How to set directory whitelist and ip whitelist in nginx
1. Set the directory whitelist: There is no restriction on the specified request path. If there is no restriction on the request path to the api directory, it can be written as
server{ location /app { proxy_pass http://192.168.1.111:8095/app; limit_conn conn 20; limit_rate 500k; limit_req zone=foo burst=5 nodelay; } location /app/api { proxy_pass http://192.168.1.111:8095/app/api } } # 因nginx会优先进行精准匹配,所以以上写法即接触了对api目录下属路径的限制
2. To set the IP whitelist, you need to use nginx geo and nginx map
If there is no manual deletion (--without-http_geo_module or --without-http_map_module), nginx loads it by default ngx-http-geo-module and ngx-http-map-module related content;
ngx-http-geo-module can be used to create variables, the variable value depends on the client ip address;
ngx-http-map-module can create variables based on other variables and variable values, which allows classification, or mapping multiple variables to different values and storing them in one variable;
nginx geo 格式说明 syntax ( 语法格式 ): geo [$address] $variable { ... } default ( 默认 ): - content ( 配置段位 ): http nginx map 格式说明 syntax ( 语法格式 ): map string $variable { ... } default ( 默认 ):- content ( 配置段位 ): http 白名单配置示例 http{ # ... 其他配置内容 #定义白名单ip列表变量 geo $whiteiplist { default 1 ; 127.0.0.1/32 0; 64.223.160.0/19 0; } #使用map指令映射将白名单列表中客户端请求ip为空串 map $whiteiplist $limit{ 1 $binary_remote_addr ; 0 ""; } #配置请求限制内容 limit_conn_zone $limit zone=conn:10m; limit_req_zone $limit zone=allips:10m rate=20r/s; server{ location /yourapplicationname { proxy_pass http://192.168.1.111:8095/app; limit_conn conn 50; limit_rate 500k; limit_req zone=allips burst=5 nodelay; } } } 白名单配置可用于对合作客户,搜索引擎等请求过滤限制 #(特殊情况处理) #如果想仅限制指定的请求,如:只限制post请求,则: http{ # 其他请求.. #请求地址map映射 map $request_method $limit { default ""; post $binary_remote_addr; } #限制定义 limit_req_zone $limit zone=reqlimit:20m rate=10r/s; server{ ... #与普通限制一致 } } #在此基础上,想进行指定方法的白名单限制处理,则: http{ #... #定义白名单列表 map $whiteiplist $limitips{ 1 $binary_remote_addr; 0 ""; } #基于白名单列表,定义指定方法请求限制 map $request_method $limit { default ""; # post $binary_remote_addr; post $limitips; } #对请求进行引用 limit_req_zone $limit zone=reqlimit:20m rate=10r/s; #在server中进行引用 server{ #... 与普通限制相同 } }
The above is the detailed content of How to set directory whitelist and ip whitelist in nginx. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

ArtGPT
AI image generator for creative art from text prompts.

Stock Market GPT
AI powered investment research for smarter decisions

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

1. The first choice for the Laravel MySQL Vue/React combination in the PHP development question and answer community is the first choice for Laravel MySQL Vue/React combination, due to its maturity in the ecosystem and high development efficiency; 2. High performance requires dependence on cache (Redis), database optimization, CDN and asynchronous queues; 3. Security must be done with input filtering, CSRF protection, HTTPS, password encryption and permission control; 4. Money optional advertising, member subscription, rewards, commissions, knowledge payment and other models, the core is to match community tone and user needs.

When Nginx experiences a "Toomyopenfiles" error, it is usually because the system or process has reached the file descriptor limit. Solutions include: 1. Increase the soft and hard limits of Linux system, set the relevant parameters of nginx or run users in /etc/security/limits.conf; 2. Adjust the worker_connections value of Nginx to adapt to expected traffic and ensure the overloaded configuration; 3. Increase the upper limit of system-level file descriptors fs.file-max, edit /etc/sysctl.conf and apply changes; 4. Optimize log and resource usage, and reduce unnecessary file handle usage, such as using open_l

The core role of Homebrew in the construction of Mac environment is to simplify software installation and management. 1. Homebrew automatically handles dependencies and encapsulates complex compilation and installation processes into simple commands; 2. Provides a unified software package ecosystem to ensure the standardization of software installation location and configuration; 3. Integrates service management functions, and can easily start and stop services through brewservices; 4. Convenient software upgrade and maintenance, and improves system security and functionality.

To solve the problem of inconsistency between PHP environment and production, the core is to use Kubernetes' containerization and orchestration capabilities to achieve environmental consistency. The specific steps are as follows: 1. Build a unified Docker image, including all PHP versions, extensions, dependencies and web server configurations to ensure that the same image is used in development and production; 2. Use Kubernetes' ConfigMap and Secret to manage non-sensitive and sensitive configurations, and achieve flexible switching of different environment configurations through volume mounts or environment variable injection; 3. Ensure application behavior consistency through unified Kubernetes deployment definition files (such as Deployment and Service) and include in version control; 4.

1. The mainstream frameworks of PHP e-commerce backend include Laravel (fast development, strong ecology), Symfony (enterprise-level, stable structure), Yii (excellent performance, suitable for standardized modules); 2. The technology stack needs to be equipped with MySQL Redis cache, RabbitMQ/Kafka message queue, Nginx PHP-FPM, and front-end separation is considered; 3. High concurrency architecture should be layered and modular, database read and write separation/distributed database, accelerated with cache and CDN, asynchronous processing of tasks, sharing of load balancing and Session, gradually microservice, and establish a monitoring and alarm system; 4. Multiple monetization paths include product price difference or platform commission, site advertising, SaaS subscription, customized development and plug-in market, API connection

In NGINX configuration, the @ symbols within the location block are used to define named locations. These are internally used endpoints and cannot be matched directly by the client request. They are usually called via the error_page, try_files, or rewrite directives. 1. The naming location starts with @. For example, location@notfound will not respond to direct requests, but trigger from other configuration parts; 2. It is often used for custom error handling, internal routing and backend agent backing; 3. For example, combined with try_files, forwarding to @backend when static files do not exist; 4. Notes include: not directly accessed, avoiding naming conflicts, and using descriptive names. Named locations can include

After modifying the Nginx configuration, you should first test the syntax and then reload the service. 1. Use nginx-t to check the configuration file syntax. If the prompt "syntaxisok" and "testissuccessful" are prompted, it means that it is correct; if there is an error, the specific problem line will be displayed. 2. If the configuration file permissions are high, you need to use sudonginx-t to execute. 3. Confirm that the test is actually loaded. You can specify the path through nginx-t-c/path/to/your/nginx.conf, or view the configuration file used by the main process through ps-ef|grepnginx. 4. After the test is passed, execute sudonginx-sreload overload service to make the new configuration take effect

To configure the PHP environment to support MongoDB, the core step is to install and enable the PHP driver of MongoDB to enable the PHP application to communicate with the MongoDB database. 1. Install MongoDBPHP driver, it is recommended to use PECL to install. If there is no PECL, you need to first install the PHP development package and related compilation tools; 2. Edit the php.ini file and add extension=mongodb.so (or .dll) to enable the extension; 3. Restart the web server or PHP-FPM service to make the configuration take effect; 4. Verify whether the extension is loaded successfully through phpinfo() or php-m. Frequently asked questions include missing PECL commands, compilation errors, php.ini
