Reading nginx's ngx_http_access_module's documentation, I came across this:

In case of a lot of rules, the use of the ngx_http_geo_module module variables is preferable.

How can I use allow/deny with the geo module? If I do this:

geo $listofips {
    default 0; 1;

server {
    # [...]
    allow $listofips;
    deny all;

It gives me the following error:

invalid parameter "$listofips" in /path/to/config:97

How can I use the geo module for access control? I cannot use ifs, because it evidently breaks try_files (see nginx's IfIsEvil).

  • It's a common misconception that if is evil anywhere within your Nginx config. I'm not sure why because their own "If is evil" page makes it clear that it's only evil within location blocks. To quote the docs "In some cases, it’s also possible to move ifs to server level (where it’s safe as only other rewrite module directives are allowed within it)."
    – miknik
    Commented Jun 17, 2018 at 18:01

1 Answer 1


Without the use of IF I'm sure this is not possible at the time that this answer was written.

So in this case would look like this:

geo $trusted_user {
    default 0; 1;

    if ( $trusted_user = 0 ) {
        return 403;

Send a suggestion to team NGINX in: https://www.nginx.com/

This question was answered based on this response: NGINX - conditionally allow or deny IP

Search source "# try_files wont work due to if" in "Examples": https://www.nginx.com/resources/wiki/start/topics/depth/ifisevil/#examples

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .