Return custom 403 error page with nginx

I had the same issue... The point is that i've implemented ip whitelist at server context level (or vhost level if you prefer), so every locations will have this as well (basicaly /403.html won't be accessible) :

server {
  listen       *:443 ssl;
  server_name  mydomain.com ;
  error_page 403 /403.html;
  .....
  if ($exclusion = 0) { return 403; } #implemented in another conf.d files (see below)
  location ~ \.php$ {
    root          /var/www/vhosts/mydomain.com/httpdocs;
    include       /etc/nginx/fastcgi_par
    fastcgi_pass  127.0.0.1:9000;
    fastcgi_connect_timeout 3m;
    fastcgi_read_timeout 3m;
    fastcgi_send_timeout 3m;
  }
  location /403.html {
    root      /usr/share/nginx/html;
    allow all;
  }

  ...
}

Exclusion conf.d file sample:

geo $exclusion {
  default 0;
  10.0.0.0/8  Local network
  80.23.120.23 Some_ip
  ...
}

To fix that simply do your return 403 at location level (context):

server {
  listen       *:443 ssl;
  server_name  mydomain.com ;
  error_page 403 /403.html;
  .....
  location ~ \.php$ {
    if ($exclusion = 0) { return 403; } 
    root          /var/www/vhosts/mydomain.com/httpdocs;
    include       /etc/nginx/fastcgi_par
    fastcgi_pass  127.0.0.1:9000;
    fastcgi_connect_timeout 3m;
    fastcgi_read_timeout 3m;
    fastcgi_send_timeout 3m;
  }
  location /403.html {
    root      /usr/share/nginx/html;
    allow all;
  }

  ...
}

Works for me.

The problem might be that you're trying to server a 403 "Forbidden" error from a webserver that they are forbidden from accessing. Nginx treats the error_page directive as an internal redirect. So it is trying to server https://example.com/error403.html which is also forbidden.

So you need to make the error page not served out of https like this:

error_page  403   http://example.com/error403.html

or add the necessary "access allowed" options to the location for the error page path. The way to test this is to access the /error403.html page directly. If you can't accesses that way, it isn't going to work when someone gets an actual 403 error.

I did heaps of googling before coming here but did some more just now, within 5 minutes I had my answer :P

Seems I'm not the only person to have this issue:

error_page 403 /e403.html;
  location = /e403.html {
  root   html;
  allow all;
}

http://www.cyberciti.biz/faq/unix-linux-nginx-custom-error-403-page-configuration/

Seems that I was right in thinking that access to my error page was getting blocked.