6

I have an Nginx web server hosting two sites. I created a blockips.conf file to blacklist IP addresses that are constantly probing the server and included this file in the nginx.conf file. However in my access logs for the sites I still see these IP addresses showing up. Do I need to include the black list in each site's conf instead of the global conf for Nginx?

Here is my nginx.conf

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;

    keepalive_timeout  65;

    include /etc/nginx/conf.d/*.conf;
    # Load virtual host configuration files.
    include /etc/nginx/sites-enabled/*;

    # BLOCK SPAMMERS IP ADDRESSES
    include /etc/nginx/conf.d/blockips.conf;
}

blockips.conf

deny 58.218.199.250;

access.log still shows this IP address.

58.218.199.250 - - [27/Sep/2012:06:41:03 -0600] "GET http://59.53.91.9/proxy/judge.php HTTP/1.1" 403 570 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "-"

What am I doing incorrectly?

  • Why don't you block the ip's further up at your firewall rather than the application – Ben Lessani - Sonassi Sep 27 '12 at 20:39
  • @sonassi - I definitely could, but the web server should be able to do this as well. Just curious why it's not. – ProfessionalAmateur Sep 27 '12 at 20:41
  • Your lines include /etc/nginx/conf.d/*.conf; and include /etc/nginx/conf.d/blockips.conf; would lead to blockips.conf to be included twice. – max Jul 9 '18 at 11:41
5

Looking at your log, it IS blocking the traffic, there is a 403 header - ie. Access denied.

  • That makes sense, I was under the assumption I wouldnt even see it in the log. I see other 403 responses for unblocked IP's so I just assumed it was allowing access and failing later. – ProfessionalAmateur Sep 27 '12 at 20:49
  • 1
    Save your bandwidth and CPU time and block them with iptables . You should also look into Naxsi if you want to automate the process. – Ben Lessani - Sonassi Sep 27 '12 at 20:57
9

I would recommend to place your blacklist in iptables :) iptables -A INPUT -s 58.218.199.250 -j DROP That way you dont spend resources processing requests from unwanted ip addresses.

  • 1
    I upvoted as if you can this is the right approach, however I have nginx behind haproxy so that the source real ip address is that of the haproxy rather than the real ip addreess. – James Aug 30 '15 at 6:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.