nginx proxy_set_header X-Forwarded-For with allow/deny something wrong -

nginx's conf:

location / {     deny 192.168.1.1;     allow 127.0.0.1/24;     deny all;     default_type application/json; } 

if request http://192.168.1.101:8000 no header ,nginx return 403.

if request http://192.168.1.101:8000 set header[" x-forwarded-for "] = 127.0.0.1 ,nginx return 200.

so how can denied illegal ip's request ？