# Deny certain words **URL:** \ **Category:** NGINX\ **Created:** [September 2, 2014, 1:08pm UTC](https://www.ruby-forum.com/t/deny-certain-words/231837 "2014-09-02T13:08:23Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![addis\_a](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/c4cdca/32.png) [@addis\_a](https://www.ruby-forum.com/u/addis_a)\ **Post date:** [September 2, 2014, 1:08pm UTC](https://www.ruby-forum.com/t/deny-certain-words/231837/1 "2014-09-02T13:08:23Z")
Hi, Somehow my server gets hit by torrent requests which look like this: GET /?info\_hash=… after the = come long strings of seemingly random hashes torrent clients are looking for. I’d like to deny all such requests so would like if someone could provide me how to deny everything (and including) ?info\_hash= I’ve looked all over the net at similar examples but all I tried thus far didn’t work Thanks 🙂 – Yours truly ---
**Author:** ![Grozdan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/aca169/32.png) [@Grozdan](https://www.ruby-forum.com/u/Grozdan)\ **Post date:** [September 2, 2014, 1:18pm UTC](https://www.ruby-forum.com/t/deny-certain-words/231837/2 "2014-09-02T13:18:09Z")
Torrent clients have their own user agent normally, I had a need a while back to block some which we used the magic 444 to kill it. if ($http\_user\_agent ~\* (uTorrent|Transmission) ) { return 444; break; } ---
**Author:** ![Grozdan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/aca169/32.png) [@Grozdan](https://www.ruby-forum.com/u/Grozdan)\ **Post date:** [September 2, 2014, 1:33pm UTC](https://www.ruby-forum.com/t/deny-certain-words/231837/3 "2014-09-02T13:33:24Z")
On Tue, Sep 2, 2014 at 1:17 PM, Steve W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Torrent clients have their own user agent normally, I had a need a while > back to block some which we used the magic 444 to kill it. > > if ($http\_user\_agent ~\* (uTorrent|Transmission) ) { > return 444; > break; > > } Thanks. That seems to work here 🙂 > > clients are looking for. > > * * * > > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) – Yours truly ---
**Author:** ![Grozdan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/aca169/32.png) [@Grozdan](https://www.ruby-forum.com/u/Grozdan)\ **Post date:** [September 2, 2014, 3:10pm UTC](https://www.ruby-forum.com/t/deny-certain-words/231837/4 "2014-09-02T15:10:33Z")
Hello! On Tue, Sep 02, 2014 at 12:17:12PM +0100, Steve W. wrote: > Torrent clients have their own user agent normally, I had a need a while > back to block some which we used the magic 444 to kill it. > > if ($http\_user\_agent ~\* (uTorrent|Transmission) ) { > return 444; > break; > } Just a note: you don’t need “break” here. – Maxim D. > **[nginx](http://nginx.org/)** ---
**Author:** ![Grozdan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/aca169/32.png) [@Grozdan](https://www.ruby-forum.com/u/Grozdan)\ **Post date:** [September 3, 2014, 4:34pm UTC](https://www.ruby-forum.com/t/deny-certain-words/231837/5 "2014-09-03T16:34:18Z")
On 02/09/2014 17:38, Grozdan wrote: > > > if ($http\_user\_agent ~\* (uTorrent|Transmission) ) { > > > Hi, > > As reported, the above code returns 444 on torrent clients trying to > connect. However, my access logs get filled with nginx sending a 444 > response to clients. Is there a way to filter this? I’m currently > using grep -v ‘info\_hash’ to filter but it’ll be better if nginx can > do this instead. > > Thanks You could try; access\_log off; Steve. ---
**Author:** ![Grozdan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/aca169/32.png) [@Grozdan](https://www.ruby-forum.com/u/Grozdan)\ **Post date:** [September 2, 2014, 6:38pm UTC](https://www.ruby-forum.com/t/deny-certain-words/231837/6 "2014-09-02T18:38:46Z")
On Tue, Sep 2, 2014 at 3:09 PM, Maxim D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > } > > Just a note: you don’t need “break” here. > > – > Maxim D. > [http://nginx.org/](http://nginx.org/) Hi, As reported, the above code returns 444 on torrent clients trying to connect. However, my access logs get filled with nginx sending a 444 response to clients. Is there a way to filter this? I’m currently using grep -v ‘info\_hash’ to filter but it’ll be better if nginx can do this instead. Thanks > * * * > > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) – Yours truly ---
**Author:** ![Grozdan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/aca169/32.png) [@Grozdan](https://www.ruby-forum.com/u/Grozdan)\ **Post date:** [September 3, 2014, 5:07pm UTC](https://www.ruby-forum.com/t/deny-certain-words/231837/7 "2014-09-03T17:07:55Z")
I’ve just thought of another angle for this. Is this hitting your default/only site? If it’s got a host header you could create a site just for that that bins all requests off with a 444 and no logging. ---
**Author:** ![Grozdan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/aca169/32.png) [@Grozdan](https://www.ruby-forum.com/u/Grozdan)\ **Post date:** [September 3, 2014, 5:31pm UTC](https://www.ruby-forum.com/t/deny-certain-words/231837/8 "2014-09-03T17:31:42Z")
On Wed, Sep 3, 2014 at 5:13 PM, Grozdan [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > On Wed, Sep 3, 2014 at 5:07 PM, Steve W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > I’ve just thought of another angle for this. Is this hitting your > > default/only site? If it’s got a host header you could create a site just > > for that that bins all requests off with a 444 and no logging. > > Yes, it’s the only site. I will try what you suggested. Thanks! Well, just as I went and try what you suggested I came on the nginx docs where it says you can use ‘map directive’ to decide what to log or not so I tried the below and it works Below goes inside http { … } map $status $loggable { ~^444 0; default 1; } and in the vhost inside server { … } goes the below access\_log /var/log/nginx/vhost.access.log combined if=$loggable; This completely ignores disables logging of 444 responses > > > > > Yours truly > – > Yours truly ---
**Author:** ![Grozdan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/aca169/32.png) [@Grozdan](https://www.ruby-forum.com/u/Grozdan)\ **Post date:** [September 3, 2014, 5:14pm UTC](https://www.ruby-forum.com/t/deny-certain-words/231837/9 "2014-09-03T17:14:02Z")
On Wed, Sep 3, 2014 at 5:07 PM, Steve W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I’ve just thought of another angle for this. Is this hitting your > default/only site? If it’s got a host header you could create a site just > for that that bins all requests off with a 444 and no logging. Yes, it’s the only site. I will try what you suggested. Thanks! > > after the = come long strings of seemingly random hashes torrent > > * * * > > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) – Yours truly