/ Register

Welcome to Centmin Mod Community
Become a Member

Nginx Enabling GeoIP 2 Lite Nginx Module questions ?

Discussion in 'Nginx, PHP-FPM & MariaDB MySQL' started by Itworx4me, Apr 9, 2019.

Previous Thread Next Thread
Loading...
  1. Apr 9, 2019 #1
    Itworx4me

    Itworx4me Premium Member Premium Member

    339
    35
    28
    Mar 14, 2017
    Ratings:
    +65
    Local Time:
    9:40 PM
    Nginx 1.27.4
    MariaDB 10.6.21
  2. Apr 9, 2019 #2
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:40 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    haven't really tested it specifically - GeoIP/GeoIP2 is something you either need to use or you don't. But GeoIP legacy nginx module is installed by default in Centmin Mod so all the benchmarks done to date are with it enabled anyway. GeoIP 2 nginx module isn't installed by default though and only enabled via https://community.centminmod.com/threads/17165/
     
  3. Apr 10, 2019 #3
    Itworx4me

    Itworx4me Premium Member Premium Member

    339
    35
    28
    Mar 14, 2017
    Ratings:
    +65
    Local Time:
    9:40 PM
    Nginx 1.27.4
    MariaDB 10.6.21
    I don't understand where to put this code:

    Then within your nginx vhost's server{} context add entry
    Code (Text):
    if ($country_code_allowed = deny) {
  return 444;
}


    Thanks,
    Itworx4me
     
  4. Apr 11, 2019 #4
    Itworx4me

    Itworx4me Premium Member Premium Member

    339
    35
    28
    Mar 14, 2017
    Ratings:
    +65
    Local Time:
    9:40 PM
    Nginx 1.27.4
    MariaDB 10.6.21
    @eva2000 can you elaborate more on this?
     
  5. Apr 11, 2019 #5
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:40 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    within nginx vhost's server{} context i.e. above the first location / webroot context.
     
  6. Apr 11, 2019 #6
    Itworx4me

    Itworx4me Premium Member Premium Member

    339
    35
    28
    Mar 14, 2017
    Ratings:
    +65
    Local Time:
    9:40 PM
    Nginx 1.27.4
    MariaDB 10.6.21
    Can you give me an example.

    Thanks
    Itworx4me
     
  7. Apr 11, 2019 #7
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:40 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Code (Text):
    if ($country_code_allowed = deny) {
  return 444;
}

location / {
 
}
     
  8. Apr 11, 2019 #8
    Itworx4me

    Itworx4me Premium Member Premium Member

    339
    35
    28
    Mar 14, 2017
    Ratings:
    +65
    Local Time:
    9:40 PM
    Nginx 1.27.4
    MariaDB 10.6.21
    I am assuming that this is the correct file to edit?
    Code (Text):
     /usr/local/nginx/conf/conf.d/newdomain.com.conf

    I am curious as to why you wouldn't want to block it for all traffic into the server instead of per vhost site. Seems very tedious to change each vhost site hosted on the server.

    Thanks,
    Itworx4me
     
  9. Apr 11, 2019 #9
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:40 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    You can put common nginx rules in your own include file i.e. /usr/local/nginx/conf/block_county.conf and reference that in your nginx vhost config files non-https at /usr/local/nginx/conf/conf.d/newdomain.com.conf or https vhost at /usr/local/nginx/conf/conf.d/newdomain.com.ssl.conf as
    Code (Text):
    include /usr/local/nginx/conf/block_county.conf;

    If you want server level blocking there's better tools such as CSF Firewall server level country blocking by editing /etc/csf/csf.conf CSF Firewall config file - something off topic for this thread. So for CSF Firewall questions ask at https://community.centminmod.com/forums/other-centmin-mod-installed-software.22/.
     
  10. Apr 14, 2019 #10
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:40 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    to clarify both these methods do exactly same thing

    method 1 put directly in nginx vhost config files non-https at /usr/local/nginx/conf/conf.d/newdomain.com.conf or https vhost at /usr/local/nginx/conf/conf.d/newdomain.com.ssl.conf the following code above location / context
    Code (Text):
    if ($country_code_allowed = deny) {
  return 444;
}

location / {

}

    or method 2 put the code in /usr/local/nginx/conf/block_county.conf
    Code (Text):
    if ($country_code_allowed = deny) {
  return 444;
}

    and reference that as an include file in your nginx vhost config files non-https at /usr/local/nginx/conf/conf.d/newdomain.com.conf or https vhost at /usr/local/nginx/conf/conf.d/newdomain.com.ssl.conf above location / context
    Code (Text):
    include /usr/local/nginx/conf/block_county.conf;

location / {

}
     
  11. Apr 14, 2019 #11
    Itworx4me

    Itworx4me Premium Member Premium Member

    339
    35
    28
    Mar 14, 2017
    Ratings:
    +65
    Local Time:
    9:40 PM
    Nginx 1.27.4
    MariaDB 10.6.21
    I followed the your install Nginx - How to enable GeoIP 2 Lite Nginx Module Support ? I get nothing from running theses commands:
    Code (Text):
    lsof -p 2128 | grep .so | grep geo
or
lsof -p 2128 | grep GeoIP

    Nginx failed to start too:
    Code (Text):
    nginx -t
nginx: [emerg] unknown "geoip2_data_country_code" variable
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed

    Any ideas?
     
  12. Apr 14, 2019 #12
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:40 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Did recompiled nginx via centmin.sh after setting NGINX_GEOIPTWOLITE='y' and NGXDYNAMIC_GEOIPTWOLITE='y' set persistent config file at /etc/centminmod/custom_config.inc as instructed at Nginx - How to enable GeoIP 2 Lite Nginx Module Support ? ? If you did not, then you wont have GeoIP 2 support

    run command
    Code (Text):
    nginx -V

    to see if --add-dynamic-module=../ngx_http_geoip2_module is listed in output to indicate geoip2 nginx module is installed.

    also

    does your /usr/local/nginx/conf/geoip.conf look like below ?
    Code (Text):
    # SET the path to the .dat file used for determining the visitors country from the IP-address ###
geoip_country /usr/share/GeoIP/GeoIP.dat;

# SET the path to the .dat file used for determining the visitors country from the IP-address ###
geoip_city /usr/share/GeoIP/GeoIPCity.dat;

# GeoIP2 Lite databases
#include /usr/local/nginx/conf/geoip2.conf;

    this line should have automatically be uncommented removed # hash if you recompiled nginx via centmin.sh with NGINX_GEOIPTWOLITE='y' and NGXDYNAMIC_GEOIPTWOLITE='y' set persistent config file at /etc/centminmod/custom_config.inc
    Code (Text):
    #include /usr/local/nginx/conf/geoip2.conf;

    so should be
    Code (Text):
    include /usr/local/nginx/conf/geoip2.conf;
     
  13. Apr 14, 2019 #13
    Itworx4me

    Itworx4me Premium Member Premium Member

    339
    35
    28
    Mar 14, 2017
    Ratings:
    +65
    Local Time:
    9:40 PM
    Nginx 1.27.4
    MariaDB 10.6.21
    This is what my /usr/local/nginx/conf/geoip.conf looks like. This isn't a fresh install.
    Code (Text):
    # cat /usr/local/nginx/conf/geoip.conf
# SET the path to the .dat file used for determining the visitors country from the IP-address ###
geoip_country /usr/share/GeoIP/GeoIP.dat;

# SET the path to the .dat file used for determining the visitors country from the IP-address ###
geoip_city /usr/share/GeoIP/GeoIPCity.dat;

# GeoIP2 Lite databases
#  geoip2 /usr/share/GeoIP/GeoLite2-Country.mmdb {
#    $geoip2_data_country_code country iso_code;
#    $geoip2_data_country_name country names en;
#  }
#
#  geoip2 /usr/share/GeoIP/GeoLite2-City.mmdb {
#    $geoip2_data_city_name city names en;
#    $geoip2_data_postal_code postal code;
#    $geoip2_data_latitude location latitude;
#    $geoip2_data_longitude location longitude;
#    $geoip2_data_state_name subdivisions 0 names en;
#    $geoip2_data_state_code subdivisions 0 iso_code;
#  }
     
  14. Apr 14, 2019 #14
    Itworx4me

    Itworx4me Premium Member Premium Member

    339
    35
    28
    Mar 14, 2017
    Ratings:
    +65
    Local Time:
    9:40 PM
    Nginx 1.27.4
    MariaDB 10.6.21
    I added this line to the geoip.conf
    Code (Text):
    # GeoIP2 Lite databases
include /usr/local/nginx/conf/geoip2.conf;

    and nginx restarted this time.
     
  15. Apr 14, 2019 #15
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:40 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    yes that is older config, you can replace contents of /usr/local/nginx/conf/geoip.conf with one at centminmod/centminmod - centmin mod won't auto change older installers version as you may have customised your geoip.conf so need to update it manually.
     
  16. Apr 14, 2019 #16
    Itworx4me

    Itworx4me Premium Member Premium Member

    339
    35
    28
    Mar 14, 2017
    Ratings:
    +65
    Local Time:
    9:40 PM
    Nginx 1.27.4
    MariaDB 10.6.21
    Thank you for taking the time for this novice to learn how to install new stuff on there server.
    Itworx4me
     
  17. Mar 4, 2021 #17
    Itworx4me

    Itworx4me Premium Member Premium Member

    339
    35
    28
    Mar 14, 2017
    Ratings:
    +65
    Local Time:
    9:40 PM
    Nginx 1.27.4
    MariaDB 10.6.21
    @eva2000 is there a way to deny all and only expect a few counties with geoIP2? If so, what does the code look like?

    Thanks,
    Itworx4me
     
  18. Mar 4, 2021 #18
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:40 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
  19. Mar 4, 2021 #19
    Itworx4me

    Itworx4me Premium Member Premium Member

    339
    35
    28
    Mar 14, 2017
    Ratings:
    +65
    Local Time:
    9:40 PM
    Nginx 1.27.4
    MariaDB 10.6.21
    I looked at post #9. I don't see where is says what I am asking for. I will give it a try here and if you could tell me if I am correct.

    Code (Text):
    map $geoip2_data_country_code $country_code_allowed {
  default deny;
  US allow;
  CA allow;
  AU allow;
  GB allow;
}


    Would this be the correct? Deny all but allow the US,CA,AU and GB to see the server?

    Thanks,
    Itworx4me
     
Previous Thread Next Thread
Loading...

.