屏蔽海外IP

1.ngx_http_geoip2_module模块是实现IP拦截的一个Nginx 模块
Nginx需要几个依赖包，分别是pcre，openssl，zlib，在安装nginx之前需要先安装这几个依赖。
sudo yum install pcre pcre-devel，openssl openssl-devel，zlib,zlib-devel

[root@VM606583F24B41474 local]# sudo yum install pcre pcre-devel，openssl openssl-devel，zlib,zlib-devel
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile

• base: ftp-srv2.kddilabs.jp
• extras: http://ftp.riken.jp
• updates: http://ftp.riken.jp
  Package pcre-8.32-17.el7.x86_64 already installed and latest version
  Nothing to do

Nginx下载
mkdir -p /usr/local/nginx && cd /usr/local/nginx

wget http://nginx.org/download/nginx-1.20.1.tar.gz
tar -zxvf nginx-1.20.1.tar.gz
查看nginx版本
/usr/local/nginx/sbin/nginx -V
cd /usr/local

下载 ngx_http_geoip2_module 模块：
git clone https://github.com/leev/ngx_http_geoip2_module.git

geoip2扩展依赖
yum install libmaxminddb-devel -y

./configure –with-http_stub_status_module \
–prefix=/usr/local/nginx \
–user=nginx –group=nginx –with-http_ssl_module –with-stream \
–add-module=/usr/local/ngx_http_geoip2_module

make && make install

常见问题：

./configure: error: C compiler cc is not found
yum install gcc-c++ -y
./configure: error: the HTTP rewrite module requires the PCRE library.
You can either disable the module by using –without-http_rewrite_module

Maxmind数据库下载地址

https://www.maxmind.com/en/accounts/1015962/geoip/downloads

vim /usr/local/nginx/conf/nginx.conf
cd /usr/local/share/GeoIP
wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz（城市）
wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country.mmdb.gz（国家）

https://www.maxmind.com/en/accounts/1015962/geoip/downloads
在http端中添加

geoip2 /usr/share/GeoIP/GeoLite2-City.mmdb {
auto_reload 5m;
$geoip2_data_country_code country iso_code;
}
map $geoip2_data_country_code $allowed_country {
default yes;
CN no;
}
站点的server段里面加一下代码拒绝所有不是国内ip：

if ($allowed_country = yes) {
# return https://www.baidu.com;
# return /home/japan;
return 404;
}

重新启动nginx
/usr/local/nginx/sbin/nginx -s reload

2.宝塔安装
Nginx免费防火墙，和现有的Nginx的防火墙只能安装一个,建议和PHP网站安全告警配合
设置，全局设置，屏蔽海外ip

3.域名解析屏蔽
线路类型选择境外，记录值127.0.0.1

感谢您的来访，获取更多精彩文章请收藏本站。