Block Foreign IPs Using NGINX ngx_http_geoip2 Module

Overview

Goal: block non‑Chinese IP addresses using NGINX and the ngx_http_geoip2 module.

Prerequisites

NGINX ≥ 1.18 (originally 1.16, upgraded)

Root access on a Linux distribution (yum‑based example)

libmaxminddb development library

1. Install libmaxminddb development package

yum install libmaxminddb-devel -y

2. Obtain the ngx_http_geoip2 module

git clone https://github.com/leev/ngx_http_geoip2_module.git

3. Place the module in a permanent location

mv ngx_http_geoip2_module /usr/local/

4. Compile NGINX with the module

Download the NGINX 1.18 source tarball, extract, and configure with the additional module.

tar -xf nginx-1.18.0.tar.gz
cd nginx-1.18.0
./configure \
  --with-http_stub_status_module \
  --prefix=/usr/local/nginx \
  --user=nginx --group=nginx \
  --with-http_ssl_module \
  --with-stream \
  --add-module=/usr/local/ngx_http_geoip2_module
make
# Backup the existing binary
cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.16
# Replace with the newly built binary
cp objs/nginx /usr/local/nginx/sbin/
pkill nginx
/usr/local/nginx/sbin/nginx   # restart

Verify the version:

/usr/local/nginx/sbin/nginx -V

5. Download the GeoLite2 Country database

Create a free MaxMind account, download the GeoLite2-Country.mmdb GZIP file, and extract it to /usr/share/GeoIP/.

cd /usr/share/GeoIP/
tar -xzf GeoLite2-Country.mmdb.gz   # or unzip if already .mmdb
ls -l

6. Configure NGINX

Backup the current configuration and edit /usr/local/nginx/conf/nginx.conf.

cp /usr/local/nginx/conf/nginx.conf /usr/local/nginx/conf/nginx.conf.bak
vim /usr/local/nginx/conf/nginx.conf

Add the following directives inside the http block to load the database and map country codes:

geoip2 /usr/share/GeoIP/GeoLite2-Country.mmdb {
    auto_reload 5m;
    $geoip2_data_country_code country iso_code;
}
map $geoip2_data_country_code $allowed_country {
    default yes;   # allow by default
    CN      no;    # deny China (or reverse logic as needed)
}

Inside the desired server block, add a conditional that returns 404 for disallowed countries:

if ($allowed_country = yes) {
    return 404;
}

7. Test and reload

/usr/local/nginx/sbin/nginx -t
/usr/local/nginx/sbin/nginx -s reload

From a non‑Chinese IP (e.g., a Korean server) request the site; the response should be 404 Not Found. Verify the access log shows the 404 status.

Key considerations

Only recompile NGINX; do not run make install to avoid overwriting the entire existing installation.

Check existing compile‑time modules with /usr/local/nginx/sbin/nginx -V before adding new ones.

The auto_reload directive refreshes the database every 5 minutes, so updates to the GeoLite2 file are applied without restarting NGINX.