---
title: Adding a catch all black hole blocks in Nginx
url: https://calvin.my/posts/adding-a-catch-all-black-hole-blocks-in-nginx
published: 2026-01-05
updated: 2026-09-16
category: Operations
tags:
- Nginx
- Security
summary: The post describes creating a default Nginx “black hole” server block for requests that do not match configured domains. It uses a dummy self-signed certificate for HTTPS and drops unmatched traffic, including scans sent directly to an IP address or requests with unexpected host headers. This reduces unnecessary bandwidth use, prevents accidental routing to applications, and avoids exposing certificates for legitimate sites when scanners connect over HTTPS.
---

# Adding a catch all black hole blocks in Nginx

This configuration is a security measure used to create a catch-all black hole server block. Its purpose is to handle any requests that do not match a specifically defined domain name on the server.

* * *

## Setup

1. Create a self-signed cert with openssl with a 10 years validity.

   ```bash
   sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
     -keyout /path/to/dummy.key \
     -out /path/to/dummy.crt \
     -subj "/CN=_"
   ```

2. Create a new server block in the Nginx config.

   ```bash
   server {
       listen 80 default_server;
       listen [::]:80 default_server;
       listen 443 ssl default_server;
       listen [::]:443 ssl default_server;
   
       server_name _;
   
       ssl_certificate     /path/to/dummy.crt;
       ssl_certificate_key /path/to/dummy.key;
   
       return 444;
   }
   ```

3. Check and restart Nginx service.

   ```bash
   sudo nginx -t
   sudo service nginx restart
   ```

* * *

## The Usage

1. Many automated bots scan IP addresses directly rather than using domain names. By returning `444`, you save bandwidth and hide the fact that an active web server is running.

2. It ensures that requests with fake or unexpected `Host` headers are dropped rather than being routed to your actual application.

3. Modern HTTPS requires a certificate to complete the handshake. Without this default block, if someone hits your IP via HTTPS, Nginx might serve the certificate of a random site hosted on the same server. Using a dummy certificate ensures your "real" certificates aren't leaked to scanners.