How it is possible without using if but with map in nginx with the module --with_geoip2_module (dynamic) to block all countries except the chosen and all ip except the chosen, to make it work like this:
**if ($lan = yes) {
set $allowed_country yes;
}
if ($allowed_country = no) {
return 503;
}**
but without if?
Centos 7
It`s my /etc/nginx/nginx.conf
load_module modules/ngx_http_geoip2_module.so;
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
#block country
geoip2 /etc/nginx/geoip/GeoLite2-Country/GeoLite2-Country.mmdb {
auto_reload 60m;
$geoip2_data_country_code country iso_code;
$geoip2_data_country_name country names en;
}
geo $lan {
default no;
123.224.55.2 yes;
}
map $geoip2_data_country_code $allowed_country {
default no;
UA yes;
BG yes;
RO yes;
}
log_format geoip_main '$remote_addr - $geoip2_data_country_code - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent "$host" '
'"$http_referer" "$http_user_agent" "$gzip_ratio"';
access_log /var/log/nginx/access.log geoip_main;
access_log /var/log/nginx/geoip_country.log geoip_main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
access_log /var/log/nginx/geoip_country.log geoip_main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
include include/etc/nginx/modules/*.so;
}
I am very grateful to you for your help!
An official NGINX article says:
The only 100% safe things which may be done inside if in a location context are:
return ...; rewrite ... last;
So your if (...) { return 503; }
block is completely safe. To exclude first one if
block, use
geo $lan {
default no;
123.224.55.2 yes;
}
map $geoip2_data_country_code $allowed_country {
default no;
UA yes;
BG yes;
RO yes;
}
map $lan$allowed_country $deny {
~yes "";
default 1;
}
...
server {
...
if ($deny) {
return 503;
}
...
}
Update
This version have the same functionality and should be slightly faster since it doesn't use a regex matching:
geo $lan {
default 0;
123.224.55.2 1;
...
}
map $geoip2_data_country_code $allowed_country {
default 0;
UA 1;
BG 1;
RO 1;
}
map $lan$allowed_country $deny {
default 0;
00 1;
}
...
server {
...
if ($deny) {
return 503;
}
...
}