.org/u/Lee_Ars)
#### Post date: [April 21, 2015, 7:30pm UTC](https://meta.discourse.org/t/how-to-forbid-direct-ip-visit-to-discourse/27797/6 "2015-04-21T19:30:59Z")
> [@sam](#):
>
> host header needs to be parsed though, so its not doable in iptables.
I prefer the nuclear option! “No more Discourse! NO MORE ANY WEB SITES AT ALL!”