Nginx Block And Deny IP Address OR Network Subnets

How do I block or deny access based on the host name or IP address of the client visiting website under nginx web server?

Nginx comes with a simple module called ngx_http_access_module to allow or deny access to IP address. The syntax is as follows:

deny IP;
deny subnet;
allow IP;
allow subnet;
# block all ips
deny    all;
# allow all ips 
allow    all;

Note rules are checked in the order of their record to the first match.

How Do I Configure Nginx To Block IPs?

Edit nginx.conf file, enter (note my nginx path is set to /usr/local/nginx/, replace this according to your setup):
# cd /usr/local/nginx/conf/
# vi nginx.conf

Add the following line in http section:

## Block spammers and other unwanted visitors  ##
 include blockips.conf;

Save and close the file. Finally, create blockips.conf in /usr/local/nginx/conf/, enter:
# vi blockips.conf
Append / add entries as follows:


Save and close the file. Test the config file, enter:
# /usr/local/nginx/sbin/nginx -t
Sample outputs:

the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
configuration file /usr/local/nginx/conf/nginx.conf test is successful

Reload the new config, enter:
# /usr/local/nginx/sbin/nginx -s reload

How Do I Deny All and Allow Only Intranet/LAN IPs?

Edit config file as follows:

location / {
  # block one workstation
  # allow anyone in
  # drop rest of the world 
  deny    all;

Granted access to network with the exception of the address

How Do I Customize HTTP 403 Forbidden Error Messages?

Create a file called error403.html in default document root, enter:
# cd /usr/local/nginx/html
# vi error403.html

<head><title>Error 403 - IP Address Blocked</title></head>
Your IP Address is blocked. If you this an error, please contact webmaster with your IP at

If SSI enabled, you can display the client IP easily from the html page itself:

Your IP Address is <!--#echo var="REMOTE_ADDR" --> blocked.

Save and close the file. Edit your nginx.conf file, enter:
# vi nginx.conf

# redirect server error pages to the static page
 error_page   403  /error403.html;
 location = /error403.html {
         root   html;

Save and close the file. Reload nginx, enter:
# /usr/local/nginx/sbin/nginx -s reload

See also:


🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 19 comments so far... add one

CategoryList of Unix and Linux commands
Disk space analyzersncdu pydf
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network UtilitiesNetHogs dig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
19 comments… add one
  • KKKKK Apr 14, 2010 @ 11:30

    I am not a administrator. how i can stop 403 error..
    Please tell me..
    My all downloading is block and e found error 403 & 404..please solve it.

    • 🐧 nixCraft Apr 14, 2010 @ 11:50

      You can’t, it is a server side configuration. Only server admin can configure and allow or deny access.

  • Khupcom Nov 5, 2010 @ 21:19

    Its working good, but how to redirect blocked IP to 404 page?

  • Camella Apr 12, 2011 @ 13:21

    How do I get Live Journal to unblock my IP Adress? Administrators need to make sure that the IP Address that they are blocking is malicious first, and stop blocking genuine customers.

  • panchicore Apr 14, 2011 @ 2:15

    [emerg]: unknown directive “deny” in blockips.conf

    • p0rsche Dec 26, 2011 @ 6:55

      include blockips.conf
      inside of http brackets:
      http {
      include blockips.conf
      #other options..

  • Duhec Jul 23, 2011 @ 22:38

    I have the same problem. Cant google it anyhow.
    unknown directive “deny”…

    Although nginx -V does not show any signs of “disinclussion” of the module. So I’m guessing its enabled? Any help appreciated.

  • Kelvin Loke Oct 5, 2011 @ 10:28

    My upstream load balancer use SNAT, so in Nginx it sees all source IP as load balancer IP.

    Is there a way in Nginx to find out the real IP of client browser in order to use ngx_http_access_module?


    • 🐧 nixCraft Oct 5, 2011 @ 12:41

      Use X-Real-Ip when request comes from another proxy or L7 load balancer. See how to install and configure HttpRealIpModule.

  • wayne Aug 30, 2012 @ 18:59

    Excellent post. I already knew how to use the deny / allow, but didn’t know you could include other files. Idea’s are now brewing in my head.

  • bill Apr 27, 2013 @ 11:36

    Very interesting article. I notice lots of entries in my access log such as the following
    from this morning:

    \xFB\x81\xF1`\xC7k\x12L\x09PS\xB8\xDB\xD0\xAC9\xF5 \xE4k\xB0\x80\x929\xCA\x8E\x93e\xF3\xFEf$\x1B\x87z7\x8C\x96Iy\xB1L/K\xB6&\x12\xC3}\x02J\x1E\xBF\xDE\x22\xE5\xA7\xE82\xD7\xE1\xFDo\xF6\x05o\xCC\xCBE&" 400 172 "-" "-"
    I presume these are attempts to hack into my site. If so, is there a way to block all attempts which use this type of string. Many thanks, Bill
  • Peter Aug 22, 2013 @ 13:05

    I did that but it won’t works. no error but i can visit the site with the block ip. I’m using latest ver of nginx.

    have you tested it yourself?

  • Harry DS Alsyundawy Dec 20, 2013 @ 12:47

    Excellent post. Tested & Working … Thx

  • Anisuzzaman Khan Jul 26, 2014 @ 13:58

    Hi nixcraft, it might be an off-topic but I really need to know about the ip address formatting. On your example you have used “allow”

    Does it mean that ip to will be allowed for that specific location? My current IP address is xx.xx.xx.223. When I set something like xx.xx.xx.0/230 nginx through me an error that says. invalid parameter “xx.xx.xx.0/230”

    What is the real deal here?

  • ade Jan 2, 2015 @ 11:41

    I get the same problem. I can specify one IP address ok but when I try a range of IPs like:


    I get invalid parameter. Why is this? I want to allow local lan not just one IP address

  • TiTex Sep 23, 2015 @ 7:34

    Does anybody know a solution for a setup like:
    – i have 100+ vhosts
    – i have one htaccess file with all the users/passwords for basic auth
    – for some of the vhosts , i want it to set so that for some specific vhosts only one or more specific users from htaccess file would have access , and i don’t want to create another htaccess file for those vhosts.

    this is the relevant part from my active apache2 configuration that i want to convert to nginx

    AuthUserFile /var/htpasswd/htpasswd
    AuthType Basic
    AuthName “Auth Required”
    Satisfy Any

    Order Deny,Allow
    Deny from all
    Allow from x.x.x.x
    Allow from x.x.x.x
    Require user user_name

  • Wolfram Dec 28, 2015 @ 10:29

    The /24 is not a range like 0..24. It specifies a bitmask, in this case the first 24 bits should be relevant. As there are 8 bits between each dot of an IP adress, this means that the first three numbers are relevant and the number after the last dot may be anything from 0 to 255. So you should be fine because covers evrerything form to

  • LAYSHA Dec 29, 2015 @ 22:33

    Unblock Smallworlds i can’t get on the website now i want my ip address back

  • Ali Oct 12, 2016 @ 0:45

    Hello there,

    I have 5 servers running behind load balancers.
    What is the best way to implement this configuration? NFS storage? OR rsync to sync the file?

    Please advise.

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Still have questions? Post it on our forum