Japanatron Logo

I've been figuring out how to block or redirect web traffic in Nginx based on the country geoIP.

NOTES
* You need the package nginx-extras for this because this package has the geoIP Nginx plugin.
* I used Japan (JP) in these examples, so change the country code to whatever you wish.

APPROACH #1 - BASIC
This uses a locally-downloaded GeoIP database.

I. This goes in the HTTP block. It basically flags traffic from countries you specify.

# DETECT JAPAN TRAFFIC
geoip_country /usr/share/GeoIP/GeoIP.dat;
map $geoip_country_code $allow_visit {
default yes;
JP no;
}

II. This goes in the SERVER block. It sets the action you want on the country IP flag you set.

# BLOCK ACCESS FROM JAPAN
if ($allow_visit = no) {
deny all ;
}

** Alternatively, you could redirect the traffic somewhere instead of outright blocking it...

# REDIRECT JAPAN TRAFFIC
if ($allow_visit = no) {
return 301 https://www.japanatron.com/ ;
}

APPROACH #2 - ADVANCED
This approach allows you to set exceptions, like for whitelisted IP addresses.

I. This goes in the HTTP block:

# DETECT JAPAN TRAFFIC
geoip_country /usr/share/GeoIP/GeoIP.dat;
map $geoip_country_code $allowed_country {
default yes;
JP no;
}

geo $exclusions {
default 0;
111.222.333.444/32 1;
}

II. This goes in the SERVER block:

# REDIRECT JAPAN TRAFFIC
if ($allowed_country = yes) {
set $exclusions 1;
}

if ($exclusions = "0") {
return 301 https://www.japanatron.com ;
}

APPROACH #3 - CLOUDFLARE IP COUNTRY HEADER
If you use Cloudflare's reverse proxy / CDN service, you can read the geoIP information from Cloudflare's headers. This is my favorite approach because it doesn't require locally downloading and maintaining a geoIP database.

I. This goes in the HTTP block:

# DETECT JAPAN TRAFFIC (CLOUDFLARE HEADER)
map $http_cf_ipcountry $allowed_country {
default yes;
JP no;
}

geo $exclusions {
default 0;
111.222.333.444/32 1;
}

II. This goes in the SERVER block:

# REDIRECT JAPAN TRAFFIC
if ($allowed_country = yes) {
set $exclusions 1;
}

if ($exclusions = "0") {
return 301 https://www.japanatron.com ;
}

Related Articles

RDP - Enable Remote Desktop in...

1. Open registry editor (regedt32) and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server.  Registry editor can also connect to rem...

Kingston USB Drive Not Working...

I upgraded to MacOS El Capitan and to my chagrin my Kingston USB drive no longer works.  I get some stupid "Unable to start DTXX application" or "ERR_COULD_NOT_...

Roku - Blocking Hard-Coded DNS

The Roku media player has Google's free public DNS (8.8.8.8) hard-coded into it.  This is great for DNS redundancy, but totally sucks if you use an unblock serv...

Windows - Install Fonts Via Co...

I found this awesome Windows powershell script that allows you to install fonts via the command line.  This is very convenient for mass deployment.$ssfFonts = 0...