Geo Blocking in Nginx

Geo blocking is a technique for blocking whole regions from viewing your website. I’ll avoid the technical details of how for two reasons.

1. Most people don’t care and going into them will just make this post even more boring to read.
2. I only have a high level understanding of them myself.

There are many reasons you might want to geo block. However, for me, my target audience is people in the US, Canada, and Great Britain. I don’t really care about serving my content outside of these places. Great Britain only made the list because I have a family member there and therefore grace has been granted to it.

Prerequisites.

• This post only covers nginx, because that is what I use.
• I am assuming:
  • you know your way around a terminal.
  • you are using ubuntu.

Configuration

It was surprisingly easy to configure this. Somehow when I set up the server way-back-when I had already installed the tools I would need to do this—or they were included, I can’t say.

nginx.conf Changes

First, I had to update the main config file for nginx. Usually this is located at /etc/nginx/nginx.conf on your server. I had to set up a whitelist, or sometimes called an “allowlist”. Which is just a way to block everything by default except what you explicitly allow. In contrast, a blacklist–or “blocklist”–would allow anything except what you disallow. I prefer the former because it’s easier to just block everything and then add your exceptions. In my opinion, at least.

http {
    //... rest of configuration

+   geoip_country /usr/share/GeoIP/GeoIP.dat;

+   map $geoip_country_code $allowed_country {
+       default no;
+       US yes;
+       CA yes;
+       GB yes;
+   }

    //... rest of configuration
}

To summarize the above additions:

1. I import a list of IP address groupings or ranges by country
2. I map (step through) over each code in geoip_country. By default I say no. Below default I add in my exceptions: US, CA, and GB as yes

mywebsite.conf Changes

Next I have to use the $allowd_country in my website configuration. Which means adding the below to the config file for my site.

server {
    //... rest of configuration.

+   if ($allowed_country = no) {
+       return 403;
+   }

    //... rest of configuration.
}

Again, to summarize:

1. If $allowed_country is no then send a 403 code. All the code is, is a signal to the person or software requesting my site that they are not allowed to see it.

Just sending a code is not very “friendly” in the UX sense. I can and probably will make a custom webpage that a user will see that will explain why they can’t see the site. If you have the ability to make custom error pages I think it’s good practice. Mainly because it’s a way to give more meaningful information, not to mention be creative, and maintain your branding.

Troubleshooting

I don’t believe I can provide much help here. I don’t know anything about your system. Regardless, here some tips and resources for you.

• use nginx -t in your terminal. It will test your configs and let you know if there are errors.
• I read the following and was able to piece together what I needed to do.
  • Nginx Geo blocking Documentation
  • thelinuxcode.com
  • Sling Academy Guide

The two problem I encountered where the follwing:

In nginx.conf I had this near the top of the file before the http block.

- load_module /path/to/geoip/module

I realized I didn’t need it because on my server the geoip module was already loaded.

The other thing was that I used the wrong database. I downloaded one called dbip because it was free, however I learned later that my server came with GeoIP already setup. Also the dbip was not in a format the Geo Blocking module could understand

-   geoip_country /usr/share/GeoIP/dbip-country.dat
+   geoip_country /usr/share/GeoIP/GeoIP.dat;