在Nginx中实现动态封禁IP的三种主流方案

# /etc/nginx/conf.d/blockips.conf
192.168.1.100 1;
203.0.113.5    1;

http {
    # 从外部文件加载黑名单
    geo $block_ip {
        default 0;
        include /etc/nginx/conf.d/blockips.conf;
    }

    map $block_ip $deny_ip {
        1 "denied";
        0 "";
    }

    server {
        listen 80;

        if ($deny_ip = "denied") {
            return 403;
        }

        location / {
            # 正常业务
        }
    }
}

nginx -s reload

# Ubuntu 示例
wget -O - https://openresty.org/package/pubkey.gpg | sudo apt-key add -
echo "deb http://openresty.org/package/debian $(lsb_release -sc) openresty" | sudo tee /etc/apt/sources.list.d/openresty.list
sudo apt update && sudo apt install openresty

http {
    lua_shared_dict ip_blacklist 10m;  # 共享内存存储黑名单

    server {
        listen 80;

        # 【核心】访问前检查 IP
        access_by_lua_block {
            local ip = ngx.var.remote_addr
            if ngx.shared.ip_blacklist:get(ip) then
                ngx.log(ngx.WARN, "Blocked IP: ", ip)
                ngx.exit(403)
            end
        }

        # 动态封禁接口（建议加 IP 白名单保护）
        location = /ban {
            content_by_lua_block {
                local args = ngx.req.get_uri_args()
                local ip = args.ip
                local seconds = tonumber(args.seconds) or 3600

                if not ip or not ip:match("^%d+%.%d+%.%d+%.%d+$") then
                    ngx.status = 400
                    ngx.say("Invalid or missing 'ip'")
                    return
                end

                ngx.shared.ip_blacklist:set(ip, true, seconds)
                ngx.say("Banned ", ip, " for ", seconds, "s")
            }
        }

        # 解封 & 查询接口
        location / { echo "Hello! Your IP: $remote_addr"; }
    }
}

# 封禁 IP 5 分钟
curl "http://your-server/ban?ip=1.2.3.4&seconds=300"

# 测试是否被封
curl http://your-server/  # 返回 403

log_format main '$remote_addr - $remote_user [$time_local] "$request" $status ...';
access_log /var/log/nginx/access.log main;

[Definition]
failregex = ^<HOST> -.*"(GET|POST).*" 404 .*
ignoreregex =

[nginx-bad-request]
enabled  = true
port     = http,https
filter   = nginx-bad-request
logpath  = /var/log/nginx/access.log
maxretry = 10      # 10 次失败
findtime = 600     # 在 10 分钟内
bantime  = 3600    # 封 1 小时
action   = iptables-multiport[name=nginx, port="http,https"]

sudo systemctl start fail2ban
sudo fail2ban-client status nginx-bad-request