Few months back, I got a message from one of my friends saying that his website is getting attacked
by a lot of people.
So we decided to go into the Nginx logs and we went into Splunk to see what exactly is happening.
And we figured out that most of the attacks that are coming on this website were specific to a particular
country, which was Russia.
So attacks ranged from brute force to SQL injection attempts and so many other things, and they were
like 2000, 3000 every hour.
So one of the things that we determined was that his website was specific to clients in India.
So there was no need to open up the website for the whole world.
So then we decided to block the website for specific countries.
Now in Nginx, if we want to do that, then there is a very amazing module.
Nicolas de Enginex.
Http module.
Which basically allows you to block the website based on specific countries.
So if you talk about Linux.
So there are two ways in which you can block a particular IP address.
So let me give you the real world scenario itself of one of my friends.
So basically this is a server and within the server there are multiple websites hosted.
So all of these are the websites.
And this is one.
Linux server.
So there were around five websites which are hosted now.
One of the ways where we could actually block the countries was through the firewall.
So this is a firewall.
And in the firewall layer itself, we could have blocked.
But one of the challenge was that we only wanted to block one website and not all.
So if you just want to block one website based on the server name server name parameter.
Then doing this in Firewall does not become an ideal solution.
So during that you actually have to use the Geoip module which Nginx provides, which can block.
Countries based on the website which they are trying to access.
So let's see on how we can do that in the Nginx configuration.
So.
There is a module called as Geoip which is available.
So let's do a geoip grep.
And you see there are geoip modules available.
Now you will need these modules if you want to do the country based blocking.
So if you do not have this module, then you can simply install the package which is geo hyphen hyphen,
geoip hyphen dev devel and this will actually install both the modules.
For me it is there.
So if you install it, install the nginx yum.
Then this modules will be by default there.
So let's open the nginx configuration and let's write our first code.
Okay.
So I'll say.
Geoip underscore country.
User share.
I hope this is a geo IP that I'll explain the code.
Then we map.
So we map the host variable.
Now host is basically the host that it is trying to attach.
A client is trying to connect followed by the.
Geoip.
Country Code.
And if let's say we define a variable DNI by country.
So if anything starts from, let's say example.com.
If it is not from.
India.
Then let's give it an value of one.
However, the default value is zero.
Let's save this.
Okay.
It's successful.
Now, second thing that you have to do is go to the.
Next 50.
Stay with me on this and I'll just explain you and inside the server directive.
We add a include?
If denied by country, then return.
403.
Let's check if the tests are successful.
Okay.
And let's reload the enginex.
Okay.
So let's see on what exactly you have written.
So the first directive over here is geoip underscore country.
So this basically means that this is the location of the database file.
Now, this database file basically contains IP to country mapping.
Now, if we look into the Internet or if we look into the IP address based schemes, each country is
given a specific set of IP addresses.
So let me open a Firefox.
And if we look over here, this is one of the websites.
I'll be posting it on the forum itself.
So this basically gives IP address corresponding to particular country.
So if I say India, then.
There are IP address blocks which are assigned to.
Indian ISPs, and there are a lot of them.
So specifying each and every IP addresses based on country is a very difficult task.
So there is a organization called as Maxmind, which has already done that for us.
And that mapping country to IP mapping is stored in the geoip.
That file.
So the first thing that we are doing over here is we are including this IP dot, that file.
In the second directive we are mapping the host.
So host is a variable.
So we have already looked into the Http header where we have a host header.
So host with the Geoip country code and deny by country is a variable.
So the default value for deny by country is zero.
And if any host variable.
So this is host.
If any, host variable.
Comes with Indian IP.
Then the value is one.
So let me explain you on how this works.
Let's use our favorite one node.
So the first.
We are doing a mapping and we have a host variable over here.
And.
GOP.
And let's go country.
And the scope code.
So let's say if a host is example.com, so it will be example.com.
And its zip code is India.
So this will become a mapping to this.
So if any visitor so if, say, if any user tries to come and opens example.com.
And if he's not from India, then block him.
So this is what we are actually specifying over here.
So I just had.
To add over here.
I see.
So this corresponds to.
This semicolon.
So again, let's revise map host variable to give country code and if anything's come in any.
Visit comes to example.com and if it is not from India.
So here we have specified.
If it is not from India, then the value is one by default, value is zero.
And.
Within the.
Web.config.
If said if deny by country value is one, then return 403.
So that means if any visitor tries to access example.com from any other country other than India, then
the value of this denied by country becomes one.
Otherwise it is zero.
And if the value becomes one, return a 403.
So this is how the blocking happens.
So as I'm from India, let's not include India in the list.
So I'll put, let's say us.
So before we do that, I'll just show you that a website is working.
Let's say example.com.
Ah, it is showing forbidden.
It looks like or it seems cash.
Okay.
Let's see what happened.
The code seems good.
Let's restart Nginx.
And let's do a tail.
Tail always helps on what exactly is the issue.
So let's refresh this.
And this is working now.
So.
So those things were because of the old testing and the cache in my browser.
So now example.com is working.
So now let's block example.com from India.
So I'll open the nginx.conf.
And so by default it is allowing only India and no other country.
So let's remove India and say let's allow us.
So now only client IP address from us will be allowed and rest.
Everyone will be blocked.
So if I reload this.
And try to open.
Basically it will give me A4034 bidder, which means.
The IP addresses not allowed.
So this is very useful.
If specific website is only targeting customers based on a specific country or a specific city.
So even if you look into security wise, so if your website is specific to a particular country, let's
say India, then why do you want that website to be accessible throughout the world?
You can actually block countries where a lot of attacks that comes from specifically Russia, a lot
of attacks comes from there.
So you can actually do that.
Now, one more interesting question that comes is how will we know the code for each and every country?
So in us and so many other things.
So there is a database from Maxmind itself which has country code mapping.
So EU stands for Australia, for India.
It is in and for each country they have given a specific country code.
So this is something that you can use to.
Enhance your blocking capabilities.
So I'll be posting this in the website itself so that you can refer it.
Now this is the basics about how you can block the.
Two countries from your whole website.
So we have looked into geoip based country mapping so you can do a lot of things with the Http module.
You can even use city based blocking.
You can use longitude as well as organization based.
So organization based means that some organizations are being given a specific set of IP addresses.
So specifically if you see universities.
So if I say University of California, so this University of California, many times they are given
a specific range of IP addresses.
So you can actually use Geoip module based on the university names instead of the country code.
So a lot of things that you can do, you can always do trial and error test many things depending upon
the requirements.
So this is it about the basic Geoip module and how to block country based upon the Geoip block.
So I hope this video has been informative for you, and I'd like to thank you for viewing.