Get the most out of your Centmin Mod LEMP stack
Become a Member

Nginx How to block country on Nginx using Cloudflare http_cf_ipcountry?

Discussion in 'Nginx, PHP-FPM & MariaDB MySQL' started by rdan, Dec 10, 2018.

  1. rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    5:07 PM
    Mainline
    10.2
    I want to allow some parts of the site for certain countries like admin/install page.
    Following this guide didn't work:
    Using CloudFlare for country blocking - Nginx Library
    No error, it just didn't do anything.


    IP Geolocation is also enabled on Cloudflare.
     
  2. eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    7:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    should work as long as your server can detect the HTTP_CF_IPCOUNTRY header passed from Cloudflare

    though you can just use Cloudflarw Zone Lock down to do the same thing too
     
  3. rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    5:07 PM
    Mainline
    10.2
    How can I test this?
    headers-more-nginx-module doesn't interfere or strip it?

    I'll use this as last resort.
    Thanks!
     
  4. eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    7:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
  5. rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    5:07 PM
    Mainline
    10.2
    Checking /admin.php?tools/phpinfo
    $_SERVER['HTTP_CF_IPCOUNTRY'] is there with correct country code.
     
  6. eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    7:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    yup so it exists :)
     
  7. rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    5:07 PM
    Mainline
    10.2
    But it doesn't work :unsure:
     
  8. eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    7:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
  9. rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    5:07 PM
    Mainline
    10.2
    But using GEOIP Module not cloudflare header?
     
  10. eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    7:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    ah yes using geoip
    Code (Text):
        map $geoip_country_code $adcountry {
            default "";
            AP ap;   # asian pacific region
            AU au;   # australia
            BR br;   # brazil
            CA ca;   # canada
            CN cn;   # china
            DE de;   # germany
            EU eu;   # europe
            FR fr;   # france
            GB gb;   # great britain
            HK hk;   # hong kong       
            ID id;   # indonesia
            IN in;   # india
            IT it;   # italy
            JP jp;   # japan
            NL nl;   # netherlands
            NO no;   # norway
            PH ph;   # philippines
            PT pt;   # portugal
            RU ru;   # russia
            SG sg;   # singapore
            TH th;   # thailand
            US us;   # usa
            VN vn;   # vietnam
        }
     
  11. rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    5:07 PM
    Mainline
    10.2
    I ended up using Cloudflare :D.
    Code:
    (ip.geoip.country ne "XX" and http.request.uri.path eq "/admin.php")
     
  12. eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    7:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Yeah Cloudflare Firewall Rules will do the same :) Though if someone bypasses Cloudflare to hit origin directly, you won't have any protection like you would doing it at Nginx level.
     
  13. rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    5:07 PM
    Mainline
    10.2
    I do have this also: Authenticated Origin Pulls
     
  14. eva2000

    eva2000 Administrator Staff Member

    58,894
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    7:07 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+