Nginx geoipblocking & allowing LAN IPs

geoipip-blockinglocal-area-networknginxwhitelist

I'd like to block IPs with geoip except whitelisted countries AND the local area network.
The first part works flawless, the second one not.
Somwehere searching the internet I found the codes LH (local host) and LN (local network), but they are both not working.

I'm using the standard howto code for the blocking.

The relevant http {} part in nginx.conf:

geoip_country /usr/share/GeoIP/GeoIP.dat;
   map $geoip_country_code $allowed_country {
    default no;                              
    US yes;
   }

The relevant server {} part in sites-available/default:

block countries
      if ($allowed_country = no) {
        return 444;
      }

Any suggestions would be much appreciated!

Update:

$geoip_country_code variable returns "-" on LAN IP access, but adding "- yes;" to the geoip_county block doesn't work either.

Best Answer

I found a solution - no idea if it's 'clean'. Just overwrite the $allowed_country variable if a lan IP condition was matched before.

geo $lan-ip {
default no;
192.168.1.0/24 yes;
}

and this block before the "#block countries" part

if ($lan-ip = yes) {
set $allowed_country yes;
}

Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

NginX GeoIP cause extra load

Nginx parses and loads geoip data into memory once the config file only on (re)start or SIGHUP.

What about expanding $geoip_* variables - I'm not sure, but hope they calculates only when required (in "if" or "log" or "map" or whatever construction). Anyway, it doesn't reread and reload whole dat the file each request.

Best Answer

Related Solutions

NGINX Redirect – How to Rewrite All HTTP Requests to HTTPS While Maintaining Sub-Domain

Correct way in new versions of nginx

NginX GeoIP cause extra load

Related Topic