Nginx拒绝国外地址访问网站

• 上传Nginx安装文件和GeoIP数据库文件
• https://www.maxmind.com/en/accounts/632766/geoip/downloads IP数据库下载连接

[root@devonl ~]# cd /usr/local/src/

[root@devonl src]# ls

libmaxminddb-1.6.0.tar.gz  nginx-1.6.0.tar.gz  ngx_http_geoip2_module-master.zip  pcre-8.35.tar.gz  zlib-1.2.8.tar.gz

[root@devonl src]# cd /usr/share/GeoIP/

[root@devonl GeoIP]# ls

GeoIP.dat  GeoIP-initial.dat  GeoIPv6.dat  GeoIPv6-initial.dat  GeoLite2-City.mmdb  GeoLite2-Country.mmdb

• 解压所有压缩包文件

[root@devonl src]# tar xf libmaxminddb-1.6.0.tar.gz

[root@devonl src]# tar xf nginx-1.6.0.tar.gz

[root@devonl src]# tar xf pcre-8.35.tar.gz

[root@devonl src]# tar xf zlib-1.2.8.tar.gz

[root@devonl src]# unzip ngx_http_geoip2_module-master.zip

• 安装pcre、zlib、libmaxminddb、nginx

[root@devonl src]# cd pcre-8.35/

[root@devonl pcre-8.35]# ./configure

[root@devonl pcre-8.35]# make

[root@devonl pcre-8.35]# make install

[root@devonl pcre-8.35]# cd ..

[root@devonl src]# cd zlib-1.2.8/

[root@devonl zlib-1.2.8]# ./configure

[root@devonl zlib-1.2.8]# make

[root@devonl zlib-1.2.8]# make install

[root@devonl nginx-1.6.0]# cd ..

[root@devonl src]# cd libmaxminddb-1.6.0/

[root@devonl libmaxminddb-1.6.0]# ./configure

[root@devonl libmaxminddb-1.6.0]# make

[root@devonl libmaxminddb-1.6.0]# make install

[root@devonl libmaxminddb-1.6.0]# echo '/usr/local/lib' > /etc/ld.so.conf.d/geoip.conf

[root@devonl libmaxminddb-1.6.0]# ldconfig

[root@devonl libmaxminddb-1.6.0]# cd .. /nginx-1.6.0/

[root@devonl nginx-1.6.0]# ./configure --prefix=/usr/local/nginx --with-pcre=/usr/local/src/pcre-8.35 --with-zlib=/usr/local/src/zlib-1.2.8 --add-module=/usr/l

ocal/src/ngx_http_geoip2_module-master

[root@devonl nginx-1.6.0]# make

[root@devonl nginx-1.6.0]# make install

[root@devonl nginx]# ./sbin/nginx -V

nginx version: nginx/1.6.0

built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC)

configure arguments: --prefix=/usr/local/nginx --with-pcre=/usr/local/src/pcre-8.35 --with-zlib=/usr/local/src/zlib-1.2.8 --add-module=/usr/local/src/ngx_http_geoip2_module-master

• 在http字段里加入配置文件

    map $geoip2_data_country_code $allowed_country {

        CN no;

        default yes;

    }

 

    geoip2 /usr/share/GeoIP/GeoLite2-Country.mmdb {

      $geoip2_country_code country iso_code;

    }

    geoip2 /usr/share/GeoIP/GeoLite2-City.mmdb {

      $geoip2_data_country_code default=China source=$remote_addr country iso_code;

      $geoip2_data_country_name country names en;

      $geoip2_data_city_name city names en;

      $geoip2_data_province_name subdivisions 0 names en;

      $geoip2_data_province_isocode subdivisions 0 iso_code;

      $geoip2_continent_code continent code;

}

Server字段添加

        if ($allowed_country = yes) {

            return 403;

        }

• 配置IP测试服务，server字段中添加location字段

location /myip {

            default_type text/plain;

            return 200 "$remote_addr $geoip2_data_city_name $geoip2_country_code $geoip2_continent_code\n";

        }

[root@devonl nginx]# ./sbin/nginx -t

• 访问测试

新加坡地址访问403Forbidden

日本东京