1

I've noticed in my nginx access.log entries like this:

XX.XX.XX.XX - - [05/Jan/2017:00:21:43 +0100] "GET / HTTP/1.1" 301 178 "-" "libwww-perl/6.05"

This is weird because i've implemented GeoIP blocking in nginx, so only IP Adresses from my country and local network have access to my server. Other IPs should be "blocked" with HTTP status code 444. This GeoIP implementation should work, because I've tested it multiple times.

But why does nginx return 301 to this foreign IP Adress (not in my country)?

This is my nginx configuration:

server {
    listen 80;
    server_name example.com;

    # enforce https
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name example.com;

    if ($lan-ip = yes) {
        set $allowed_country yes;
    }

    if ($allowed_country = no) {
        return 444;
    }

    root /var/www/html;

    # SSL Configuration
    # .
    # .
    # .
}

This is the GeoIP blocking party in nginx.conf:

geoip_country /usr/share/GeoIP/GeoIP.dat;

map $geoip_country_code $allowed_country {
    default no;
    DE yes;
}

geo $lan-ip {
    default no;
    192.168.0.0/24 yes;
}
  • 1
    How is your GeoIP blocking implemented exactly? Have you checked the IP in question against exactly the same database you use for blocking? – Steffen Ullrich Jan 9 '17 at 11:23
  • I added the GeoIP blocking part of nginx.conf in the question! How can I check if the IP address is not in my country according to my local GeoIP database? The GeoIP database has the .dat extension. – PatrickMA Jan 9 '17 at 11:26
  • Check out unix.stackexchange.com/questions/7399/… and the documentation from the distributor of your database (probably maxmind) for how to query the database. And note that the database is not fully reliable. My guess is that nothing is wrong with your configuration but that the database reports this IP to be in your country. – Steffen Ullrich Jan 9 '17 at 11:34
  • 1
    So you've checked against exactly the same database as your nginx uses? Since different providers have different databases with different errors it will not help if you checked against some other database. – Steffen Ullrich Jan 9 '17 at 11:46
  • 1
    An http request will hit the first server block. Your GeoIP blocking is only applied after the 301 redirect, which is consistent with the logfile entry in your question. – Richard Smith Jan 9 '17 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.