Deny IP blocks with exceptions - help with configs

[svieweng]

Hi,

I am trying to solve an issue, and I think NGINX is the right solution
as we already use it as our frontend proxy.

The problem is this:  we have several domains that are pointed to the
same thing.  We need to block/deny a group of subnets. There is an
exception to this: if the client comes in pointing at a specific domain,
then we should pass him/her even if the originating IP block is normally
denied.

First, lets call this domain.com, and lets add a.domain.com,
b.domain.com, and c.domain.com.
a.domain.com should accept all clients from any IP range.
{b|c}.domain.com, *.domain.com, 86.75.3.09, and
other.someone-elses-domain.net should pass everything except the
netblocks listed in the include file "blockips.conf"

What is currently happening, is that using the below config template,
all traffic is flowing to all domains, regardless of originating
netbock.   I have tried various orders, and different configs entirely. 
And the result is the same for different reasons - either it blocks
everything, the config is bad and wont load, or it passes everything. 
Any help on this is greatly appreciated.

This is what I did (names changed to protect the innocent):

I created a file called /etc/nginx/blockips.conf

#----BEGIN blockips.conf

deny 1.1.0.0/16;
deny 2.2.0.0/16;
deny 3.3.0.0/16;
deny 4.4.0.0/16;

#----END blockips.conf

#----BEGIN nginx.conf

upstream prod-a  {

server 10.1.1.10; 
}

upstream prod-b {
ip_hash;
server 10.1.1.10;
}

server {

large_client_header_buffers 4 16k;
proxy_buffer_size 16k;
proxy_buffers 8 16k;
proxy_busy_buffers_size 32k;
proxy_intercept_errors on;
proxy_buffering         on;
proxy_temp_path         /my/nginx/temp;

listen 80;
server_name a.domain.com;

location / {
                proxy_pass http://prod-a;
                proxy_set_header        X-Real-IP $remote_addr;
                proxy_set_header        X-Forwarded-For
$proxy_add_x_forwarded_for;
                proxy_set_header        Host $http_host;

}
}

server {

large_client_header_buffers 4 16k;
proxy_buffer_size 16k;
proxy_buffers 8 16k;
proxy_busy_buffers_size 32k;
proxy_intercept_errors on;
proxy_buffering         on;
proxy_temp_path         /my/nginx/temp;

listen 80;
server_name b.domain.com.com c.domain.com.com *.domain.com 86.75.3.09
other.someone-elses-domain.net ;

location / {
                include blockips.conf;
                proxy_pass http://prod-b;
                proxy_set_header        X-Real-IP $remote_addr;
                proxy_set_header        X-Forwarded-For
$proxy_add_x_forwarded_for;
                proxy_set_header        Host $http_host;

}
}

#----END nginx.conf

Posted at Nginx Forum: http://forum.nginx.org/read.php?2,118355,118355#msg-118355