# How to implement Modsecurity for Nextcloud AIO **URL:** \ **Category:** 📦 Appliances (Docker, Snappy, VM, NCP, AIO)\ **Tags:** reverseproxy, docker, security, modsecurity, ncp, aio\ **Created:** [August 2, 2024, 7:08pm UTC](https://help.nextcloud.com/t/how-to-implement-modsecurity-for-nextcloud-aio/199999 "2024-08-02T19:08:39Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Nanak\_Singh](https://help.nextcloud.com/user_avatar/help.nextcloud.com/nanak_singh/32/51072_2.png) [@Nanak\_Singh](https://help.nextcloud.com/u/Nanak_Singh)\ **Post date:** [August 2, 2024, 7:08pm UTC](https://help.nextcloud.com/t/how-to-implement-modsecurity-for-nextcloud-aio/199999/1 "2024-08-02T19:08:39Z")
I am running nextcloud AIO with reverse proxy. I want to configure modsecurity how is it possible? I just want to configure a rule where a url is blocked if accessed from a specific ip range. ---
**Author:** ![szaimen](https://help.nextcloud.com/user_avatar/help.nextcloud.com/szaimen/32/63019_2.png) [@szaimen](https://help.nextcloud.com/u/szaimen)\ **Post date:** [August 2, 2024, 7:24pm UTC](https://help.nextcloud.com/t/how-to-implement-modsecurity-for-nextcloud-aio/199999/2 "2024-08-02T19:24:01Z")
Hi, I dont know much about modsecurity but you could potentially use this community container which allows to do geoblocking: [all-in-one/community-containers/caddy at main · nextcloud/all-in-one · GitHub](https://github.com/nextcloud/all-in-one/tree/main/community-containers/caddy) Apart from that, there will be a way to limit admin actions to certain ip-ranges with Nextcloud 30: [Hardening and security guidance — Nextcloud latest Administration Manual latest documentation](https://docs.nextcloud.com/server/latest/admin_manual/installation/harden_server.html#restrict-admin-actions-to-a-specific-range-of-ip-addresses) ---
**Author:** ![jtr](https://help.nextcloud.com/letter_avatar/jtr/32/6_22734026db12803ebb3e059622ac3534.png) [@jtr](https://help.nextcloud.com/u/jtr)\ **Post date:** [August 2, 2024, 7:28pm UTC](https://help.nextcloud.com/t/how-to-implement-modsecurity-for-nextcloud-aio/199999/3 "2024-08-02T19:28:57Z")
> [@Nanak\_Singh](#): > > I want to configure modsecurity how is it possible? I just want to configure a rule where a url is blocked if accessed from a specific ip range. There are far easier ways to do that than mod\_security. Check the manual for whatever web server you’re using as reverse proxy. ---
**Author:** ![Nanak\_Singh](https://help.nextcloud.com/user_avatar/help.nextcloud.com/nanak_singh/32/51072_2.png) [@Nanak\_Singh](https://help.nextcloud.com/u/Nanak_Singh)\ **Post date:** [August 2, 2024, 7:41pm UTC](https://help.nextcloud.com/t/how-to-implement-modsecurity-for-nextcloud-aio/199999/4 "2024-08-02T19:41:31Z")
@jtr @szaimen thx for ur reply but i want to block access to `https://domain.com/apps/mail/api/messages/846/attachment/2` for anyone accessing it outside of local network. this would block users from downloading mail attachments outside of local network. I’m using nginx proxy manager ---
**Author:** ![jtr](https://help.nextcloud.com/letter_avatar/jtr/32/6_22734026db12803ebb3e059622ac3534.png) [@jtr](https://help.nextcloud.com/u/jtr)\ **Post date:** [August 2, 2024, 8:27pm UTC](https://help.nextcloud.com/t/how-to-implement-modsecurity-for-nextcloud-aio/199999/5 "2024-08-02T20:27:08Z")
Use your favorite [search](https://help.nextcloud.com/search) engine. Nginx (NPM included) can do this. e.g. [https://www.reddit.com/r/unRAID/comments/vldhki/block\_a\_specific\_sub\_folder\_using\_nginx\_proxy/](https://www.reddit.com/r/unRAID/comments/vldhki/block_a_specific_sub_folder_using_nginx_proxy/) ---
**Author:** ![Nanak\_Singh](https://help.nextcloud.com/user_avatar/help.nextcloud.com/nanak_singh/32/51072_2.png) [@Nanak\_Singh](https://help.nextcloud.com/u/Nanak_Singh)\ **Post date:** [August 2, 2024, 8:29pm UTC](https://help.nextcloud.com/t/how-to-implement-modsecurity-for-nextcloud-aio/199999/6 "2024-08-02T20:29:12Z")
I was trying that, im able to deny request but not allow a subnet. ---
**Author:** ![Nanak\_Singh](https://help.nextcloud.com/user_avatar/help.nextcloud.com/nanak_singh/32/51072_2.png) [@Nanak\_Singh](https://help.nextcloud.com/u/Nanak_Singh)\ **Post date:** [August 2, 2024, 8:38pm UTC](https://help.nextcloud.com/t/how-to-implement-modsecurity-for-nextcloud-aio/199999/7 "2024-08-02T20:38:09Z")
I’m trying the following, deny working on all but allow not working why? ```auto location ~* ^/apps/mail/api/messages/\d+/attachment/\d+$ { allow 192.168.0.0/16; deny all; } ``` ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [May 22, 2025, 5:55am UTC](https://help.nextcloud.com/t/how-to-implement-modsecurity-for-nextcloud-aio/199999/8 "2025-05-22T05:55:48Z")
---
**Author:** ![ernolf](https://help.nextcloud.com/user_avatar/help.nextcloud.com/ernolf/32/77874_2.png) [@ernolf](https://help.nextcloud.com/u/ernolf)\ **Post date:** [August 21, 2025, 10:46pm UTC](https://help.nextcloud.com/t/how-to-implement-modsecurity-for-nextcloud-aio/199999/9 "2025-08-21T22:46:49Z")
> [@Nanak\_Singh](#): > > i want to block access to `https://domain.com/apps/mail/api/messages/846/attachment/2` > for anyone accessing it outside of local network. This is a typical use case for mod\_security! Your rule should look like this: ```auto # Allow access to mail attachments only from local network SecRule REQUEST_URI "@rx ^/apps/mail/api/messages/\d+/attachment/\d+" \ "id:900100,\ phase:1,\ deny,\ t:none,\ msg:'Blocked access to Mail attachment from outside local network',\ chain" SecRule REMOTE_ADDR "!@ipMatch 192.168.189.0/24" # adjust your local network/subnet ``` I assume you know how to install modsecurity on your server and where to put this rule. h.t.h. * * * Much and good luck, ernolf