Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Nginx web server hosting two sites. I created a blockips.conf file to blacklist IP addresses that are constantly probing the server and included this file in the nginx.conf file. However in my access logs for the sites I still see these IP addresses showing up. Do I need to include the black list in each site's conf instead of the global conf for Nginx?

Here is my nginx.conf

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/;

events {
    worker_connections  1024;

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;

    keepalive_timeout  65;

    include /etc/nginx/conf.d/*.conf;
    # Load virtual host configuration files.
    include /etc/nginx/sites-enabled/*;

    include /etc/nginx/conf.d/blockips.conf;



access.log still shows this IP address. - - [27/Sep/2012:06:41:03 -0600] "GET HTTP/1.1" 403 570 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "-"

What am I doing incorrectly?

share|improve this question
Why don't you block the ip's further up at your firewall rather than the application – Ben Lessani - Sonassi Sep 27 '12 at 20:39
@sonassi - I definitely could, but the web server should be able to do this as well. Just curious why it's not. – ProfessionalAmateur Sep 27 '12 at 20:41
up vote 3 down vote accepted

Looking at your log, it IS blocking the traffic, there is a 403 header - ie. Access denied.

share|improve this answer
That makes sense, I was under the assumption I wouldnt even see it in the log. I see other 403 responses for unblocked IP's so I just assumed it was allowing access and failing later. – ProfessionalAmateur Sep 27 '12 at 20:49
Save your bandwidth and CPU time and block them with iptables . You should also look into Naxsi if you want to automate the process. – Ben Lessani - Sonassi Sep 27 '12 at 20:57

I would recommend to place your blacklist in iptables :) iptables -A INPUT -s -j DROP That way you dont spend resources processing requests from unwanted ip addresses.

share|improve this answer
I upvoted as if you can this is the right approach, however I have nginx behind haproxy so that the source real ip address is that of the haproxy rather than the real ip addreess. – James Aug 30 '15 at 6:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.