ACL configuration based on keywords and blacklist in Nginx reverse proxy

With the rapid progress of network development, the number of applications and services deployed is increasing. In some scenarios, requests need to be routed to specific servers or applications. Nginx is a high-performance web server and a commonly used reverse proxy method that can solve these problems. Based on the ACL module provided by the Nginx reverse proxy, administrators can flexibly control and manage request routing, access control, and other network security issues.

In a reverse proxy, a request is sent from the client to the reverse proxy server, and the proxy server sends a request to the backend server on behalf of the client and provides the return result to the client. For example, in modern web applications with multiple languages ​​and technology stacks, Nginx reverse proxy can be used to route different requests to different back-end services through the same domain name.

In this article, we will learn how to configure keyword- and blacklist-based ACLs to implement more granular routing policies and security controls for Nginx reverse proxy.

Keyword ACL

Keyword ACL is a way to implement request routing by matching keywords in the request URL. For example, in the current application, when the requested URL contains "/app1/", we want the Nginx reverse proxy to route the request to backend application 1. If the URL contains "/app2/", the request is routed to backend application 2.

To implement this function, you need to configure a keyword ACL in the Nginx configuration file. Here's how to configure it:

http {
    ...
    # 关键词acl
    map $request_uri $app_name {
        ~* "/app1/" app1;
        ~* "/app2/" app2;
        default "";
    }
}

In this configuration, $request_uri is an Nginx built-in variable that represents the requested URL. The value of this variable is passed to the map directive, which matches the predefined keyword regular expression. If the match is successful, the name of the application is stored in the $app_name variable, otherwise the default value is used.

Next, you can pass the $app_name variable defined above as the target of the proxy to the proxy URL option in the proxy directive:

server {
    ...
    location / {
        ...
        # 配置关键词代理
        proxy_pass http://$app_name.backend.com;
    }
}

In this configuration, the keyword ACL will be requested from The name of the requested application is matched in the URL, and the client's request is routed to the corresponding back-end application through proxy instructions.

Blacklist-based ACL

Blacklist ACL is a method used to block access to certain IPs or request URLs. This approach is very useful in some situations. For example, in the event of a malicious attack, the administrator can configure a blacklist ACL in the Nginx reverse proxy to deny access to a group of IP addresses. You can also use blacklist ACLs to deny certain common attack URLs.

Here's how to configure a blacklist-based ACL:

http {
    ...
    # 黑名单acl
    geo $blocked_ip {
        default 0;
        include /path/to/blacklists/ip.txt;
    }
}

In this configuration, the geo directive defines a memory variable named $blocked_ip, which is used to store the list of blocked IP addresses. In this example, an external IP address blacklist file is used. The format of the file is as follows:

10.2.1.10 1;
192.168.0.0/24 1;
202.102.85.154 1;

Each line of the file contains an IP address or network segment in CIDR format, followed by the number 1 to indicate that this IP address or CIDR network segment is blocked.

Next you can use this blacklist ACL in the Nginx configuration:

server {
    ...
    location / {
        ...
        # 配置黑名单ACL
        if ($blocked_ip) {
            return 403;
        }
        proxy_pass http://backend.com;
    }
}

In this configuration, the if directive is used to determine whether the requested IP address is in the blacklist. If so A 403 Forbidden response will be returned directly. Otherwise, the request will be routed to the backend proxy server.

To sum up, Nginx reverse proxy provides a good ACL module, which can be used together with other functional modules to achieve very flexible request routing and access control. In the use of reverse proxy, understanding and mastering these methods can allow us to better adapt to various situations and improve the quality and security of network services.

The above is the detailed content of ACL configuration based on keywords and blacklist in Nginx reverse proxy. For more information, please follow other related articles on the PHP Chinese website!