# Global denial for certain IPs or agents?

**URL:** <https://www.ruby-forum.com/t/global-denial-for-certain-ips-or-agents/244595>\
**Category:** NGINX\
**Created:** [May 10, 2016, 3:43pm UTC](https://www.ruby-forum.com/t/global-denial-for-certain-ips-or-agents/244595 "2016-05-10T15:43:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [May 10, 2016, 3:43pm UTC](https://www.ruby-forum.com/t/global-denial-for-certain-ips-or-agents/244595/1 "2016-05-10T15:43:49Z")

</div>

Hi all,  
I’ve got Nginx on a Debian server, hosting two sites (two subdomains of  
my  
work’s website). I want to limit both, and any future subdomains, to  
only  
intranet addresses. I also saw access logs this morning from a Chinese  
web  
spider which I want to block. I know how to do this, but how can I do it  
globally? Currently I have to put the rules in each site’s configuration  
file, which is duplicating, which I’d like to avoid. I tried adding this  
to  
the main conf file, but I’m not sure what to put for the “listen” and  
other  
variables given that this isn’t a server, it’s a rule I want applied to  
all  
servers. Is this doable? If so, what’s the process? Thanks.

---

<div class="post-metadata">

**Author:** ![redroot](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/919ad9/32.png) [@redroot](https://www.ruby-forum.com/u/redroot)\
**Post date:** [May 10, 2016, 3:47pm UTC](https://www.ruby-forum.com/t/global-denial-for-certain-ips-or-agents/244595/2 "2016-05-10T15:47:19Z")

</div>

Hi Alex

this might be an inspiration for your task:

> **[nginx: How To Block Visitors By Country With The GeoIP Module (Debian/Ubuntu)](https://www.howtoforge.com/nginx-how-to-block-visitors-by-country-with-the-geoip-module-debian-ubuntu)**
>
> nginx: How To Block Visitors By Country With The GeoIP Module (Debian/Ubuntu)
> 
> This tutorial explains how to use the GeoIP module with nginx to 
> b...

cheers,

mex

Posted at Nginx Forum:

> **[Re: Global denial for certain IPs or agents?](https://forum.nginx.org/read.php?2,266738,266739#msg-266739)**
>
> Hi all, I've got Nginx on a Debian server, hosting two sites (two subdomains of my work's website). I want to limit both, and any future subdomains, to only intranet addresses. I also saw access logs this morning from a Chinese web spider which I...

---

<div class="post-metadata">

**Author:** ![redroot](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/919ad9/32.png) [@redroot](https://www.ruby-forum.com/u/redroot)\
**Post date:** [May 10, 2016, 4:04pm UTC](https://www.ruby-forum.com/t/global-denial-for-certain-ips-or-agents/244595/3 "2016-05-10T16:04:16Z")

</div>

Thanks. That page says that, to do the actual returning of the 4xx  
error,  
you must go go your site’s configuration, not the global conf file. Am I  
reading that right? Is the easiest way to set my own variable in the  
main  
conf file, based on IP, then just do a check for that variable in each  
site’s file? Or is there another way?

---

<div class="post-metadata">

**Author:** ![redroot](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/919ad9/32.png) [@redroot](https://www.ruby-forum.com/u/redroot)\
**Post date:** [May 10, 2016, 10:21pm UTC](https://www.ruby-forum.com/t/global-denial-for-certain-ips-or-agents/244595/4 "2016-05-10T22:21:04Z")

</div>

On Tue, May 10, 2016 at 09:42:26AM -0400, Alex H. wrote:

Hi there,

> I know how to do this, but how can I do it  
> globally? Currently I have to put the rules in each site’s configuration  
> file, which is duplicating, which I’d like to avoid.

[Module ngx\_http\_access\_module](http://nginx.org/r/allow) says “Context: http, server, location,  
limit\_except”.

So you can put your allow (and deny) directives at “http” level,  
and they will inherit into the appropriate location{} block (unless  
overridden elsewhere).

(Or you could block access outside of nginx, by using a firewall or  
other network control device.)

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![redroot](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/919ad9/32.png) [@redroot](https://www.ruby-forum.com/u/redroot)\
**Post date:** [May 10, 2016, 10:33pm UTC](https://www.ruby-forum.com/t/global-denial-for-certain-ips-or-agents/244595/5 "2016-05-10T22:33:55Z")

</div>

you could also include one file at all relevant places.

nginx.conf:  
server {  
# settings for server1  
include /path/to/include.file;  
}  
server {  
# settings for server2  
include /path/to/include.file;  
}

/path/to/include.file:  
allow from ip1;  
allow from cidr2;  
deny all;

Andreas

---

<div class="post-metadata">

**Author:** ![redroot](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/919ad9/32.png) [@redroot](https://www.ruby-forum.com/u/redroot)\
**Post date:** [May 10, 2016, 4:44pm UTC](https://www.ruby-forum.com/t/global-denial-for-certain-ips-or-agents/244595/6 "2016-05-10T16:44:35Z")

</div>

Hi Alex,

you can do it that way or use something like this  
inside your server {} block:

```
  allow IP1;
  allow IP2;
  allow IP3;

  deny all;

```

[http://nginx.org/en/docs/http/ngx\_http\_access\_module.html#allow](http://nginx.org/en/docs/http/ngx_http_access_module.html#allow)

Posted at Nginx Forum:

> **[Re: Global denial for certain IPs or agents?](https://forum.nginx.org/read.php?2,266738,266750#msg-266750)**
>
> Hi all, I've got Nginx on a Debian server, hosting two sites (two subdomains of my work's website). I want to limit both, and any future subdomains, to only intranet addresses. I also saw access logs this morning from a Chinese web spider which I...