The "deny" and "access" directives are IP-based in general. Both directives
only support IPv6 from nginx 0.8.22 onwards, on older versions of nginx those
directives have no effect on IPv6 requests. Thus they do not block access for
IPv6 requests.
Adding the "internal" directive blocks external access in general (both IPv4
and IPv6) and makes the web server return a status code 404 (Not Found)
response.
See:
http://nginx.org/en/CHANGEShttp://wiki.nginx.org/HttpCoreModule#internal
PHPBB3-10007