README, nginx, iptables, vk, mail.ru

blacklists_nginx/README.md

@@ -0,0 +1,302 @@
+# Nginx Blacklist Configurations
+
+Auto-generated nginx configuration files for blocking networks and IP addresses.
+
+## Available Files
+
+### Mixed IPv4/IPv6
+
+- **`blacklist.conf`** - Contains both IPv4 and IPv6 deny rules (809 entries)
+
+### IPv4 Only
+
+- **`blacklist-v4.conf`** - Contains only IPv4 deny rules (806 entries)
+
+### IPv6 Only
+
+- **`blacklist-v6.conf`** - Contains only IPv6 deny rules (3 entries)
+
+## Usage
+
+### Basic Usage
+
+Include the desired configuration file in your nginx `server` or `location` block:
+
+```nginx
+server {
+    listen 80;
+    server_name example.com;
+
+    # Include the blacklist
+    include /path/to/blacklist.conf;
+
+    location / {
+        # your configuration
+    }
+}
+```
+
+### Separate IPv4/IPv6 Files
+
+For more granular control, use separate files:
+
+```nginx
+server {
+    listen 80;
+    listen [::]:80;
+    server_name example.com;
+
+    # Include both IPv4 and IPv6 blacklists
+    include /path/to/blacklist-v4.conf;
+    include /path/to/blacklist-v6.conf;
+
+    location / {
+        # your configuration
+    }
+}
+```
+
+### HTTP Block Level
+
+Apply the blacklist globally to all virtual hosts:
+
+```nginx
+http {
+    # Apply blacklist globally
+    include /path/to/blacklist.conf;
+
+    server {
+        listen 80;
+        server_name example.com;
+        # ...
+    }
+
+    server {
+        listen 80;
+        server_name another.com;
+        # ...
+    }
+}
+```
+
+### Location Block Level
+
+For selective blocking within specific locations:
+
+```nginx
+server {
+    listen 80;
+    server_name example.com;
+
+    location /admin {
+        # Apply blacklist only to admin area
+        include /path/to/blacklist.conf;
+        # ...
+    }
+
+    location /public {
+        # Public area without blacklist
+        # ...
+    }
+}
+```
+
+## Testing Configuration
+
+After adding the blacklist, always test your nginx configuration:
+
+```bash
+# Test configuration
+nginx -t
+
+# Reload nginx if test passes
+nginx -s reload
+# or
+systemctl reload nginx
+```
+
+## Custom Response
+
+By default, denied IPs receive a connection drop. To customize the response:
+
+```nginx
+server {
+    listen 80;
+    server_name example.com;
+
+    # Return custom error page
+    error_page 403 /403.html;
+
+    include /path/to/blacklist.conf;
+
+    location = /403.html {
+        root /usr/share/nginx/html;
+        internal;
+    }
+}
+```
+
+Note: For large blacklists, using `deny` directives (as in these files) is more efficient than `if` statements.
+
+## Performance Considerations
+
+- **Deny directives** are processed in order and stop at the first match
+- For optimal performance, most frequently matched IPs should be at the top
+- Current files are sorted for consistency
+- Nginx handles hundreds of deny rules efficiently
+- For very large blacklists (10,000+ entries), consider using:
+  - Nginx GeoIP2 module for geographic blocking
+  - nftables/iptables at the firewall level for better performance
+  - Stream module for TCP/UDP level blocking
+
+## Integration Examples
+
+### Docker Deployment
+
+```dockerfile
+FROM nginx:alpine
+
+# Copy blacklist
+COPY blacklist.conf /etc/nginx/blacklist.conf
+
+# Copy nginx config that includes the blacklist
+COPY nginx.conf /etc/nginx/nginx.conf
+
+EXPOSE 80 443
+CMD ["nginx", "-g", "daemon off;"]
+```
+
+### Kubernetes ConfigMap
+
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-blacklist
+data:
+  blacklist.conf: |
+    # Include blacklist content here
+    deny 109.124.119.88/29;
+    deny 109.124.66.128/30;
+    # ...
+```
+
+### Automated Updates
+
+Set up a cron job to automatically fetch the latest blacklist:
+
+```bash
+#!/bin/bash
+# /etc/cron.daily/update-nginx-blacklist
+
+# Download latest blacklist
+wget -q https://raw.githubusercontent.com/C24Be/AS_Network_List/main/blacklists_nginx/blacklist.conf \
+  -O /etc/nginx/blacklist.conf.new
+
+# Test nginx configuration
+nginx -t -c /etc/nginx/nginx.conf
+
+# If test passes, reload nginx
+if [ $? -eq 0 ]; then
+    mv /etc/nginx/blacklist.conf.new /etc/nginx/blacklist.conf
+    systemctl reload nginx
+    echo "Blacklist updated successfully"
+else
+    rm /etc/nginx/blacklist.conf.new
+    echo "Nginx config test failed, blacklist not updated"
+fi
+```
+
+## Logging Blocked Requests
+
+To log denied requests:
+
+```nginx
+server {
+    listen 80;
+    server_name example.com;
+
+    # Custom log format for denied IPs
+    log_format blocked '$remote_addr - $remote_user [$time_local] '
+                      '"$request" 403 0 '
+                      '"$http_referer" "$http_user_agent"';
+
+    access_log /var/log/nginx/blocked.log blocked;
+
+    include /path/to/blacklist.conf;
+
+    location / {
+        # your configuration
+    }
+}
+```
+
+## Monitoring
+
+Check how many IPs are being blocked:
+
+```bash
+# Count deny rules
+grep -c "deny" /path/to/blacklist.conf
+
+# Check blocked access logs
+tail -f /var/log/nginx/blocked.log
+
+# Count blocked requests today
+grep "$(date +%d/%b/%Y)" /var/log/nginx/access.log | grep " 403 " | wc -l
+```
+
+## Troubleshooting
+
+### Configuration Test Fails
+
+```bash
+# Check syntax
+nginx -t
+
+# Check for duplicate includes
+grep -r "include.*blacklist" /etc/nginx/
+
+# Verify file permissions
+ls -l /path/to/blacklist.conf
+```
+
+### Legitimate Users Blocked
+
+Check if their IP is in the blacklist:
+
+```bash
+grep "YOUR_IP" /path/to/blacklist.conf
+```
+
+Whitelist specific IPs before applying the blacklist:
+
+```nginx
+server {
+    listen 80;
+    server_name example.com;
+
+    # Whitelist before blacklist
+    allow 192.168.1.100;  # Trusted IP
+
+    # Then apply blacklist
+    include /path/to/blacklist.conf;
+
+    # Deny all others not explicitly allowed
+    # deny all;  # Optional
+}
+```
+
+## Automatic Updates
+
+These files are automatically regenerated daily when the blacklists are updated via the GitHub Actions workflow.
+
+## Source
+
+Generated from the blacklist files in the `blacklists/` directory by `blacklists_updater_nginx.sh`.
+
+## See Also
+
+- [IPTables/IPSet Format](../blacklists_iptables/README.md) - For firewall-level blocking
+- [Text Format](../blacklists/README.md) - For custom integrations
+- [Main Repository](https://github.com/C24Be/AS_Network_List) - Complete documentation