NGINX防止CC攻击
1.geo指令定义了一个白名单
2.使用map指令映射搜索引擎客户端的ip为空串，如果不是搜索引擎就显示本身真实的ip，这样搜索引擎ip就不能存到limit_req_zone内存session中，所以不会限制搜索引擎的ip访问
3.ngx_http_limit_req_module模块
1
2
3
4
5
6
7
8
| limit_req_zone $binary_remote_addr zone=perip:10m rate=1r/s;
limit_req_zone $server_name zone=perserver:10m rate=10r/s;
server {
...
limit_req zone=perip burst=5 nodelay;
limit_req zone=perserver burst=10;
}
|
nginx.conf文件
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
| http{
#定义白名单 limited
geo $limited{
default 1;
172.16.130.40/32 0;
}
#自定义$limit
map $limited $limit {
1 $binary_remote_addr;
0 "";
}
map $limited $limit_server_name {
1 $server_name;
0 "";
}
limit_req_zone $limit zone=perip:10m rate=1r/s;
limit_req_zone $limit_server_name zone=perserver:10m rate=1r/s;
include ssl.conf;
}
|
ssl.conf文件
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
| server {
server_name 127.0.0.1;
listen 444;
listen [::]:444;
ssl on;
ssl_certificate /Data/apps/nginx/conf/33iq.crt;
ssl_certificate_key /Data/apps/nginx/conf/33iq_nopass.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
client_max_body_size 512M;
root /Data/apps/wwwroot/firewall/apps/admin;
index index.html index.htm index.php;
location / {
limit_req zone=perip burst=5 nodelay;
limit_req zone=perserver burst=10;
index index.htm index.html index.php;
if (!-e $request_filename){
rewrite ^(.*)$ /index.php last;
}
}
location ~ \.php(.*)$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
include fastcgi_params;
}
}
|
https://blog.csdn.net/u012566181/article/details/49968283
http://nginx.org/en/docs/http/ngx_http_limit_req_module.html
http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html