<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Dont.<div class=""><br class=""></div><div class="">You should let every tier do it’s job. Just because nginx has geoid functionality doesn’t mean that you should use it.</div><div class="">If you are lucky enough to have hardware load balancer in front of nginx then do the blocking there, so you reduce the</div><div class="">load on your nginx. The Golden Rule of keeping websites up is “Protect the back-end.” </div><div class="">The best way to do that is to handle the request as soon as possible:</div><div class=""><br class=""></div><div class="">1 browser cache</div><div class="">2 CDN</div><div class="">3 load balancer</div><div class="">4 nginx reverse caching proxy</div><div class="">5 backend dynamic systems</div><div class=""><br class=""></div><div class="">Any request that gets to level 4 that could hav been handled by level 1, 2, or 3 is just dumb.</div><div class=""><br class=""></div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 24 May 2018, at 9:57 AM, Sathish Kumar <<a href="mailto:satcse88@gmail.com" class="">satcse88@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="auto" class="">Hi,<div dir="auto" class="">The client is already sending the X-Forwarded-For but when it received on server it has multiple ips, how we can filter only the 1st IP and pass it to geo ip module to block the IP based on Country.</div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="">On Thu, May 24, 2018, 11:25 AM Frank Liu <<a href="mailto:gfrankliu@gmail.com" target="_blank" rel="noreferrer" class="">gfrankliu@gmail.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="">Since only load balancer sees the client IP, it has to pass that information to nginx. You need to talk to your LB engineer and depending on the type of LB, there are different ways to do that. Once the information is passed to nginx, nginx will expose it as a variable, which can then be used by the geoip2 module to do the lookup and create country code for you to use for blocking.<br class=""></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Wed, May 23, 2018 at 6:51 PM, Sathish Kumar <span dir="ltr" class=""><<a href="mailto:satcse88@gmail.com" rel="noreferrer noreferrer" target="_blank" class="">satcse88@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto" class=""><span style="font-family: helvetica; font-size: inherit;" class="">How can I get the client IP address if the request is coming through load balancer or Proxy and pass it to default nginx geoip module to block it based on the Country.</span><br class=""></div><div class="m_-8510576873092392174m_-1028795640436308476HOEnZb"><div class="m_-8510576873092392174m_-1028795640436308476h5"><br class=""><div class="gmail_quote"><div dir="ltr" class="">On Tue, May 22, 2018, 4:45 PM Frank Liu <<a href="mailto:gfrankliu@gmail.com" rel="noreferrer noreferrer" target="_blank" class="">gfrankliu@gmail.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class=""><div dir="auto" class="">Instead of the default nginx geoip module , I suggest you switch to third party geoip2 module for two reasons:</div><div dir="auto" class="">1) maxmind deprecated geoip1 db.</div><div dir="auto" class="">2)geoip2 module can do what you wanted, and the geo lookup can be based on any variables, such as $http_x_forwarded_for</div><div dir="auto" class=""> Frank</div><br class=""><div class="gmail_quote"><div class="">On Mon, May 21, 2018 at 6:37 PM Sathish Kumar <<a href="mailto:satcse88@gmail.com" rel="noreferrer noreferrer noreferrer" target="_blank" class="">satcse88@gmail.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto" class="">Hi All,<div dir="auto" class=""><br class=""></div><div dir="auto" class="">Is there a way, I can block the clients which is coming through load balancer using http geo ip module nginx.</div><div dir="auto" class=""><br class=""></div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">Currently, I can block the clients which is not coming through load balancer or api gateway by geo ip module.</div><div dir="auto" class=""><br class=""></div><div dir="auto" class=""><br class=""></div><div dir="auto" class=""><br class=""></div></div><br class=""><div class="gmail_quote"><div class="">On Mon, May 21, 2018, 2:02 PM basti <<a href="mailto:mailinglist@unix-solution.de" rel="noreferrer noreferrer noreferrer" target="_blank" class="">mailinglist@unix-solution.de</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">hello,<br class="">
the way to block ip's can also be used for PTR records, I think.<br class="">
Also as wildcard.<br class="">
<br class="">
On 21.05.2018 05:49, Sathish Kumar wrote:<br class="">
> Hi All,<br class="">
> <br class="">
> I have a requirement to block certain countries coming to our website. <br class="">
> I managed to achieved it using the ngx_http_geoip_module. I have a<br class="">
> problem now, if the request comes through Amazon API Gateway, how can I<br class="">
> read the X-forwarded-for header or block these request too.<br class="">
> <br class="">
> nginx.conf<br class="">
> map $geoip_country_code $allow_country {<br class="">
> default yes; <br class="">
> SG no; <br class="">
> }<br class="">
> <br class="">
> <br class="">
> geoip_country /etc/nginx/GeoIP.dat; # the country IP database <br class="">
> geoip_city /etc/nginx/GeoLiteCity.dat; # the city IP database<br class="">
> <br class="">
> <br class="">
> domain.conf<br class="">
> if ($allow_country = no) { <br class="">
> return 444; <br class="">
> }<br class="">
> <br class="">
> Thanks & Regards<br class="">
> Sathish.V<br class="">
> <br class="">
> <br class="">
> _______________________________________________<br class="">
> nginx mailing list<br class="">
> <a href="mailto:nginx@nginx.org" rel="noreferrer noreferrer noreferrer noreferrer" target="_blank" class="">nginx@nginx.org</a><br class="">
> <a href="http://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer noreferrer noreferrer noreferrer noreferrer" target="_blank" class="">http://mailman.nginx.org/mailman/listinfo/nginx</a><br class="">
> <br class="">
_______________________________________________<br class="">
nginx mailing list<br class="">
<a href="mailto:nginx@nginx.org" rel="noreferrer noreferrer noreferrer noreferrer" target="_blank" class="">nginx@nginx.org</a><br class="">
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer noreferrer noreferrer noreferrer noreferrer" target="_blank" class="">http://mailman.nginx.org/mailman/listinfo/nginx</a></blockquote></div>
_______________________________________________<br class="">
nginx mailing list<br class="">
<a href="mailto:nginx@nginx.org" rel="noreferrer noreferrer noreferrer" target="_blank" class="">nginx@nginx.org</a><br class="">
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer noreferrer noreferrer noreferrer" target="_blank" class="">http://mailman.nginx.org/mailman/listinfo/nginx</a></blockquote></div></div>
_______________________________________________<br class="">
nginx mailing list<br class="">
<a href="mailto:nginx@nginx.org" rel="noreferrer noreferrer noreferrer" target="_blank" class="">nginx@nginx.org</a><br class="">
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer noreferrer noreferrer noreferrer" target="_blank" class="">http://mailman.nginx.org/mailman/listinfo/nginx</a></blockquote></div>
</div></div><br class="">_______________________________________________<br class="">
nginx mailing list<br class="">
<a href="mailto:nginx@nginx.org" rel="noreferrer noreferrer" target="_blank" class="">nginx@nginx.org</a><br class="">
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer noreferrer noreferrer" target="_blank" class="">http://mailman.nginx.org/mailman/listinfo/nginx</a><br class=""></blockquote></div><br class=""></div>
_______________________________________________<br class="">
nginx mailing list<br class="">
<a href="mailto:nginx@nginx.org" rel="noreferrer noreferrer" target="_blank" class="">nginx@nginx.org</a><br class="">
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer noreferrer noreferrer" target="_blank" class="">http://mailman.nginx.org/mailman/listinfo/nginx</a></blockquote></div>
_______________________________________________<br class="">nginx mailing list<br class=""><a href="mailto:nginx@nginx.org" class="">nginx@nginx.org</a><br class="">http://mailman.nginx.org/mailman/listinfo/nginx</div></blockquote></div><br class=""></div></body></html>