How to Use Nginx to Restrict Malicious Access: IP Blocking, DDoS Mitigation, SQL Injection and XSS Prevention

Malicious access refers to attackers targeting a website or network service to gain illegal access or disrupt normal operation. To protect server network security, Nginx can be configured to restrict such malicious traffic.

Using Nginx to Restrict IPs

1. Configure IP blacklist

Add a blacklist in the Nginx configuration file ( /etc/nginx/nginx.conf) within the http block:

http {
    ...
    # black list
    geo $not_allowed_ip {
        default 0;
        include /etc/nginx/not_allowed_ip.txt;
    }
    ...
}

This defines a variable $not_allowed_ip whose values are read from not_allowed_ip.txt.

2. Edit the IP blacklist file

Open the file and add IPs separated by semicolons:

sudo nano /etc/nginx/not_allowed_ip.txt

192.168.0.1;
192.168.0.2;

Save and close the editor after editing.

3. Add IP restriction rule

Use an if directive inside a server block to return a 403 status for blacklisted IPs:

http {
    ...
    server {
        ...
        # access control list
        if ($not_allowed_ip) {
            return 403;
        }
        ...
    }
    ...
}

4. Reload Nginx

After saving the configuration, reload Nginx to apply changes: sudo systemctl reload nginx Using Nginx to Defend Against DDoS Attacks

1. Limit concurrent connections per IP

http {
    ...
    limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
    ...
    server {
        ...
        limit_conn conn_limit_per_ip 10;
        ...
    }
    ...
}

This creates a shared memory zone conn_limit_per_ip and limits each IP to 10 simultaneous connections.

2. Limit request rate per IP

http {
    ...
    limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=1r/s;
    ...
    server {
        ...
        limit_req zone=req_limit_per_ip burst=10 nodelay;
        ...
    }
    ...
}

Requests are limited to 1 per second with a burst of up to 10.

3. Limit request body size

http {
    ...
    # limit body size
    client_max_body_size 10m;
    ...
}

Uploads larger than 10 MB are rejected.

Using Nginx to Defend Against SQL Injection and XSS Attacks

1. Prevent SQL injection

http {
    ...
    server {
        ...
        if ($query_string ~ "union.*select.*\(") {
            return 403;
        }
        if ($query_string ~ "cookies|document|base64") {
            return 403;
        }
        ...
    }
    ...
}

Two if statements check the query string for suspicious patterns and block the request with a 403 status.

2. Prevent XSS attacks

http {
    ...
    server {
        ...
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Frame-Options "SAMEORIGIN";
        ...
    }
    ...
}

These headers disable MIME sniffing, enable XSS protection, and restrict framing to the same origin.

Summary

The article demonstrates how to use Nginx to implement various security measures—IP blacklisting, DDoS mitigation, request rate and body size limits, and defenses against SQL injection and XSS—thereby strengthening the protection of web services.