nginx结合GeoIP可以做一些很有趣的事情，比如过滤掉某些国家的IP。该如何配置呢？
安装环境
CentOS 7.9.2009
nginx 1.25.2
ngx_http_geoip2_module 3.4
libmaxminddb 1.7.1
注册maxmind帐号并下载GeoLite库
去 https://www.maxmind.com 官网注册个帐号，然后下载GeoLite2 City和GeoLite2 Country这两个IP地址库文件。下载后放在服务器的/usr/local/geoip目录下。
编译libmaxminddb
git clone https://github.com/maxmind/libmaxminddb.git -b1.7.1 cd libmaxminddb # make编译./configure makemake install # 或者也可以使用cmake编译mkdir build && cd build cmake .. cmake --build . cmake --build . --target install
编译nginx
git clone https://github.com/leev/ngx_http_geoip2_module.git wget https://nginx.org/download/nginx-1.25.2.tar.gz tar zxvf nginx-1.25.2.tar.gz cd nginx-1.25.2 CFLAGS=-Wno-stringop-truncation ./configure \ --prefix=/usr/local/nginx \ --with-file-aio \ --with-http_ssl_module \ --with-http_realip_module \ --with-http_xslt_module \ --with-http_image_filter_module \ --with-http_ssl_module \ --with-http_sub_module \ --with-http_dav_module \ --with-http_gzip_static_module \ --with-http_secure_link_module \ --with-http_random_index_module \ --with-http_stub_status_module \ --with-http_v2_module \ --add-module=../ngx_http_geoip2_module \ --with-http_v2_modulemakemake install
安装geoipupdate
yum install libmaxminddb-devel geoipupdate
配置geoip
maxmind geoip配置文件保存在/etc/GeoIP.conf中，主要内容如下（需要修改的部分已加注释）：
# cat GeoIP.conf# Please see http://dev.maxmind.com/geoip/geoipupdate/ for instructions# on setting up geoipupdate, including information on how to download a# pre-filled GeoIP.conf file.# Enter your account ID and license key below. These are available from# https://www.maxmind.com/en/my_license_key. If you are only using free# GeoLite databases, you may leave the 0 values.# 注册maxmind帐号后可获取AccountID xxxxxxxxxx LicenseKey xxxxxxxxx # Enter the edition IDs of the databases you would like to update.# Multiple edition IDs are separated by spaces.EditionIDs GeoLite2-Country GeoLite2-City # The remaining settings are OPTIONAL.# The directory to store the database files. Defaults to /usr/local/share/GeoIP# geoip数据库位置DatabaseDirectory /usr/local/geoip # The server to use. Defaults to "updates.maxmind.com".# Host updates.maxmind.com# The desired protocol either "https" (default) or "http".# Protocol https# The proxy host name or IP address. You may optionally specify a# port number, e.g., 127.0.0.1:8888. If no port number is specified, 1080# will be used.# Proxy 127.0.0.1:8888# The user name and password to use with your proxy server.# ProxyUserPassword username:password# Whether to skip host name verification on HTTPS connections.# Defaults to "0".# SkipHostnameVerification 0# Whether to skip peer verification on HTTPS connections.# Defaults to "0".# SkipPeerVerification 0# Whether to preserve modification times of files downloaded from the server.# Defaults to "0".# PreserveFileTimes 0# The lock file to use. This ensures only one geoipupdate process can run at a# time.# Defaults to ".geoipupdate.lock" under the DatabaseDirectory.# LockFile /usr/local/share/GeoIP/.geoipupdate.lock
nginx相关配置
geoip2 /usr/local/geoip/GeoLite2-City.mmdb { #default是为了当ip查不到信息时设置一个默认值。$countrydefault=CN country iso_code; $city_namedefault=Beijing city names en; $provincedefault=Henan subdivisions 0 names en; } map $province$allowed_province { default yes; #Guangdong no;#Guangxi no;#Fujian no;#Beijing no;#Shanghai no;#Tianjin no; } map $country$allowed_country { default yes; #默认都拒绝 CN yes; #中国大陆 TW yes; #中国台湾 HK yes; #中国香港 MO yes; #中国澳门 TH yes; #泰国 VN yes; #越南 US no; #美国 BR no; IE yes; KOR yes; }
GeoIP日常使用及更新
# 查看IP地址属地mmdblookup --file /usr/local/geoip/GeoLite2-City.mmdb --ip223.104.30.232 subdivisions 0 names # 更新IP地址库，因为IP地址库更新比较频繁，建议加入crontab中geoipupdate
