If you have a list of these addresses in a file, you can try the following in Nginx config:
1 Define an IP group using geo directive (inside http block):
http {
...
geo $block {
default 0;
include blacklist;
}
...
}
It means that variable $block will be set to 0 by default.
2 Prepare a blacklist file to look like this:
192.168.0.0/24 1;
192.168.2.0/24 1;
10.0.0.0/8 1;
That is, set variable $block to 1 for these addresses.
3 Inside the `location' block, check this variable and report 500 error if it's 1:
if ($block = 1) {
return 500;
}
PS: The efficiency of this solution is arguable, since the connections from banned IPs are accept()ed and passed to the web server. However, if this tiny overhead is not critical for your host, I would rather do it with Nginx, not with iptables.