Muchas veces algunas webs de las empresas solo queremos abrirla para los rangos de IP de CUBA, muchas veces usamos LACNIC. Hoy le enseno como hacerlo con GeoIP de un forma bastante rápida. Bueno necesitamos primero que hallan hecho lo de la guía básica de un server de web con nginx de proxy inverso.
Lo primero es revisar si nuestros NGINX tiene soporte de GeoIP
root@proxy_inverso:/root# nginx -V
nginx version: nginx/1.4.6 (Ubuntu)
built by gcc 4.8.4 (Ubuntu 4.8.4-2ubuntu1~14.04.3)
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-Bsymbolic-functions -Wl,-z,relro' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit --with-ipv6 --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_addition_module --with-http_dav_module --with-http_geoip_module --with-http_gzip_static_module --with-http_image_filter_module --with-http_spdy_module --with-http_sub_module --with-http_xslt_module --with-mail --with-mail_ssl_moduleInstalamos el GeoIP
apt-get install geoip-database libgeoip1
mv /usr/share/GeoIP/GeoIP.dat /usr/share/GeoIP/GeoIP.dat_bak
cd /usr/share/GeoIP/
wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
gunzip GeoIP.dat.gznano /etc/nginx/nginx.confle agregamos en la parte de http
geoip_country /usr/share/GeoIP/GeoIP.dat;
map $geoip_country_code $allowed_country {
default no;
CU yes;
}En caso de necesitar crear una lista blanca(whitelist) para permitir el acceso a algunos IP solamente.
geo $exclusions {
default 0;
10.8.0.0/29 1;
}nano /etc/nginx/cuba.conf
if ($allowed_country = no) {
return 444;
}y si creamos la whitelist seria de la siguiente forma
if ($allowed_country = yes) {
set $exclusions 1;
}
if ($exclusions = "0") {
return 444;
}Una vez ya configurado esto pasamos y agregamos un include a el virtualhost que queremos limitar el acceso solamente desde cuba
server {
listen 0.0.0.0:80;
server_name onlycu.dominio.cu;
return 301 https://$host$request_uri;
include /etc/nginx/ban_exploits.conf;
include /etc/nginx/favicon.conf;
}
server {
listen 0.0.0.0:443 ssl;
server_name onlycu.dominio.cu;
include /etc/nginx/ssl.conf;
include /etc/nginx/error.conf;
include /etc/nginx/ban_exploits.conf;
include /etc/nginx/favicon.conf;
access_log /var/log/nginx/onlycu-access.log;
error_log /var/log/nginx/onlycu-error.log;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass https://192.168.0.1;
proxy_read_timeout 90;
proxy_redirect https://192.168.0.1 https://onlycu.dominio.cu;
include /etc/nginx/cuba.conf;
}
location ~ /(\.|wp-config.php|readme.html|license.txt|schema.txt|password.txt|passwords.txt|phpmyadmin|admin|download)
{
deny all;
}
}
No comments yet