# Deny IP blocks with exceptions - help with configs

**URL:** <https://www.ruby-forum.com/t/deny-ip-blocks-with-exceptions-help-with-configs/193070>\
**Category:** NGINX\
**Created:** [August 10, 2010, 6:11pm UTC](https://www.ruby-forum.com/t/deny-ip-blocks-with-exceptions-help-with-configs/193070 "2010-08-10T18:11:28Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![svieweng](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/50afbb/32.png) [@svieweng](https://www.ruby-forum.com/u/svieweng)\
**Post date:** [August 10, 2010, 6:11pm UTC](https://www.ruby-forum.com/t/deny-ip-blocks-with-exceptions-help-with-configs/193070/1 "2010-08-10T18:11:28Z")

</div>

Hi,

I am trying to solve an issue, and I think NGINX is the right solution  
as we already use it as our frontend proxy.

The problem is this: we have several domains that are pointed to the  
same thing. We need to block/deny a group of subnets. There is an  
exception to this: if the client comes in pointing at a specific domain,  
then we should pass him/her even if the originating IP block is normally  
denied.

First, lets call this [domain.com](http://domain.com), and lets add [a.domain.com](http://a.domain.com),  
[b.domain.com](http://b.domain.com), and [c.domain.com](http://c.domain.com).  
[a.domain.com](http://a.domain.com) should accept all clients from any IP range.  
{b|c}.domain.com, \*.domain.com, 86.75.3.09, and  
[other.someone-elses-domain.net](http://other.someone-elses-domain.net) should pass everything except the  
netblocks listed in the include file “blockips.conf”

What is currently happening, is that using the below config template,  
all traffic is flowing to all domains, regardless of originating  
netbock. I have tried various orders, and different configs entirely.  
And the result is the same for different reasons - either it blocks  
everything, the config is bad and wont load, or it passes everything.  
Any help on this is greatly appreciated.

This is what I did (names changed to protect the innocent):

I created a file called /etc/nginx/blockips.conf

#----BEGIN blockips.conf

deny 1.1.0.0/16;  
deny 2.2.0.0/16;  
deny 3.3.0.0/16;  
deny 4.4.0.0/16;

#----END blockips.conf

#----BEGIN nginx.conf

upstream prod-a {

server 10.1.1.10;  
}

upstream prod-b {  
ip\_hash;  
server 10.1.1.10;  
}

server {

large\_client\_header\_buffers 4 16k;  
proxy\_buffer\_size 16k;  
proxy\_buffers 8 16k;  
proxy\_busy\_buffers\_size 32k;  
proxy\_intercept\_errors on;  
proxy\_buffering on;  
proxy\_temp\_path /my/nginx/temp;

listen 80;  
server\_name [a.domain.com](http://a.domain.com);

location / {  
proxy\_pass [http://prod-a](http://prod-a);  
proxy\_set\_header X-Real-IP $remote\_addr;  
proxy\_set\_header X-Forwarded-For  
$proxy\_add\_x\_forwarded\_for;  
proxy\_set\_header Host $http\_host;

}  
}

server {

large\_client\_header\_buffers 4 16k;  
proxy\_buffer\_size 16k;  
proxy\_buffers 8 16k;  
proxy\_busy\_buffers\_size 32k;  
proxy\_intercept\_errors on;  
proxy\_buffering on;  
proxy\_temp\_path /my/nginx/temp;

listen 80;  
server\_name [b.domain.com.com](http://b.domain.com.com) [c.domain.com.com](http://c.domain.com.com) \*.domain.com 86.75.3.09  
[other.someone-elses-domain.net](http://other.someone-elses-domain.net) ;

location / {  
include blockips.conf;  
proxy\_pass [http://prod-b](http://prod-b);  
proxy\_set\_header X-Real-IP $remote\_addr;  
proxy\_set\_header X-Forwarded-For  
$proxy\_add\_x\_forwarded\_for;  
proxy\_set\_header Host $http\_host;

}  
}

#----END nginx.conf

Posted at Nginx Forum:

> **[Deny IP blocks with exceptions - help with configs](https://forum.nginx.org/read.php?2,118355,118355#msg-118355)**
>
> Hi, I am trying to solve an issue, and I think NGINX is the right solution as we already use it as our frontend proxy. The problem is this: we have several domains that are pointed to the same thing. We need to block/deny a group of subnets. There is...