Nginx 地区访问限制

nginx 配置地址访问限制 

nginx.conf

user nobody;
worker_processes  2;
pid        /var/run/nginx.pid;
worker_rlimit_nofile 65535; 
events {
    worker_connections  51200;
	use epoll;
	multi_accept        on;
}
http {
    include      mime.types;
    default_type  application/octet-stream;
    log_format main '$http_x_forwarded_for ($remote_addr) - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent "$http_referer" ' '"$http_user_agent"'  ;
    server_name_in_redirect off;
    client_body_buffer_size  150M;
    client_header_buffer_size 10240k;
    client_max_body_size 150M;
    large_client_header_buffers 40 2M;
	
    fastcgi_intercept_errors on;
    sendfile        on;
    server_tokens off;
    keepalive_timeout 600s;
    fastcgi_connect_timeout 300s;
    fastcgi_send_timeout 300s;
    fastcgi_read_timeout 300s;
    fastcgi_buffer_size 1024k;
    fastcgi_buffers 4 1024k;
    fastcgi_busy_buffers_size 1024k;
    fastcgi_temp_file_write_size 1024k;

	
  # Proxy settings
    proxy_redirect      off;
    proxy_set_header    Host            $host;
    proxy_set_header    X-Real-IP       $remote_addr;
    proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass_header   Set-Cookie;
    proxy_connect_timeout   90;
    proxy_send_timeout  90;
    proxy_read_timeout  90;
    proxy_buffers       32 4k;
	
    # Error pages
    error_page          403          /error/403.html;
    error_page          404          /error/404.html;
    error_page          502 503 504  /error/50x.html;


    # Cache settings
    proxy_cache_path /var/cache/nginx levels=2 keys_zone=cache:10m inactive=60m max_size=1024m;
    proxy_cache_key "$host$request_uri $cookie_user";
    proxy_temp_path  /var/cache/nginx/temp;
    proxy_ignore_headers Expires Cache-Control;
    proxy_cache_use_stale error timeout invalid_header http_502;
    proxy_cache_valid any 1d;
    proxy_intercept_errors on;

    # Cache bypass
    map $http_cookie $no_cache {
        default 0;
        ~SESS 1;
        ~wordpress_logged_in 1;
    }

	
    # SSL PCI Compliance
    ssl_session_cache   shared:SSL:10m;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers        "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
	
	
    gzip on;
    gzip_buffers 16 8k;
    gzip_comp_level 6;
    gzip_http_version 1.1;
    gzip_min_length 256;
    gzip_proxied any;
	gzip_disable        "MSIE [1-6]\.";
    gzip_vary on;
    gzip_types
      text/xml application/xml application/atom+xml application/rss+xml application/xhtml+xml image/svg+xml
      text/javascript application/javascript application/x-javascript
      text/x-json application/json application/x-web-app-manifest+json
      text/css text/plain text/x-component
      font/opentype application/x-font-ttf application/vnd.ms-fontobject
      image/x-icon image/jpeg image/gif image/png image/x-ms-bmp;
  gzip_disable "MSIE [1-6]\.(?!.*SV1)"; 
  
  # File cache settings
    open_file_cache          max=10000 inactive=30s;
    open_file_cache_valid    60s;
    open_file_cache_min_uses 2;
    open_file_cache_errors   off;
    add_header Access-Control-Allow-Origin *;
    add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
    add_header 'Access-Control-Allow-Credentials' 'true';
    add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,X-Requested-With';
    add_header PS 1;

 # Geoip  acl den
    geoip_country /usr/share/GeoIP/GeoIP.dat;
    fastcgi_param GEOIP_COUNTRY_CODE $geoip_country_code;
    fastcgi_param GEOIP_COUNTRY_CODE3 $geoip_country_code3;
    fastcgi_param GEOIP_COUNTRY_NAME $geoip_country_name;
  
    include vhost/*.conf;
    include vhost/*.hash
}

　　

二级域名配置文件应用 ip区域访问限制

server {
       listen 80;
       server_name  www.xxx.com ;

location /{
      return 301 https://$server_name$request_uri;
      }
}
server {
        listen 443  ssl http2;
        server_name www.xxx.com ;
        ssl on;
        ssl_certificate ssl/www.xxx.com/fullchain.pem;
        ssl_certificate_key ssl/www.xxx.com/privkey.pem;

        ssl_session_timeout  5m;


        access_log logs/www.xxx.com.com.access.log access_json;
        error_log logs/www.xxx.com.com.error.log warn;
        include d.eny;
location / {
        proxy_pass http://xxx/;
        proxy_redirect   off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        client_max_body_size 100m;
        client_body_buffer_size    128k;
        proxy_connect_timeout 600;  
        proxy_read_timeout 600;
        proxy_send_timeout 600;
        proxy_temp_file_write_size 64k;
        proxy_cache_valid 200 302 1m;
        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;
        #add_header Cache-Control no-cache;
        #add_header Cache-Control no-store;
        expires     888s;
        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Headers X-Requested-With;
        add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken';
        add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
        add_header PS 1;
       } 
}

　配置d.eny 条件判断

if ( $geoip_country_code3 !~* CHN|HKG|PHL) { return http://www.google.com; }