openresty如何禁止海外ip访问
前几天，我有一个徒弟问我，如何禁止海外ip访问他的网站系统？操作系统采用的是centos7.9，发布服务采用的是openresty。通过日志他发现，有很多类似以下数据
{"host":"172.30.7.95","clientip":"122.189.224.120","size":1818,"responsetime":2025-05-27T14:28:53,"http_host":"www.pingan.com","url":"/401.html","agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","country_code":"CN","country_name":"China","city_name":"-","status":"401"}
{"host":"172.30.7.95","clientip":"199.204.97.58","size":154,"responsetime":2025-05-27T14:29:01,"http_host":"_","url":"-","agent":"-","country_code":"US","country_name":"United States","city_name":"-","status":"400"}
{"host":"172.30.7.95","clientip":"122.189.224.28","size":1818,"responsetime":2025-05-27T14:29:16,"http_host":"lsw-fast.lenovo.com.cn","url":"/401.html","agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","country_code":"CN","country_name":"China","city_name":"-","status":"401"}
{"host":"172.30.7.95","clientip":"204.76.203.219","size":1818,"responsetime":2025-05-27T14:29:22,"http_host":"116.62.152.21","url":"/401.html","agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46","country_code":"NL","country_name":"The Netherlands","city_name":"-","status":"401"}
{"host":"172.30.7.95","clientip":"43.133.253.253","size":1818,"responsetime":2025-05-27T14:28:48,"http_host":"www.anxundata.com","url":"/401.html","agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1","country_code":"KR","country_name":"South Korea","city_name":"-","status":"401"}
{"host":"172.30.7.95","clientip":"43.133.253.253","size":1818,"responsetime":2025-05-27T14:28:48,"http_host":"www.anxundata.com","url":"/401.html","agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1","country_code":"KR","country_name":"South Korea","city_name":"-","status":"401"}
{"host":"172.30.7.95","clientip":"42.83.147.54","size":587,"responsetime":2025-05-27T14:33:12,"http_host":"anxundata.com","url":"/index.html","agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)Chrome/74.0.3729.169 Safari/537.36","country_code":"CN","country_name":"China","city_name":"-","status":"200"}
{"host":"172.30.7.95","clientip":"45.82.255.188","size":1818,"responsetime":2025-05-27T14:36:35,"http_host":"anxundata.com","url":"/401.html","agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36","country_code":"CY","country_name":"Cyprus","city_name":"-","status":"401"}我看过数据之后，直接给出答案使用geoip2模块与GeoLite2的ip库匹配禁止访问就行。下面就是geoip2模块与GeoLite2的ip库安装步骤(以下步骤是基于openresty已经安装成功的操作手法)。
一、增加依赖
yum install -y geoip-devel libmaxminddb-devel二、geoip2模块安装
wget https://github.com/leev/ngx_http_geoip2_module/archive/refs/tags/3.4.tar.gz #下载geoip2模块
tar -zxf ngx_http_geoip2_module-3.4.tar.gz #解压文件包
mv ngx_http_geoip2_module-3.4/ /usr/local/src/ngx_http_geoip2_module #将文件拷贝到指定目录三、下载及安装GeoLite2的ip库
tar -zxf GeoLite2-Country_20250523.tar.gz #将文件解压
cd GeoLite2-Country_20250523/ #进入文件
mv GeoLite2-Country.mmdb /usr/share/GeoIP/ #将IP库复制到GeoIP文件夹中四、重新编译openresty
./configure --prefix=/usr/local/openresty --with-threads --with-file-aio --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_auth_request_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-stream_ssl_module --with-stream_realip_module --with-stream_geoip_module=dynamic --with-stream_ssl_preread_module --with-compat --with-pcre-jit --with-stream --with-http_geoip_module --add-module=/usr/local/src/ngx_http_geoip2_module
gmake && gmake install五、修改nginx主配置
vi /usr/local/openresty/nginx/conf/nginx.conf
user www;
worker_processes 2;
worker_cpu_affinity auto;
error_log /data/nginx/error.log;
worker_rlimit_nofile 65535;
pid /data/nginx/nginx.pid;
events {
worker_connections 10240;
use epoll;
multi_accept on;
}
http {
include mime.types;
geoip2 /usr/share/GeoIP/GeoLite2-Country.mmdb {
auto_reload 60m; #每隔60分钟自动重载数据库
$geoip2_data_country_code country iso_code; #IP所在-国家的编码
$geoip2_data_country_name country names en; #IP所在-国家名
$geoip2_data_city_name city names; #IP所在-城市名
}
default_type application/octet-stream;
map $time_iso8601 $logdate {
'~^(?\\d{4}-\\d{2}-\\d{2})' $ymd;
default 'date-not-found';
}
map $time_iso8601 $request_times {
'~^(?\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2})' $ymdhms;
default 'date-not-found';
}
map $geoip2_data_country_code $allowed_country {
default no; #默认禁止所有访问
CN yes; #只针对中国开放访问权限
}
log_format access-upstream '{"host":"$server_addr",'
'"clientip":"$remote_addr",'
'"size":$body_bytes_sent,'
'"responsetime":$request_times,'
'"http_host":"$host",'
'"url":"$uri",'
'"agent":"$http_user_agent",'
'"country_code":"$geoip2_data_country_code",'
'"country_name":"$geoip2_data_country_name",'
'"city_name":"$geoip2_data_city_name",'
'"status":"$status"}';
sendfile on;
tcp_nopush on;
tcp_nodelay on;
server_names_hash_bucket_size 128;
server_names_hash_max_size 512;
keepalive_timeout 1000s;
client_header_timeout 15s;
client_body_timeout 15s;
send_timeout 1000s;
proxy_cache_path /data/nginx levels=1:2 keys_zone=nginx-cache:20m max_size=50g inactive=168h;
client_body_buffer_size 512k;
client_header_buffer_size 256k;
client_max_body_size 1024m;
large_client_header_buffers 2 8k;
proxy_connect_timeout 1000s;
proxy_send_timeout 1000s;
proxy_read_timeout 1000s;
proxy_buffer_size 128k;
proxy_buffers 8 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_next_upstream http_502 http_504 http_404 error timeout invalid_header;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort on;
fastcgi_connect_timeout 1000s;
fastcgi_send_timeout 1000s;
fastcgi_read_timeout 1000s;
fastcgi_buffer_size 128k;
fastcgi_buffers 8 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
gzip on;
gzip_min_length 1k;
gzip_buffers 4 32k;
gzip_http_version 1.1;
gzip_comp_level 6;
gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
gzip_vary on;
gzip_disable "MSIE [1-6].";
include vhost/*.conf;
} 六、修改具体域名配置
location / {
if ($allowed_country = no) {
return 401;
}
index /data/wwwroot/index.html;
}下一期将带来openresty+lua+redis把非正常访问的域名加入黑名单