Use geoip to restrict access in certain countries and regions

If your m website is for English customers and you may not want to accept access from Chinese IP segments, you can use Apache's geoip module to easily achieve this.

Http://www.maxmind.com/app/mod_geoip

For reference only!

I. Briefly describe the installation process of geoip:


1.
Get the roo permission and prepare an empty directory:
Su mkdir/home/admin/geoip
CD
/Home/admin/geoip

2. Download and install geoip:
Wget Http://www.maxmind.com/download/geoip/a
... Oip.tar.gz

Tar xzfv geoip.tar.gz

CD
Geoip *

./Configure
Make
Make check
Make install
Security
When the software is installed, the default Geo. dat file is generated.
3. download and install the Apache module of geoip:
Mkdir mod_geoip
CD
Mod_geoip

Wget Http://www.maxmind.com/download/geoip/a
... 1.1.tar.gz

Tar xzfv mod_geoip_1.1.1.tar.gz
CD
Mod_geoip_1.1.1

Apxs-CIA-I/usr/local/include-L/usr/local/lib
-Lgeoip mod_geoip.c
Apxs is an Apache
HTTP server tool for compiling and installing extension modules, used to compile one or more sourcesProgramOr targetCodeThe file is a dynamic shared object so that it can use the loadmodule provided by mod_so.
The command is loaded to the Apache server at runtime.
Therefore, to use this extension mechanism, your platform must support the DSO feature, and Apache
Httpd must have built-in mod_so module. The apxs tool can automatically detect whether such conditions are met. You can also use this command to manually detect :,

4.
(Optional) Add the directory/usr/local/lib to the dynamic link library configuration file:
Edit/etc/lD. So. conf
Add a line/usr/local/lib at the bottom of the file
/Usr/Kerberos/lib
/Usr/lib/MySQL
/Usr/x11r6/lib
/Usr/local/lib

However
Then run/sbin/ldconfig/etc/lD. So. conf.
(Step 4 may not need to be done, as if Step 2 will automatically do this, or your system has
After configuration, even if you want to edit lD. So. conf, different Linux directories are different)

5. Check httpd. conf
At this time, you can see the original backup of httpd. conf. The new httpd. config may add a line like this:
Loadmodule
Geoip_module lib/Apache/mod_geoip.so

1). Load Module
Change geoip_module lib/Apache/mod_geoip.so to the actual path of your so, for example:
Loadmodule
Geoip_module/usr/local/libexec/Apache/mod_geoip.so
2). In addmodule
Add a line below mod_geoip.c:
Geoipenable on
The configuration file is as follows:

Reference: Loadmodule geoip_module lib/Apache/mod_geoip.so
Geoipenable on

The
The entry geoipdbfile/usr/local/www/geolitecity. dat is optional.

6. Restart Apache.
Service httpd restart
For FreeBSD, The apachectl restart command may be used.
If you are worried about Conf
File configuration error. You can use apachectl configtest to test it in advance.

Ii. Use geoip to block Chinese IP addresses:


In
After completing step I, and then in the geocity data file, this data file is charged, but the official getlite (a less precise database) is free of charge, storage guide after download
Directory of the server, such as/usr/local/www.
Configure httpd. conf.

Generation
Code: Geoipenable on
Geoipdbfile
/Usr/local/www/geolitecity. dat

Setenvif geoip_country_code CN
Blockcountry
Setenvif geoip_country_code Ru blockcountry
#...
Place more countries here

Deny from Env = blockcountry

#
Optional-use if you want to allow a specific IP address from
Country you denied
# (See
Http://httpd.apache.org/docs/1.3/mod/mod_access.html for more details)
Allow
From 10.1.2.3

Add the above Code to httpd. config.
Note:

Code: Deny from
ENV = blockcountry
Allow from 10.1.2.3

These two lines must be placed in your application
But other lines of code do not have this requirement. Restart Apache after saving the disk to check the changes.

If your application uses a VM
Httpd. conf: AllowOverride all.
In this way, you can write the above configuration to your. htaccess without modifying the httpd. conf file.