search
HomeOperation and MaintenanceNginxACL configuration based on keywords and blacklist in Nginx reverse proxy

ACL configuration based on keywords and blacklist in Nginx reverse proxy

Jun 10, 2023 am 09:52 AM
nginxreverse proxyacl configuration

With the rapid progress of network development, the number of applications and services deployed is increasing. In some scenarios, requests need to be routed to specific servers or applications. Nginx is a high-performance web server and a commonly used reverse proxy method that can solve these problems. Based on the ACL module provided by the Nginx reverse proxy, administrators can flexibly control and manage request routing, access control, and other network security issues.

In a reverse proxy, a request is sent from the client to the reverse proxy server, and the proxy server sends a request to the backend server on behalf of the client and provides the return result to the client. For example, in modern web applications with multiple languages ​​and technology stacks, Nginx reverse proxy can be used to route different requests to different back-end services through the same domain name.

In this article, we will learn how to configure keyword- and blacklist-based ACLs to implement more granular routing policies and security controls for Nginx reverse proxy.

Keyword ACL

Keyword ACL is a way to implement request routing by matching keywords in the request URL. For example, in the current application, when the requested URL contains "/app1/", we want the Nginx reverse proxy to route the request to backend application 1. If the URL contains "/app2/", the request is routed to backend application 2.

To implement this function, you need to configure a keyword ACL in the Nginx configuration file. Here's how to configure it:

http {
    ...
    # 关键词acl
    map $request_uri $app_name {
        ~* "/app1/" app1;
        ~* "/app2/" app2;
        default "";
    }
}

In this configuration, $request_uri is an Nginx built-in variable that represents the requested URL. The value of this variable is passed to the map directive, which matches the predefined keyword regular expression. If the match is successful, the name of the application is stored in the $app_name variable, otherwise the default value is used.

Next, you can pass the $app_name variable defined above as the target of the proxy to the proxy URL option in the proxy directive:

server {
    ...
    location / {
        ...
        # 配置关键词代理
        proxy_pass http://$app_name.backend.com;
    }
}

In this configuration, the keyword ACL will be requested from The name of the requested application is matched in the URL, and the client's request is routed to the corresponding back-end application through proxy instructions.

Blacklist-based ACL

Blacklist ACL is a method used to block access to certain IPs or request URLs. This approach is very useful in some situations. For example, in the event of a malicious attack, the administrator can configure a blacklist ACL in the Nginx reverse proxy to deny access to a group of IP addresses. You can also use blacklist ACLs to deny certain common attack URLs.

Here's how to configure a blacklist-based ACL:

http {
    ...
    # 黑名单acl
    geo $blocked_ip {
        default 0;
        include /path/to/blacklists/ip.txt;
    }
}

In this configuration, the geo directive defines a memory variable named $blocked_ip, which is used to store the list of blocked IP addresses. In this example, an external IP address blacklist file is used. The format of the file is as follows:

10.2.1.10 1;
192.168.0.0/24 1;
202.102.85.154 1;

Each line of the file contains an IP address or network segment in CIDR format, followed by the number 1 to indicate that this IP address or CIDR network segment is blocked.

Next you can use this blacklist ACL in the Nginx configuration:

server {
    ...
    location / {
        ...
        # 配置黑名单ACL
        if ($blocked_ip) {
            return 403;
        }
        proxy_pass http://backend.com;
    }
}

In this configuration, the if directive is used to determine whether the requested IP address is in the blacklist. If so A 403 Forbidden response will be returned directly. Otherwise, the request will be routed to the backend proxy server.

To sum up, Nginx reverse proxy provides a good ACL module, which can be used together with other functional modules to achieve very flexible request routing and access control. In the use of reverse proxy, understanding and mastering these methods can allow us to better adapt to various situations and improve the quality and security of network services.

The above is the detailed content of ACL configuration based on keywords and blacklist in Nginx reverse proxy. For more information, please follow other related articles on the PHP Chinese website!

Statement
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
The Ultimate Showdown: NGINX vs. ApacheThe Ultimate Showdown: NGINX vs. ApacheApr 18, 2025 am 12:02 AM

NGINX is suitable for handling high concurrent requests, while Apache is suitable for scenarios where complex configurations and functional extensions are required. 1.NGINX adopts an event-driven, non-blocking architecture, and is suitable for high concurrency environments. 2. Apache adopts process or thread model to provide a rich module ecosystem that is suitable for complex configuration needs.

NGINX in Action: Examples and Real-World ApplicationsNGINX in Action: Examples and Real-World ApplicationsApr 17, 2025 am 12:18 AM

NGINX can be used to improve website performance, security, and scalability. 1) As a reverse proxy and load balancer, NGINX can optimize back-end services and share traffic. 2) Through event-driven and asynchronous architecture, NGINX efficiently handles high concurrent connections. 3) Configuration files allow flexible definition of rules, such as static file service and load balancing. 4) Optimization suggestions include enabling Gzip compression, using cache and tuning the worker process.

NGINX Unit: Supporting Different Programming LanguagesNGINX Unit: Supporting Different Programming LanguagesApr 16, 2025 am 12:15 AM

NGINXUnit supports multiple programming languages ​​and is implemented through modular design. 1. Loading language module: Load the corresponding module according to the configuration file. 2. Application startup: Execute application code when the calling language runs. 3. Request processing: forward the request to the application instance. 4. Response return: Return the processed response to the client.

Choosing Between NGINX and Apache: The Right Fit for Your NeedsChoosing Between NGINX and Apache: The Right Fit for Your NeedsApr 15, 2025 am 12:04 AM

NGINX and Apache have their own advantages and disadvantages and are suitable for different scenarios. 1.NGINX is suitable for high concurrency and low resource consumption scenarios. 2. Apache is suitable for scenarios where complex configurations and rich modules are required. By comparing their core features, performance differences, and best practices, you can help you choose the server software that best suits your needs.

How to start nginxHow to start nginxApr 14, 2025 pm 01:06 PM

Question: How to start Nginx? Answer: Install Nginx Startup Nginx Verification Nginx Is Nginx Started Explore other startup options Automatically start Nginx

How to check whether nginx is startedHow to check whether nginx is startedApr 14, 2025 pm 01:03 PM

How to confirm whether Nginx is started: 1. Use the command line: systemctl status nginx (Linux/Unix), netstat -ano | findstr 80 (Windows); 2. Check whether port 80 is open; 3. Check the Nginx startup message in the system log; 4. Use third-party tools, such as Nagios, Zabbix, and Icinga.

How to close nginxHow to close nginxApr 14, 2025 pm 01:00 PM

To shut down the Nginx service, follow these steps: Determine the installation type: Red Hat/CentOS (systemctl status nginx) or Debian/Ubuntu (service nginx status) Stop the service: Red Hat/CentOS (systemctl stop nginx) or Debian/Ubuntu (service nginx stop) Disable automatic startup (optional): Red Hat/CentOS (systemctl disabled nginx) or Debian/Ubuntu (syst

How to configure nginx in WindowsHow to configure nginx in WindowsApr 14, 2025 pm 12:57 PM

How to configure Nginx in Windows? Install Nginx and create a virtual host configuration. Modify the main configuration file and include the virtual host configuration. Start or reload Nginx. Test the configuration and view the website. Selectively enable SSL and configure SSL certificates. Selectively set the firewall to allow port 80 and 443 traffic.

See all articles

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
1 months agoBy尊渡假赌尊渡假赌尊渡假赌
R.E.P.O. Best Graphic Settings
1 months agoBy尊渡假赌尊渡假赌尊渡假赌
Will R.E.P.O. Have Crossplay?
1 months agoBy尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Safe Exam Browser

Safe Exam Browser

Safe Exam Browser is a secure browser environment for taking online exams securely. This software turns any computer into a secure workstation. It controls access to any utility and prevents students from using unauthorized resources.

WebStorm Mac version

WebStorm Mac version

Useful JavaScript development tools

SAP NetWeaver Server Adapter for Eclipse

SAP NetWeaver Server Adapter for Eclipse

Integrate Eclipse with SAP NetWeaver application server.

MinGW - Minimalist GNU for Windows

MinGW - Minimalist GNU for Windows

This project is in the process of being migrated to osdn.net/projects/mingw, you can continue to follow us there. MinGW: A native Windows port of the GNU Compiler Collection (GCC), freely distributable import libraries and header files for building native Windows applications; includes extensions to the MSVC runtime to support C99 functionality. All MinGW software can run on 64-bit Windows platforms.

Atom editor mac version download

Atom editor mac version download

The most popular open source editor