2

I'd like to block IPs with geoip except whitelisted countries AND the local area network. The first part works flawless, the second one not. Somwehere searching the internet I found the codes LH (local host) and LN (local network), but they are both not working.

I'm using the standard howto code for the blocking.

The relevant http {} part in nginx.conf:

geoip_country /usr/share/GeoIP/GeoIP.dat;
   map $geoip_country_code $allowed_country {
    default no;                              
    US yes;
   }

The relevant server {} part in sites-available/default:

block countries
      if ($allowed_country = no) {
        return 444;
      }

Any suggestions would be much appreciated!

Update:

$geoip_country_code variable returns "-" on LAN IP access, but adding "- yes;" to the geoip_county block doesn't work either.

  • You could just log what's in $geoip_country_code variable when you access nginx from local network. Then just add this value to map directive. – Alexey Ten Mar 28 '14 at 17:40
  • If you used the access logs, then the "-" value you mentioned is used to indicate missing data (see NCSA Common log format). – Silveri Oct 30 '18 at 10:12
4

I found a solution - no idea if it's 'clean'. Just overwrite the $allowed_country variable if a lan IP condition was matched before.

geo $lan-ip {
default no;
192.168.1.0/24 yes;
}

and this block before the "#block countries" part

if ($lan-ip = yes) {
set $allowed_country yes;
}

| improve this answer | |
0

You could also do the following:

map $geoip_country_code $allowed_country {
    default no;
    '' yes;
    US yes;
}

Although it won't just apply to LAN/private network IP addresses, but to all addresses that aren't handled by your GeoIP database.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.