How to use Nginx to implement IP address-based access control

How to use Nginx to implement access control based on IP address

Introduction:
In network security, access control through IP address is a common way. As a high-performance web server, Nginx also provides corresponding modules to support access control based on IP address. This article will introduce how to use Nginx to implement IP address-based access control, and attach corresponding code examples.

1. Nginx access control module
Nginx provides many modules to implement different functions. Of course, to implement IP address-based access control, we need to use the Nginx access control module. There are two commonly used Nginx access control modules:

1. ngx_http_access_module: This module can control access rights to the client through the configuration file, and can allow or deny access to certain IP addresses or IP address segments. .
2. ngx_http_geo_module: This module can perform access control based on the client's geographical location information, and can allow or deny access to certain specific areas.

The following describes how to use these two modules.

2. Use ngx_http_access_module to implement IP address-based access control
ngx_http_access_module module can implement IP address-based access by adding allow and deny directives in the http, server or location configuration block in the Nginx configuration file control.

For example, if we want to allow the client with the IP address 192.168.0.1 to access the server, and deny the client with the IP address 192.168.0.2 to access the server, we can configure it as follows:

http {
  server {
    listen       80;
    server_name  localhost;
    
    location / {
      deny 192.168.0.2;
      allow 192.168.0.1;
      deny all;
    }
  }
}

In the above configuration, the deny directive is used to deny access to certain IP addresses, while the allow directive is used to allow access to certain IP addresses. deny all means that except for the IP addresses in the allow list, other IP addresses will be denied.

3. Use ngx_http_geo_module to implement IP address-based access control
ngx_http_geo_module module can implement IP address-based access control by adding the geo directive and geoip_country directive in the http, server or location configuration block in the Nginx configuration file Access control.

First, you need to use the geoip_country directive in the http block of the configuration file to load the IP geographical location database file, for example:

http {
  geoip_country /path/to/GeoIP.dat;
}

Then, use the geo directive in the corresponding server or location configuration block. Match the country corresponding to the IP address and perform access control as needed. For example, if we want to only allow IP addresses from mainland China to access the server, we can configure it in the following way:

http {
  server {
    listen       80;
    server_name  localhost;
    
    location / {
      geo $country {
          default 0;
          CN 1;
      }
      
      if ($country = 0) {
          return 403;
      }
    }
  }
}

In the above configuration, the geo directive is used to obtain the corresponding country code based on the IP address, and the $country variable That is the obtained country code. if ($country = 0) means that if the obtained country code is 0 (indicating an IP address other than mainland China), a 403 error page will be returned.

Conclusion:
Through Nginx’s access control module, we can easily implement access control based on IP address. Through reasonable configuration, the security and stability of the server can be improved and the server can be protected from access by bad IP addresses. I hope this article will help you understand and use Nginx's access control module. Thank you for reading.

Reference materials:

1. Nginx official documentation: http://nginx.org/en/docs/http/ngx_http_access_module.html
2. Nginx official documentation: http ://nginx.org/en/docs/http/ngx_http_geo_module.html

The above is the detailed content of How to use Nginx to implement IP address-based access control. For more information, please follow other related articles on the PHP Chinese website!