1. Black/white list IP restricted access configuration

There are several ways to configure black and white lists in nginx. Here are only two commonly used methods.

1. The first method: allow, deny

The deny and allow instructions belong to ngx_http_access_module. nginx loads this module by default, so it can be used directly.

This method is the simplest and most direct. Set up similar to firewall iptable, usage method:

Add directly to the configuration file:

#白名單設置，allow后面為可訪問IP 
location / {
     allow 123.13.123.12;
     allow 23.53.32.1/100;
     deny  all;
}

#黑名單設置，deny后面接限制的IP，為什么不加allow all? 因為這個默認是開啟的 
location / {
     deny 123.13.123.12;
}

#白名單，特定目錄訪問限制
location /tree/list {
     allow 123.13.123.12;
     deny  all;
}

or configure the whitelist by reading the file IP

location /{
    include /home/whitelist.conf;
    #默認位置路徑為/etc/nginx/ 下，
    #如直接寫include whitelist.conf，則只需要在/etc/nginx目錄下創(chuàng)建whitelist.conf
    deny all;
}

Create in the /home/ directory whitelist.conf, and write the IP that needs to be added to the whitelist. After the addition is completed, view the following:

cat /home/whitelist.conf

#白名單IP
allow 10.1.1.10;
allow 10.1.1.11;

The whitelist setting is completed, and the blacklist setting method is the same.

2: The second method, ngx_http_geo_module

By default, this module is usually added to nginx. ngx_http_geo_module: Official document, the parameters need to be set in the http module.

This module can set IP restrictions and country and region restrictions. The location can be outside the server module.

Syntax example:

Add the configuration file directly

geo $ip_list {
    default 0;
    #設置默認值為0
    192.168.1.0/24 1;
    10.1.0.0/16    1;
}
server {
    listen       8081;
    server_name  192.168.152.100;
    
    location / {
        root   /var/www/test;
		index  index.html index.htm index.php;
		if ( $ip_list = 0 ) {
		#判斷默認值，如果值為0，可訪問，這時上面添加的IP為黑名單。
		#白名單，將設置$ip_list = 1，這時上面添加的IP為白名單。
		proxy_pass http://192.168.152.100:8081;
    }

You can also read the file IP configuration

geo $ip_list {
    default 0;
    #設置默認值為0
    include ip_white.conf;
}
server {
    listen       8081;
    server_name  192.168.152.100;
    
    location / {
        root   /var/www/test;
		index  index.html index.htm index.php;
		if ( $ip_list = 0 ) {
			return 403;
			#限制的IP返回值為403，也可以設置為503，504其他值。
			#建議設置503，504這樣返回的頁面不會暴露nginx相關信息，限制的IP看到的信息只顯示服務器錯誤，無法判斷真正原因。
    }

Create ip_list in the /etc/nginx directory .conf, after adding the IP, view the following:

cat /etc/nginx/ip_list.conf

192.168.152.1 1;
192.168.150.0/24 1;

When the setting is completed, the IP list file ip_list.conf will be used as a whitelist. If the requested IP is not in the list, the 403 page will be returned directly. The blacklist setting method is the same.

3. ngx_http_geo_module load balancing (extension)

ngx_http_geo_module, the module can also be used for load balancing, such as web clusters with servers in different regions, IP segments in a certain region, load balancing to access Servers in a certain region. A similar way is to add custom values ??behind the IP. These values ??are not limited to numbers, but letters can also be used, such as US, CN, etc.

Example:

If there are three servers: 122.11.11.11, 133.11.12.22, 144.11.11.33

geo $country {
    default default;
    111.11.11.0/24   uk;
    #IP段定義值uk
    111.11.12.0/24   us;
    #IP段定義值us
    }
upstream  uk.server {
    erver 122.11.11.11:9090;
    #定義值uk的IP直接訪問此服務器
} 

upstream  us.server {
    server 133.11.12.22:9090;
    #定義值us的IP直接訪問此服務器
}

upstream  default.server {
    server 144.11.11.33:9090;
    #默認的定義值default的IP直接訪問此服務器
}
 
server {
    listen    9090;
    server_name 144.11.11.33;

    location / {
      root  /var/www/html/;
      index index.html index.htm;
     }
 }

Then

2. Country and region IP Restricting access

Some third-party services such as cloudflare also provide setting options to make the setting of firewall rules more convenient. Here we talk about how to set up nginx.

1: Install the ngx_http_geoip_module module

ngx_http_geoip_module: Official document, the parameters need to be set in the http module.

nginx does not build this module by default, it should be enabled using the --with-http_geoip_module configuration parameter.

For Ubuntu systems, install nginx-extras components directly, including almost all modules.

sudo apt install nginx-extras

For centos system, install the module.

yum install nginx-module-geoip

2. Download the IP database

This module depends on the IP database. All data is read in this database, and the ip library (dat format) needs to be downloaded.

MaxMind provides a free IP geographical database. The bad news is that MaxMind has officially stopped supporting the dat format IP database.

You can find dat format files in other places, or old versions. Of course, the data cannot be the latest, and there are some errors.

Download includes country and city versions of both Ipv4 and Ipv6.

#下載國家IP庫，解壓并移動到nginx配置文件目錄，
sudo wget https://dl.miyuru.lk/geoip/maxmind/country/maxmind.dat.gz
gunzip maxmind.dat.gz
sudo mv maxmind.dat /etc/nginx/GeoCountry.dat

sudo wget https://dl.miyuru.lk/geoip/maxmind/city/maxmind.dat.gz
gunzip maxmind.dat.gz
sudo mv maxmind.dat /etc/nginx/GeoCity.dat

3. Configure nginx

Example:

geoip_country /etc/nginx/GeoCountry.dat;
geoip_city /etc/nginx/GeoCity.dat;

server {
    listen  80;
    server_name 144.11.11.33;

    location / {
      root  /var/www/html/;
      index index.html index.htm;
      if ($geoip_country_code = CN) {
  			return 403;
 		#中國地區(qū)，拒絕訪問。返回403頁面
		}
  	}
 }

Here, the regional and country basic settings are completed.

Geoip other parameters:

Country-related parameters:
$geoip_country_code #Two-character English country code. For example: CN, US
$geoip_country_code3 #A three-character English country code. For example: CHN, USA
$geoip_country_name #The full English name of the country. For example: China, United States
City related parameters:
$geoip_city_country_code # is also a two-character English country code.
$geoip_city_country_code3 #Same as above
$geoip_city_country_name #Same as above.
$geoip_region #This has been tested to be a two-digit number, such as 02 for Hangzhou and 23 for Shanghai. However, no relevant information was found. I hope friends who know more can leave a message.
$geoip_city #The English name of the city. For example: Hangzhou
$geoip_postal_code #The postal code of the city. After testing, this field is empty in China
$geoip_city_continent_code #I don’t know what it is used for, but it seems to be AS
$geoip_latitude #Latitude
$geoip_longitude #Longitude

The above is the detailed content of How do websites set black/whitelist IP restrictions and country and city IP access restrictions through nginx?. For more information, please follow other related articles on the PHP Chinese website!