Nginx Block And Deny IP Address OR Network Subnets

by on January 13, 2010 · 15 comments· LAST UPDATED January 13, 2010


How do I block or deny access based on the host name or IP address of the client visiting website under nginx web server?

Nginx comes with a simple module called ngx_http_access_module to allow or deny access to IP address. The syntax is as follows:

deny IP;
deny subnet;
allow IP;
allow subnet;
# block all ips
deny    all;
# allow all ips
allow    all;

Note rules are checked in the order of their record to the first match.

How Do I Configure Nginx To Block IPs?

Edit nginx.conf file, enter (note my nginx path is set to /usr/local/nginx/, replace this according to your setup):
# cd /usr/local/nginx/conf/
# vi nginx.conf

Add the following line in http section:

## Block spammers and other unwanted visitors  ##
 include blockips.conf;

Save and close the file. Finally, create blockips.conf in /usr/local/nginx/conf/, enter:
# vi blockips.conf
Append / add entries as follows:


Save and close the file. Test the config file, enter:
# /usr/local/nginx/sbin/nginx -t
Sample outputs:

the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
configuration file /usr/local/nginx/conf/nginx.conf test is successful

Reload the new config, enter:
# /usr/local/nginx/sbin/nginx -s reload

How Do I Deny All and Allow Only Intranet/LAN IPs?

Edit config file as follows:

location / {
  # block one workstation
  # allow anyone in
  # drop rest of the world
  deny    all;

Granted access to network with the exception of the address

How Do I Customize HTTP 403 Forbidden Error Messages?

Create a file called error403.html in default document root, enter:
# cd /usr/local/nginx/html
# vi error403.html

<head><title>Error 403 - IP Address Blocked</title></head>
Your IP Address is blocked. If you this an error, please contact webmaster with your IP at

If SSI enabled, you can display the client IP easily from the html page itself:

Your IP Address is <!--#echo var="REMOTE_ADDR" --> blocked.

Save and close the file. Edit your nginx.conf file, enter:
# vi nginx.conf

# redirect server error pages to the static page
 error_page   403  /error403.html;
 location = /error403.html {
         root   html;

Save and close the file. Reload nginx, enter:
# /usr/local/nginx/sbin/nginx -s reload

See also:


Tweet itFacebook itG+ itDownload PDF versionFound an error/typo on this page?

{ 15 comments… read them below or add one }

1 KKKKK April 14, 2010 at 11:30 am

I am not a administrator. how i can stop 403 error..
Please tell me..
My all downloading is block and e found error 403 & 404..please solve it.


2 nixCraft April 14, 2010 at 11:50 am

You can’t, it is a server side configuration. Only server admin can configure and allow or deny access.


3 Khupcom November 5, 2010 at 9:19 pm

Its working good, but how to redirect blocked IP to 404 page?


4 Camella April 12, 2011 at 1:21 pm

How do I get Live Journal to unblock my IP Adress? Administrators need to make sure that the IP Address that they are blocking is malicious first, and stop blocking genuine customers.


5 panchicore April 14, 2011 at 2:15 am

[emerg]: unknown directive “deny” in blockips.conf


6 p0rsche December 26, 2011 at 6:55 am

include blockips.conf
inside of http brackets:
http {
include blockips.conf
#other options..


7 Duhec July 23, 2011 at 10:38 pm

I have the same problem. Cant google it anyhow.
unknown directive “deny”…

Although nginx -V does not show any signs of “disinclussion” of the module. So I’m guessing its enabled? Any help appreciated.


8 Kelvin Loke October 5, 2011 at 10:28 am

My upstream load balancer use SNAT, so in Nginx it sees all source IP as load balancer IP.

Is there a way in Nginx to find out the real IP of client browser in order to use ngx_http_access_module?



9 nixCraft October 5, 2011 at 12:41 pm

Use X-Real-Ip when request comes from another proxy or L7 load balancer. See how to install and configure HttpRealIpModule.


10 wayne August 30, 2012 at 6:59 pm

Excellent post. I already knew how to use the deny / allow, but didn’t know you could include other files. Idea’s are now brewing in my head.


11 bill April 27, 2013 at 11:36 am

Very interesting article. I notice lots of entries in my access log such as the following
from this morning:

\xFB\x81\xF1`\xC7k\x12L\x09PS\xB8\xDB\xD0\xAC9\xF5 \xE4k\xB0\x80\x929\xCA\x8E\x93e\xF3\xFEf$\x1B\x87z7\x8C\x96Iy\xB1L/K\xB6&\x12\xC3}\x02J\x1E\xBF\xDE\x22\xE5\xA7\xE82\xD7\xE1\xFDo\xF6\x05o\xCC\xCBE&" 400 172 "-" "-"
I presume these are attempts to hack into my site. If so, is there a way to block all attempts which use this type of string. Many thanks, Bill


12 Peter August 22, 2013 at 1:05 pm

I did that but it won’t works. no error but i can visit the site with the block ip. I’m using latest ver of nginx.

have you tested it yourself?


13 Harry DS Alsyundawy December 20, 2013 at 12:47 pm

Excellent post. Tested & Working … Thx


14 Anisuzzaman Khan July 26, 2014 at 1:58 pm

Hi nixcraft, it might be an off-topic but I really need to know about the ip address formatting. On your example you have used “allow″

Does it mean that ip to will be allowed for that specific location? My current IP address is xx.xx.xx.223. When I set something like xx.xx.xx.0/230 nginx through me an error that says. invalid parameter “xx.xx.xx.0/230″

What is the real deal here?


15 ade January 2, 2015 at 11:41 am

I get the same problem. I can specify one IP address ok but when I try a range of IPs like:


I get invalid parameter. Why is this? I want to allow local lan not just one IP address


Leave a Comment

Tagged as: , , , , , , , , , , , , , , , , , ,

Previous Faq:

Next Faq: