https://github.com/Vasfed/nginx_ipset_blacklist

nginx module to use linux netfilter ipsets as blacklists
https://github.com/Vasfed/nginx_ipset_blacklist

ipset nginx nginx-module

Last synced: 3 months ago
JSON representation

nginx module to use linux netfilter ipsets as blacklists

• Host: GitHub
• URL: https://github.com/Vasfed/nginx_ipset_blacklist
• Owner: Vasfed
• Created: 2010-10-22T15:49:35.000Z (over 13 years ago)
• Default Branch: master
• Last Pushed: 2016-04-16T01:21:14.000Z (about 8 years ago)
• Last Synced: 2024-01-20T15:42:32.499Z (5 months ago)
• Topics: ipset, nginx, nginx-module
• Language: C
• Homepage:
• Size: 99.6 KB
• Stars: 41
• Watchers: 4
• Forks: 18
• Open Issues: 2
• Metadata Files:
  • Readme: README.rdoc

Lists

• awesome-nginx - nginx_ipset_blacklist - nginx module to use linux netfilter ipsets as blacklists. (Third Party Modules / C Modules)
• awesome-nginx - nginx_ipset_blacklist - nginx module to use linux netfilter ipsets as blacklists. (Third Modules / C Modules)

README

        
== nginx_ipset_blacklist

An nginx module for using netfilter ipsets as a black/white list.

In comparison to standard nginx access module this allows for dynamic list updating, without nginx reload/restart.

== Installation

* Get youself a linux server with root access

* Install ipset 4.4 (see http://ipset.netfilter.org/install.html)

* Get nginx source code, unpack etc.

* Install libssl-dev, pcre and other nginx requirements

* Configure nginx with this module:

    ./configure --with-module=/path/to/nginx_ipset_blacklist

* Compile, install

* Configure nginx to run workers as root (this is needed to allow access to ipsets)

* Create yout ipset and add some 'offending' ips to it:

    sudo ipset -N myblacklist iphash

    sudo ipset -A myblacklist 127.0.0.1

* Start nginx

* Profit!

== Usage

Sample nginx config:

    user root;

    worker_processes  1;

    

    events {

      worker_connections  1024;

    }

    

    http {

      blacklist "myblacklist";

      include       mime.types;

      default_type  application/octet-stream;

      

      server {

        # your server configuration goes here

      }

      

      server {

        whitelist "my_whitelist"; # this server will not use global blacklist, but instad use local whitelist

        ...

      }

    }

For blocked ips server will respond with 403 error to any request.

== Author

nginx_ipset_blacklist was written by Vasily Fedoseyev aka Vasfed