<html><head><meta http-equiv="Content-Security-Policy" content="script-src 'self'; img-src * cid: data:;"><style id="outgoing-font-settings">#response_container_BBPPID{font-family: initial; font-size:initial; color: initial;}</style></head><body style="background-color: rgb(255, 255, 255); background-image: initial; line-height: initial;"><div id="response_container_BBPPID" style="outline:none;" dir="auto" contenteditable="false"> <div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;">When I blocked IP space in the past using Nginx, it seemed to parse the request anyway. That is the blocking was very low level. The code from the OP will add to the "regular" 403s, which I create by hot link detection.</div><div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;"><br></div><div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;">I look at the 403s to insure it isn't some other bug (AKA my coding), so the IP space blocking could really increase the error report size. It is a bit off topic, but you really should look at hit linkers to determine if the website is of low reputation (spam or porn). </div><div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;"><br></div><div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width:100%;">Back to the OPs request, unless the OP lives in a data center, the question makes it appear to me like they are using a home server. I did that in the 90s, but the internet is a really nasty place to have your home IP internet facing. These VPSs are really cheap. I doubt I will ever use a hosting company again </div> <div name="BB10" id="response_div_spacer_BBPPID" dir="auto" style="width:100%;"> <br style="display:initial"></div> <div id="blackberry_signature_BBPPID" name="BB10" dir="auto"> <div id="_signaturePlaceholder_BBPPID" name="BB10" dir="auto"></div> </div></div><div id="_original_msg_header_BBPPID" dir="auto"> <table width="100%" style="background-color: white; border-spacing: 0px; display: table; outline: none;" contenteditable="false"><tbody><tr><td colspan="2" style="padding: initial; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"> <div style="border-right: none; border-bottom: none; border-left: none; border-image: initial; border-top: 1pt solid rgb(181, 196, 223); padding: 3pt 0in 0in; font-family: Tahoma, "BB Alpha Sans", "Slate Pro"; font-size: 10pt;"> <div id="from"><b>From:</b> nginx@nginx.org</div><div id="sent"><b>Sent:</b> April 13, 2019 9:36 AM</div><div id="to"><b>To:</b> nginx@nginx.org</div><div id="reply_to"><b>Reply-to:</b> nginx@nginx.org</div><div id="cc"><b>Cc:</b> peter_booth@me.com</div><div id="subject"><b>Subject:</b> Re: [no subject]</div></div></td></tr></tbody></table> <br> </div><!--start of _originalContent --><div name="BB10" dir="auto" style="background-image: initial; line-height: initial; outline: none;" contenteditable="false"><div id="ssc11718"><style id="outgoing-font-settings">#ssc11718 #response_container_BBPPID{font-family: initial;font-size: initial;color: initial;}</style><style>#ssc11718 #ssc11652 p.MsoNormal,#ssc11718 #ssc11652 li.MsoNormal,#ssc11718 #ssc11652 div.MsoNormal{margin: 0in;margin-bottom: 1E-4pt;font-size: 11pt;font-family: "Calibri", sans-serif;}#ssc11718 #ssc11652 a:link,#ssc11718 #ssc11652 span.MsoHyperlink{color: blue;text-decoration: underline;}#ssc11718 #ssc11652 a:visited,#ssc11718 #ssc11652 span.MsoHyperlinkFollowed{color: rgb(149, 79, 114);text-decoration: underline;}</style><div dir="auto"></div>I don’t think it’s a dumb question at all. It’s a very astute question.<div><br></div><div>My experience of protecting a high traffic retail website from a foreign state-sponsored DDOS was that doing IP blocking on a hardware load bakancer in front of the nginx tier was the difference between the site bring available and the site being down on an unusually busy day. The economic impact of having both nginx and the load balancer working in concert saved millions of dollars revenue in one busy day. The load balancer (well it was the WAF module in an F5 BigIP) was doing what could have equally been done in a firewall. With F5’s acquisition of nginx we might see innovative ways of combining the best hardware and software ADC solutions to build rock solid websites.<div><br></div><div>Anything you can do to protect your backend helps your website stay alive, whether it’s browser caching, CDN, firewall, hardware load balancer, before getting to nginx. Then if nginx has intelligent caching rules you can build a site that sustained enormous bursts of traffic and stays up. Nginx is like a Swiss Army knife of http that can do so many different things - but that doesn’t mean it’s right to expect that it does everything.</div><div><br></div><div>Peter<br><br><div id="AppleMailSignature" dir="ltr">Sent from my iPhone</div><div dir="ltr"><br>On Apr 12, 2019, at 10:57 PM, lists <<a href="mailto:lists@lazygranch.com">lists@lazygranch.com</a>> wrote:<br><br></div><blockquote type="cite"><div dir="ltr"><div id="response_container_BBPPID" style="outline:none" dir="auto"> <div id="BB10_response_div_BBPPID" dir="auto" style="width:100%"> Perhaps a dumb question, but if all you are going to do is return a 403, why not just do this filtering in the firewall by blocking the offending IP space. Yeah I know a server should always have some response, but it isn't like you would be the first person to just block entire countries. (I don't do this on 80/443, but I do block most email ports outside the US.) </div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%"><br></div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%">The only reason I mention this is Nginx blocking is more CPU intensive than the firewall. On a small VPS, you might notice the difference in loadomg.</div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%"><br></div> <div id="response_div_spacer_BBPPID" dir="auto" style="width:100%"> <br></div> <div id="blackberry_signature_BBPPID" dir="auto"> <div id="_signaturePlaceholder_BBPPID" dir="auto"></div> </div></div><div id="_original_msg_header_BBPPID" dir="auto"> <table width="100%" style="background-color:white;border-spacing:0px;display:table;outline:none"><tbody><tr><td colspan="2" style="background-color:rgb( 255 , 255 , 255 )"> <div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb( 181 , 196 , 223 );padding:3pt 0in 0in;font-family:'tahoma' , 'bb alpha sans' , 'slate pro';font-size:10pt"> <div id="from"><b>From:</b> <a href="mailto:softwareinfojam@gmail.com">softwareinfojam@gmail.com</a></div><div id="sent"><b>Sent:</b> April 12, 2019 7:24 PM</div><div id="to"><b>To:</b> <a href="mailto:nginx@nginx.org">nginx@nginx.org</a></div><div id="reply_to"><b>Reply-to:</b> <a href="mailto:nginx@nginx.org">nginx@nginx.org</a></div><div id="subject"><b>Subject:</b> </div></div></td></tr></tbody></table> <br> </div><div dir="auto" style="outline:none"><div id="ssc11652"><div><div class="WordSection1"><p class="MsoNormal">Hi All</p><p class="MsoNormal">I have implemented GEO IP blocking which is working just fine. I have the settings you see below. </p><p class="MsoNormal"> </p><p class="MsoNormal"> map $geoip_country_code $country_access {<!-- --></p><p class="MsoNormal"> "US" 0;</p><p class="MsoNormal"> default 1;</p><p class="MsoNormal"> }</p><p class="MsoNormal"> </p><p class="MsoNormal"> server {<!-- --></p><p class="MsoNormal"> if ($country_access = '1') {<!-- --></p><p class="MsoNormal"> return 403;</p><p class="MsoNormal"> }</p><p class="MsoNormal"> </p><p class="MsoNormal">I notice though that in the logs, the internal IP Addresses are not tagged with a country code so internal subnets are getting blocked. Would the correct solution be to enter the subnets manually such as this config below? Or is there a better solution? Oh by the way, I did try this below and it didn’t work. Trying to keep the Geographical blocking but allow some IP ranges. Any ideas on how to do this? Any help would be appreciated.</p><p class="MsoNormal"> </p><p class="MsoNormal"> map $geoip_country_code $country_access {<!-- --></p><p class="MsoNormal"> "US" 0;</p><p class="MsoNormal"> <b>‘<wbr><a href="http://192.168.1.0/24">192.168.1.0/24</a><wbr>’ 0</b>;</p><p class="MsoNormal"> default 1;</p><p class="MsoNormal"> }</p><p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal">Regards</p><p class="MsoNormal">SI</p><p class="MsoNormal"> </p><p class="MsoNormal"> </p></div></div></div></div></div></blockquote><blockquote type="cite"><div dir="ltr">_______________________________________________<br>nginx mailing list<br><a href="mailto:nginx@nginx.org">nginx@nginx.org</a><br><a href="http://mailman.nginx.org/mailman/listinfo/nginx">http://mailman.nginx.org/mailman/listinfo/nginx</a></div></blockquote></div></div></div><!--end of _originalContent --></div></body></html>