Geoip and Nginx How to block visitors by country

Posted by: mah 6 years, 8 months ago

(0 comments)

Operating system: Ubuntu 16.04

First we need to know nginx has support Geoip:

$ nginx -V
nginx version: nginx/1.10.3 (Ubuntu)
built with OpenSSL 1.0.2g 1 Mar 2016
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2' 
--with-ld-opt='-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf 
--http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid 
--http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy 
--http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit --with-ipv6 --with-http_ssl_module 
--with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_addition_module --with-http_dav_module 
--with-http_geoip_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module --with-http_v2_module 
--with-http_sub_module --with-http_xslt_module --with-stream --with-stream_ssl_module --with-mail --with-mail_ssl_module --with-threads

yes, we have.

Install geoip packages:

$ sudo apt-get install geoip-database

place for database is:

/usr/share/GeoIP

GeoIP.dat    - > for IPv4

GeoIPv6.dat - > for IPv4 and IPv6

Go to nginx config:

$ cd /etc/nginx

in section http add follow rows:

http{
geoip_country /usr/share/GeoIP/GeoIP.dat;
map $geoip_country_code $allow_visit {
 default no;
 US yes;    # enable USA IPs
 CA yes;    # enable Canada IPs
}
geo $exclusions {
 default 0;
 10.0.1.126 1; # here comes allowed IP that is in blocked country list
 10.0.0.0/24 1;
 172.68.58.75 1;
 10.0.0.7 1;
}
# Rest of config

#..... 
}

save it and go to virtual server (dir sites-enabled)

add follow in section server

server {
#.... some config
location / {
 if ($allow_visit = yes) {
 set $exclusions 1;
 }
 if ($exclusions = "0") {
 return 403;
 }
#...
# rest of config 
}

almost done

restart nginx

sudo /etc/init.d/nginx reload
[ ok ] Reloading nginx configuration (via systemctl): nginx.service.

You can check availability your site from any place with online services.

• Tags:
• geoip,
• nginx,
• linux,
• nginx block ip by country

• ← Protect your web site with Fail2Ban!
• Install and configure Postfix on Ubuntu 16.04 with Sendgrid as smarthost →