What's the best way to block URLs in nginx?

Question

We are getting an unusually heavy amount of traffic for a few URLs, ex:

http://www.example.com/search.php?type=0&mode=search&searchterm=Little

http://www.example.com/product.php?productid=12345678

What's the best way to block these URLs in nginx?

Any other suggestions to limit the amount of connections per second/minute for specific pages?

Answer 1

If the incoming traffic is truly unusual and you are confident in saying that the traffic is spam, consider blocking it at your firewall. The lower in the stack that you can deny the traffic, the better. For example iptables -A INPUT -s 1.1.1.1 -j DROP. Of course, replace 1.1.1.1 with the IP address in question.

A broader tool to secure your server from suspicious incoming connections would be fail2ban. There are also rules that you can make that are specific to Nginx. Fail2ban protects you from many different attacks and isn't just a solution to your specific question.

For a solution specific to Nginx, it comes with a module named ngx_http_access_module that allows you to allow or deny access based on IP address. You would open nginx.conf and add include blockips.conf; Then create blockips.conf in wherever your Nginx configuration files are. Likely it's /usr/local/nginx/conf/. Finally, add deny configurations as desired:

deny 1.1.1.1;
deny 2.2.2.0/24;
deny 3.3.0.0/16;

Answer 2

Using the same principle from, http://www.sonassi.com/knowledge-base/maintenance-page-with-nginx-with-specific-permitted-access/ and http://wiki.nginx.org/HttpLimitReqModule

The following code would allow you to ban specific IPs from accessing those URLs and also rate limit anyone else trying to access those URLs.

http {
...
limit_req_zone  $binary_remote_addr  zone=one:10m   rate=1r/s;
...
server {
..
 set $deny_access off;

  if ($remote_addr ~ (bad.ip.add.ress|second.bad.ipadd.ress|third.bad.ipadd.ress)) {
   set $deny_access on;
  }
  if ($uri ~ "^/(search\.php|product\.php)\?(type=[0-9]+&mode=[a-z]+searchterm=(.*)+|productid=[0-9]+)$" ) {
   limit_req   zone=one  burst=5;
   set "${$deny_access}on";
  }
  if ($deny_access = onon) {
   return 503;
  }
  location /deny_access{
  }
  error_page 503 @deny_access;
  location @deny_access {
   rewrite ^(.*)$ /deny.html break;
 }
..
}
..
}

Answer 3

http://nginx.org/en/docs/http/ngx_http_rewrite_module.html#return : «… In addition, the non-standard code 444 closes a connection without sending a response header. …»

— So you just define those specific locations and use return 444 there.

Any other suggestions to limit the amount of connections per second/minute for specific pages?

mgorven has pointed you at already.

Answer 4

You can also use the limit_req module to limit the rate at which each source IP can access certain paths.