Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to block and redirect all traffic to a website. Is this the correct way to do it?

EDIT: I would like to block some ranges of IPs and redirect them to a URL.

EDIT: By blocking in nginx does this prevent ALL access to backend Apache so it no longer gets hit?

server {
          error_log /var/log/nginx/vhost-error_log warn;
          listen 1.2.3.4:80;
          server_name domain.com www.domain.com;
          access_log /usr/local/apache/domlogs/domain.com-bytes_log bytes_log;
          access_log /usr/local/apache/domlogs/domain.com combined;
          root /home/user/public_html;
          location / {
                deny 220.181.0.0/16;
                deny 124.115.0.0/16;
                deny 1.202.0.0/16;
                deny 208.115.0.0/16;
                deny 199.58.0.0/16;
                deny 220.181.0.0/16;
                deny 124.115.0.0/16;
                deny 83.149.0.0/16;
                deny 178.77.0.0/16;
                deny 65.55.0.0/16;
                deny 123.125.0.0/16;
                deny 82.128.0.0/16;
                deny 157.55.0.0/16;
                deny 199.0.0.0/8;
                deny 212.90.0.0/16;
          location ~.*\.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|html|htm|txt|js|css|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso)$ {
          expires 1d;
          try_files $uri @backend;
          }
          error_page 405 = @backend;
          add_header X-Cache "HIT from Backend";
          proxy_pass http://1.2.3.4:8081;
          include proxy.inc;
          }
          location @backend {
          internal;
          proxy_pass http://1.2.3.4:8081;
          include proxy.inc;
          }
          location ~ .*\.(php|jsp|cgi|pl|py)?$ {
          proxy_pass http://1.2.3.4:8081;
          include proxy.inc;
          }
          location ~ /\.ht {
          deny all;
          }
        }
share|improve this question
    
It looks obvious what you are trying to do for the IP addresses you want to redirect to a different URL. But what do you want to happen for the blocked IP addresses? Do you want them to get no response at all as if nothing is there? Do you want them to get a connection refused as if a server machine is not running a web server? Do you want them to get a specific faked HTTP error? –  Skaperen Feb 27 '13 at 23:09
add comment

1 Answer

What does "block and redirect" mean to you? Your posted config doesn't do either. It selectively blocks a set of specific requesting cidrs, but certainly not "all". The ones it doesn't block it serves from /home/user/public_html if the uri matches some suffixes, otherwise it forwards the request to some backend via proxy_pass. It will deny everyone requesting a uri that matches /.ht.

If you wish to redirect you can use the return directive to return a 301 or 302 status and the target url you wish to redirect too.

To simply block everything say:

location ^~ / {
  deny all;
}

Or just turn off your webserver :)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.