How to use Nginx to implement IP blacklist

With the rapid development of the Internet, network security has become an increasingly important issue. Malicious attacks and phishing incidents occur from time to time, posing a great threat to websites and users. Therefore, it is crucial to establish an effective network security defense system.

Nginx is a popular web server software that not only provides high-performance web services, but also plays the role of a reverse proxy. Nginx also provides rich modules to help administrators protect web servers and applications. One of the important features is the IP blacklist, which helps administrators restrict access from specific IP addresses.

The following will discuss how to implement IP blacklisting in Nginx.

Step One: Disable IP Address Access

In the Nginx configuration, the administrator can define a set of IP addresses to disable access. This can be achieved using the "deny" directive and a list of IP addresses. For example, the following configuration will prohibit access to the two IP addresses 192.168.1.2 and 192.168.1.3:

location / {
  deny 192.168.1.2;
  deny 192.168.1.3;
  # ... other configuration directives
}

You can use multiple deny directives in the location block to prevent access to multiple IP addresses.

Step 2: Allow specific IP access

In addition to disabling IP addresses, administrators can also configure Nginx to allow access from specific IP addresses. This can be achieved using the "allow" directive and a list of IP addresses. For example, the following configuration will allow access to the two IP addresses 192.168.1.4 and 192.168.1.5:

location / {
  deny all;
  allow 192.168.1.4;
  allow 192.168.1.5;
  # ... other configuration directives
}

Like the deny directive, multiple allow directives can be used in the location block to allow access to multiple IP addresses .

Step 3: Use variables to manage the IP address list

In actual applications, administrators may need to dynamically manage the IP address list. To make the configuration more flexible, variables can be used to manage the list of IP addresses. The following example demonstrates how to use variables to define a list of IP addresses:

map $remote_addr $deny_ip {
  192.168.1.2 1;
  192.168.1.3 1;
  default 0;
}

In the above example, the "map" directive maps the remote IP address to the $deny_ip variable. If the IP address is in the 192.168.1.2 or 192.168.1.3 list, the $deny_ip variable will be set to 1. Otherwise, the $deny_ip variable will be set to 0.

Next, you can use the $deny_ip variable in the Nginx configuration to determine whether access is prohibited. The following example demonstrates how to use the $deny_ip variable to block access to a banned IP address:

location / {
  if ($deny_ip) {
    return 403;
  }
  # ... other configuration directives
}

If the $deny_ip variable is 1, Nginx will return a 403 Forbidden response code.

Summary

Nginx is a powerful web server software that can provide rich security features while ensuring server performance. By using Nginx's IP blacklist function, administrators can prohibit access from specific IP addresses to ensure the security of the web server. At the same time, using variables can make the configuration more flexible and easier to manage. Using the above steps, administrators can easily implement IP blacklist functionality in Nginx.

The above is the detailed content of How to use Nginx to implement IP blacklist. For more information, please follow other related articles on the PHP Chinese website!