Nginx 웹서버 설정 - 접속자 제어

Nginx 기본 내장 변수 목록 Embedded Variables list
http://nginx.org/en/docs/http/ngx_http_core_module.html

$remote_addr : client IP
$request : 요청한 url
$status : http response code
$http_user_agent : 브라우저 agent


//-------------------------------------
    - nginx 비교 방식
https://stackoverflow.com/questions/59846238/guide-on-how-to-use-regex-in-nginx-location-block-section

# --------------------------------------------------------------------------------------------------------------------------------------------
# Search-Order       Modifier       Description                                                        Match-Type        Stops-search-on-match
# --------------------------------------------------------------------------------------------------------------------------------------------
#     1st               =           The URI must match the specified pattern exactly                  Simple-string              Yes
#     2nd               ^~          The URI must begin with the specified pattern                     Simple-string              Yes
#     3rd             (None)        The URI must begin with the specified pattern                     Simple-string               No
#     4th               ~           The URI must be a case-sensitive match to the specified Rx      Perl-Compatible-Rx      Yes (first match)                 
#     4th               ~*          The URI must be a case-insensitive match to the specified Rx    Perl-Compatible-Rx      Yes (first match)
#     N/A               @           Defines a named location block.                                   Simple-string              Yes
# --------------------------------------------------------------------------------------------------------------------------------------------

= : 정확히 일치
^~ :  시작부분 일치( if 에는 사용되지 않음)

       - 정규식
~ : 대소문자 구분
~* : 대소문자 구분 안함

-------------------------------------------------------------------------------
* IP로 차단

$ sudo nano /etc/nginx/nginx.conf

http {
...
# nginx가 실제 IP 인식하게 설정
    set_real_ip_from 172.16.0.0/12;  # 로드 밸랜서의 IP

    # X-Forwarded-For 헤더에서 실제 IP를 가져옴
    real_ip_header X-Forwarded-For;
    
    # 헤더에 여러 IP가 있을 경우, 가장 오른쪽 IP를 사용
    real_ip_recursive on;

# 차단할 IP 목록을 정의하는 geo 블록
    geo $blocked_ip {
        default 0; # 기본값은 0 (차단 안 함)

        # 차단할 IP 목록
        123.123.123.123     1;
        123.123.123.0/24    1; # 범위로 차단
    }
...
}

$ sudo nano /etc/nginx/sites-enabled/default

server {
...
if ($blocked_ip) {
            return 404; # 기본 403(Forbidden) 대신 404(Not Found) 반환
    }
...
}

    -  설정 검사
sudo nginx -t

    - 변경된 설정으로 변경
sudo systemctl reload nginx

 

-------------------------------------------------------------------------------
* NginX 설정 파일 (conf) 수정
    -  server {  ...  안에서 작동


    - 브라우저 agent로 막기
if ($http_user_agent ~* (python-requests|badBot|LieBaoFast|UCBrowser|MQQBrowser|Mb2345Browser) ) {
    return 404; # 기본 403(Forbidden) 대신 404(Not Found) 반환
}

    - 접속 IP로 막기
if ($remote_addr ~ (10.1.1.1|10.1.1.2) ) {
    return 404;
}

    - 접속 요청하는 url로 막기
if ($request ~* (getAdmin|hackAdmin) ) {
    return 404;
}

   -  Referer 에  "q=testing" 이 포함되면 막기
    if ($http_referer ~* "q=testing") {
        return 404;
    }

 

-------------------------------------------------------------------------------

http 반환 코드 설명 (HTTP response status codes)

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status

 

400 Bad Request
클라이언트가 잘못된 요청을 보냈을 때 (잘못된 문법, 파라미터 등).

401 Unauthorized
인증 필요. 로그인/토큰 없음 또는 잘못된 경우.

403 Forbidden
접근 금지. 권한이 없어도 리소스는 존재.

404 Not Found
요청한 리소스가 서버에 없음.

408 Request Timeout
클라이언트가 너무 늦게 요청을 보냄.

429 Too Many Requests
너무 많은 요청(과도한 rate limit 초과).
→ nginx limit_req 모듈에서 흔히 사용.


500 Internal Server Error
서버 내부 오류. 원인을 특정하기 어려운 일반적 에러.

503 Service Unavailable
서버 과부하, 점검 중 등으로 서비스 불가.
(일시적 문제를 나타내며, 재시도하면 될 수 있음)

504 Gateway Timeout

444 - nginx 특수 반환 코드 (표준 아님)
nginx가 응답 헤더/본문 없이 TCP 연결을 그냥 끊어버림.
(주로 악성 트래픽, 불법 크롤러 차단용. 클라이언트는 에러 메시지 없이 연결 종료 경험)