如何通过openresty 限制国外Ip访问

参考代码

https://gitee.com/xiaoyun461/blocking-external-networks

首先 需要的依赖：

libmaxminddb

https://github.com/maxmind/libmaxminddb

maxmind-geoip

https://github.com/Dreamacro/maxmind-geoip

libmaxminddb 需要gcc编译，可用 Dockerfile 里面编译生成so文件，然后复制到 openresty/openresty:centos-rpm 镜像中，然后把 Country.mmdb（Ip数据库） 也复制到镜像中

Dockerfile 如下：

############## 构建 libmaxminddb #####################
FROM gcc:9 AS libmaxminddb-build
ADD lib/libmaxminddb-1.8.0.tar.gz /
WORKDIR /libmaxminddb-1.8.0
RUN ./configure && make && make install && ldconfig -v && ls -f  /usr/local/lib/libmaxminddb*############## 构建 openresty #####################
FROM openresty/openresty:centos-rpm
ENV TZ Asia/Shanghai
COPY --from=libmaxminddb-build   /usr/local/lib/libmaxminddb.so.0.0.7 /lib64
COPY  geoip/20231212/Country.mmdb /etc/nginx/mmdb/Country.mmdbRUN  ln -snf /usr/share/zoneinfo/"$TZ" /etc/localtime && echo "$TZ" > /etc/timezone \&& opm get anjia0532/lua-resty-maxminddb \&& ln -s /lib64/libmaxminddb.so.0.0.7 /lib64/libmaxminddb.so \&& ldconfig -v

然后配置lua脚本，OpenResty（也称为 ngx_openresty）是一个基于 Nginx 与 Lua 的高性能 Web 平台，

lua脚本如下：

local function get_client_ip()local headers = ngx.req.get_headers()local clientIP = headers["x-forwarded-for"]if clientIP == nil or string.len(clientIP) == 0 or clientIP == "unknown" thenclientIP = headers["Proxy-Client-IP"]endif clientIP == nil or string.len(clientIP) == 0 or clientIP == "unknown" thenclientIP = headers["WL-Proxy-Client-IP"]endif clientIP == nil or string.len(clientIP) == 0 or clientIP == "unknown" thenclientIP = ngx.var.remote_addrend-- 对于通过多个代理的情况，第一个IP为客户端真实IP,多个IP按照','分割if clientIP ~= nil and string.len(clientIP) > 15 thenlocal pos = string.find(clientIP, ",", 1)clientIP = string.sub(clientIP, 1, pos - 1)endreturn clientIP;
endlocal function check_cn(ip)local geo = require 'resty.maxminddb'if not geo.initted() thengeo.init("/etc/nginx/mmdb/Country.mmdb")endlocal res, err = geo.lookup(ip)if not res thenngx.log(ngx.ERR, ' failed to lookup by ip , reason :', err)elsefor k, v in pairs(res) doif (k == "country") thenfor key, item in pairs(v) doif (key == "iso_code") thenif item == "CN" thenngx.log(ngx.INFO, ' this counrty: ', item)return 1;elsengx.log(ngx.ERR, ' this counrty: ', item)return 0;endendendendendend
end-- 获取nginx 本地缓存
local cache_ngx = ngx.shared.dis_cache;
-- 获取 请求IP
local clientIP = get_client_ip();--根据IP 获取本地黑名单缓存数据
local banIpCache = cache_ngx:get('ban_ip_' .. clientIP);
if banIpCache == 1 thenngx.log(ngx.ERR, "cache_black_ip:", clientIP)ngx.exit(403)
else-- 判断是否是国外IP, 直接设为黑名单,并且返回403local flag = check_cn(clientIP);if flag == 0 then-- 本地缓存黑名单 时间1小时ngx.log(ngx.ERR, "set_local_black_ip:", clientIP)cache_ngx:set('ban_ip_' .. clientIP, 1, 60 * 60);ngx.exit(403)end
end

nginx.conf 配置文件 也要加入 lua脚本校验，以及 增加128M的本地缓存，方便过滤

nginx.conf如下：

pcre_jit on;#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;error_log  logs/error.log  warn;#pid        logs/nginx.pid;worker_processes auto;events {worker_connections  20480;
}http {include       mime.types;default_type  application/octet-stream;# Enables or disables the use of underscores in client request header fields.# When the use of underscores is disabled, request header fields whose names contain underscores are marked as invalid and become subject to the ignore_invalid_headers directive.# underscores_in_headers off;log_format  main  '$remote_addr - $remote_user [$time_local] "$request" ''$status $body_bytes_sent "$http_referer" ''"$http_user_agent" "$http_x_forwarded_for"';access_log  /dev/stdout  main;#         Log in JSON Formatlog_format nginxlog_json escape=json '{ "timestamp": "$time_local", ''"remote_addr": "$remote_addr", ''"remote_user": "remote_user", ''"body_bytes_sent": $body_bytes_sent, ''"request_time": $request_time, ''"response_status": $status, ''"request": "$request", ''"request_method": "$request_method", ''"host": "$host",''"upstream_addr": "$upstream_addr",''"upstream_host": "$upstream_http_host",''"upstream_resp_time": "$upstream_response_time",''"http_x_forwarded_for": "$http_x_forwarded_for",''"http_referrer": "$http_referer", ''"http_user_agent": "$http_user_agent", ''"http_version": "$server_protocol" ';map $time_iso8601 $logdate {'~^(?<ymd>\d{4}-\d{2}-\d{2})' $ymd;default                       'date-not-found';}access_log logs/access_json-$logdate.log  nginxlog_json;# See Move default writable paths to a dedicated directory (#119)# https://github.com/openresty/docker-openresty/issues/119client_body_temp_path /var/run/openresty/nginx-client-body;proxy_temp_path       /var/run/openresty/nginx-proxy;fastcgi_temp_path     /var/run/openresty/nginx-fastcgi;uwsgi_temp_path       /var/run/openresty/nginx-uwsgi;scgi_temp_path        /var/run/openresty/nginx-scgi;sendfile        on;#tcp_nopush     on;#keepalive_timeout  0;keepalive_timeout  65;client_max_body_size 150m;#     lua cachelua_shared_dict dis_cache 128m;gzip on;gzip_static  on;gzip_min_length 1k;     # 设置允许压缩的页面最小字节数gzip_buffers 4 16k;     # 用来存储 gzip 的压缩结果gzip_http_version 1.1;  # 识别 HTTP 协议版本gzip_comp_level 2;      # 设置 gzip 的压缩比 1-9。1 压缩比最小但最快，而 9 相反gzip_types gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; # 指定压缩类型gzip_proxied any;       # 无论后端服务器的 headers 头返回什么信息，都无条件启用压缩# 限制国外ipaccess_by_lua_file /etc/nginx/lua/access_limit_open.lua;include /etc/nginx/conf.d/*.conf;}

全部 样例代码 在

https://gitee.com/xiaoyun461/blocking-external-networks

可自行修改