Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Nginx web server hosting two sites. I created a blockips.conf file to blacklist IP addresses that are constantly probing the server and included this file in the nginx.conf file. However in my access logs for the sites I still see these IP addresses showing up. Do I need to include the black list in each site's conf instead of the global conf for Nginx?

Here is my nginx.conf

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;

    keepalive_timeout  65;

    include /etc/nginx/conf.d/*.conf;
    # Load virtual host configuration files.
    include /etc/nginx/sites-enabled/*;

    # BLOCK SPAMMERS IP ADDRESSES
    include /etc/nginx/conf.d/blockips.conf;
}

blockips.conf

deny 58.218.199.250;

access.log still shows this IP address.

58.218.199.250 - - [27/Sep/2012:06:41:03 -0600] "GET http://59.53.91.9/proxy/judge.php HTTP/1.1" 403 570 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "-"

What am I doing incorrectly?

share|improve this question
    
Why don't you block the ip's further up at your firewall rather than the application –  MageStackDay Needs You ... Sep 27 '12 at 20:39
    
@sonassi - I definitely could, but the web server should be able to do this as well. Just curious why it's not. –  ProfessionalAmateur Sep 27 '12 at 20:41

2 Answers 2

up vote 3 down vote accepted

Looking at your log, it IS blocking the traffic, there is a 403 header - ie. Access denied.

share|improve this answer
    
That makes sense, I was under the assumption I wouldnt even see it in the log. I see other 403 responses for unblocked IP's so I just assumed it was allowing access and failing later. –  ProfessionalAmateur Sep 27 '12 at 20:49
1  
Save your bandwidth and CPU time and block them with iptables . You should also look into Naxsi if you want to automate the process. –  MageStackDay Needs You ... Sep 27 '12 at 20:57

I would recommend to place your blacklist in iptables :) iptables -A INPUT -s 58.218.199.250 -j DROP That way you dont spend resources processing requests from unwanted ip addresses.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.