# How do I restrict access to /admin?

**URL:** <https://discourse.mailinabox.email/t/how-do-i-restrict-access-to-admin/16547>\
**Category:** Help with Setup/Upgrade\
**Created:** [June 8, 2026, 8:20am UTC](https://discourse.mailinabox.email/t/how-do-i-restrict-access-to-admin/16547 "2026-06-08T08:20:55Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dodo](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/dodo/32/3112_2.png) [@Dodo](https://discourse.mailinabox.email/u/Dodo)\
**Post date:** [June 8, 2026, 8:20am UTC](https://discourse.mailinabox.email/t/how-do-i-restrict-access-to-admin/16547/1 "2026-06-08T08:20:55Z")

</div>

I want to restrict access to the control panel interface to the IP address range of my ISP. At least, that seems like a sensible thing to do in terms of security. How do I do that on v76?

Thanks in advance. Post must be at least 250 characters. Post must be at least 250 characters.

---

<div class="post-metadata">

**Author:** ![KiekerJan](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/kiekerjan/32/2339_2.png) [@KiekerJan](https://discourse.mailinabox.email/u/KiekerJan)\
**Post date:** [June 8, 2026, 3:00pm UTC](https://discourse.mailinabox.email/t/how-do-i-restrict-access-to-admin/16547/2 "2026-06-08T15:00:16Z")

</div>

There’s no built in thing. But you could hack the nginx configuration to block access to /admin in this way (I don’t know how though)  
Note such a change would probably be overwritten by a nightly script, so that has to be taken into account as well.

---

<div class="post-metadata">

**Author:** ![andrew](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/andrew/32/1449_2.png) [@andrew](https://discourse.mailinabox.email/u/andrew)\
**Post date:** [June 9, 2026, 3:58am UTC](https://discourse.mailinabox.email/t/how-do-i-restrict-access-to-admin/16547/3 "2026-06-09T03:58:08Z")

</div>

Here’s something else that will secure the admin account … MIAB already has two-factor authentication that (if activated) applies to the admin pages (not to email access).

Go to admin / Mail & Users / Two-Factor Authentication.

---

<div class="post-metadata">

**Author:** ![Dodo](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/dodo/32/3112_2.png) [@Dodo](https://discourse.mailinabox.email/u/Dodo)\
**Post date:** [June 9, 2026, 7:47am UTC](https://discourse.mailinabox.email/t/how-do-i-restrict-access-to-admin/16547/4 "2026-06-09T07:47:29Z")

</div>

True, but you can never have too much security, eh?  
I tried to lock it down in nginx, the configuration looks okay but evidently doesn’t work in practice. I’ll try again.

---

<div class="post-metadata">

**Author:** ![netmaster48](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/n/82dd89/32.png) [@netmaster48](https://discourse.mailinabox.email/u/netmaster48)\
**Post date:** [June 10, 2026, 6:56am UTC](https://discourse.mailinabox.email/t/how-do-i-restrict-access-to-admin/16547/5 "2026-06-10T06:56:48Z")

</div>

I have tried to modify nginx conf, but indeed, it will be overwritten. 2FA does not help much when in one day some bug is found in login logic (or somewhere) of the admin interface or api. All the MIAB installs will be hacked at once. That’s something that bothers me. In my book, everything not needed for the users (starting from ssh) must be closed or hidden from the world, and there is no need to advertise what exact software you using like MIAB does in SMTP banner. Actually there is full list of security tightening things I do before each install or update. Unfortunately MIAB does everything in it’s power to overwrite them.

---

<div class="post-metadata">

**Author:** ![Dodo](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/dodo/32/3112_2.png) [@Dodo](https://discourse.mailinabox.email/u/Dodo)\
**Post date:** [June 10, 2026, 12:00pm UTC](https://discourse.mailinabox.email/t/how-do-i-restrict-access-to-admin/16547/6 "2026-06-10T12:00:42Z")

</div>

Right, I got it working.

edit` /etc/nginx/conf.d/local.conf`

change this

```auto
location /admin/ {
    proxy_pass http://127.0.0.1:10222/;
    proxy_set_header X-Forwarded-For $remote_addr;
    add_header X-Frame-Options "DENY";
    add_header X-Content-Type-Options nosniff;
    add_header Content-Security-Policy "frame-ancestors 'none';";
}

```

to

> location /admin/ {  
> allow v.x.y.z/20;  
> deny all;
> 
> ```
> proxy_pass http://127.0.0.1:10222/;
> proxy_set_header X-Forwarded-For $remote_addr;
> add_header X-Frame-Options "DENY";
> add_header X-Content-Type-Options nosniff";
> add_header Content-Security-Policy "frame-ancestors 'none';";
> 
> ```
> 
> }

Do the same in `/root/mailinabox/conf/nginx-primaryonly.conf`

change this

```auto
location /admin/ {
    proxy_pass http://127.0.0.1:10222/;
    proxy_set_header X-Forwarded-For $remote_addr;
    add_header X-Frame-Options "DENY";
    add_header X-Content-Type-Options nosniff";
    add_header Content-Security-Policy "frame-ancestors 'none';";
}

```

to this

```auto
location /admin/ {
    allow v.x.y.z/20;
    deny all;

    proxy_pass http://127.0.0.1:10222/;
    proxy_set_header X-Forwarded-For $remote_addr;
    add_header X-Frame-Options "DENY";
    add_header X-Content-Type-Options nosniff";
    add_header Content-Security-Policy "frame-ancestors 'none';";
}

```

where v.x.y.z/20 is the subnet you want to allow access to.

Then run restart nginx and run `sudo mailinabox` for good measure.

---

<div class="post-metadata">

**Author:** ![KiekerJan](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/kiekerjan/32/2339_2.png) [@KiekerJan](https://discourse.mailinabox.email/u/KiekerJan)\
**Post date:** [June 10, 2026, 1:14pm UTC](https://discourse.mailinabox.email/t/how-do-i-restrict-access-to-admin/16547/7 "2026-06-10T13:14:54Z")

</div>

Nice!  
Note you’ll need to run some arcane git command when you wamt to upgrade MiaB. Also, in the last section

> [@Dodo](#):
>
> `allow allow v.x.y.z/20;`

Should probably be only one time allow?

---

<div class="post-metadata">

**Author:** ![Dodo](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/dodo/32/3112_2.png) [@Dodo](https://discourse.mailinabox.email/u/Dodo)\
**Post date:** [June 10, 2026, 2:49pm UTC](https://discourse.mailinabox.email/t/how-do-i-restrict-access-to-admin/16547/8 "2026-06-10T14:49:15Z")

</div>

Well spotted, that was a copy & paste error.

I think I’ll knock up a bash script that adds those lines to those files using `sed` for future use.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.mailinabox.email/uploads/default/original/2X/4/4d0933d13c456b7e57f296aa6cc344525b6f0c70.png) [@system](https://discourse.mailinabox.email/u/system)\
**Post date:** [June 17, 2026, 2:49pm UTC](https://discourse.mailinabox.email/t/how-do-i-restrict-access-to-admin/16547/9 "2026-06-17T14:49:21Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.