allow localhost; deny all; for all despite "index.php" and "/" - nginx

Question

I'm trying to restrict direct access to .php files on web server.
Used allow localhost;deny all;. However, this restricts access also to index.php.
How to overcome this issue? Is there something like IF conditions?
My config:
if ($request_uri ~* "^(/)index\.php$") {
return 301 $1;
}
location / {
try_files $uri $uri/ /index.php?$args;
rewrite ^/(\w+)$ /?system=$1 break;
rewrite ^/(\w+)/(\w+)(/.)*$ /?system=$1&id=$2 break;
rewrite ^/(.*)/$ /$1 permanent;
location ~ \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
#fastcgi_pass 127.0.0.1:9000;
fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param PHP_VALUE "auto_prepend_file=/usr/share/nginx/html/web/config.php";
}
}

Answer 1

What's commonly done is that you add a RewriteRule to an .htaccess file. This makes it possible to redirect all traffic to the index.php as you wish.
This solution even allows you to add the requested URL as an URL-parameter, so it is accessible within index.php as a $_GET variable.
Since .htaccess is only a solution for an Apache server it cannot be applied one-on-one here. This blog post on NGINX's website explains how it's done on NGINX: https://www.nginx.com/blog/creating-nginx-rewrite-rules/

Answer 2

Instead of matching all PHP files, match just index.php and reject all others, like this:
location = /index.php {
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
#fastcgi_pass 127.0.0.1:9000;
fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param PHP_VALUE "auto_prepend_file=/usr/share/nginx/html/web/config.php";
}
location ~ \.php$ {
return 301 $scheme://$http_host/index.php;
}
If you want to allow posts from the server to itself add the following for the URI
location = /post.php {
allow 127.0.0.1/24;
deny all;
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
#fastcgi_pass 127.0.0.1:9000;
fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param PHP_VALUE "auto_prepend_file=/usr/share/nginx/html/web/config.php";
}
Edit: Alternative Configuration
server {
listen 80;
location = /index.php {
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
#fastcgi_pass 127.0.0.1:9000;
fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param PHP_VALUE "auto_prepend_file=/usr/share/nginx/html/web/config.php";
}
location ~ \.php$ {
return 301 $scheme://$http_host/index.php;
}
}
server {
listen 127.0.0.1:81;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
#fastcgi_pass 127.0.0.1:9000;
fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param PHP_VALUE "auto_prepend_file=/usr/share/nginx/html/web/config.php";
}
}
Local requests would then need to be directed to port 81, ie:
curl http://localhost:81/myscript.php