Where to place Nginx IP blacklist config file?

Question

I have an Nginx web server hosting two sites. I created a blockips.conf file to blacklist IP addresses that are constantly probing the server and included this file in the nginx.conf file. However in my access logs for the sites I still see these IP addresses showing up. Do I need to include the black list in each site's conf instead of the global conf for Nginx?

Here is my nginx.conf

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;

    keepalive_timeout  65;

    include /etc/nginx/conf.d/*.conf;
    # Load virtual host configuration files.
    include /etc/nginx/sites-enabled/*;

    # BLOCK SPAMMERS IP ADDRESSES
    include /etc/nginx/conf.d/blockips.conf;
}

blockips.conf

deny 58.218.199.250;

access.log still shows this IP address.

58.218.199.250 - - [27/Sep/2012:06:41:03 -0600] "GET http://59.53.91.9/proxy/judge.php HTTP/1.1" 403 570 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "-"

What am I doing incorrectly?

Why don't you block the ip's further up at your firewall rather than the application — Ben Lessani, Sep 27 '12 at 20:39
@sonassi - I definitely could, but the web server should be able to do this as well. Just curious why it's not. — ProfessionalAmateur, Sep 27 '12 at 20:41
Your lines `include /etc/nginx/conf.d/*.conf;` and `include /etc/nginx/conf.d/blockips.conf;` would lead to `blockips.conf` to be included twice. — max, Jul 09 '18 at 11:41

score 13 · Answer 1 · answered Sep 27 '12 at 21:08

13

I would recommend to place your blacklist in iptables :) iptables -A INPUT -s 58.218.199.250 -j DROP That way you dont spend resources processing requests from unwanted ip addresses.

answered Sep 27 '12 at 21:08

Hex

1,949
11
17

2

I upvoted as if you can this is the right approach, however I have nginx behind haproxy so that the source real ip address is that of the haproxy rather than the real ip addreess. – James Aug 30 '15 at 06:44

score 6 · Accepted Answer · answered Sep 27 '12 at 20:45

6

Looking at your log, it IS blocking the traffic, there is a 403 header - ie. Access denied.

answered Sep 27 '12 at 20:45

Ben Lessani

5,244
17
37

That makes sense, I was under the assumption I wouldnt even see it in the log. I see other `403` responses for unblocked IP's so I just assumed it was allowing access and failing later. – ProfessionalAmateur Sep 27 '12 at 20:49
2

Save your bandwidth and CPU time and block them with `iptables` . You should also look into Naxsi if you want to automate the process. – Ben Lessani Sep 27 '12 at 20:57

Where to place Nginx IP blacklist config file?

2 Answers2