Nginx中配置IP白名单动态刷新的流程步骤

Nginx中配置IP白名单动态刷新的流程步骤需要先看清适用场景和关键步骤，避免只记结论却忽略实际限制。

一：背景

域名访问，动态配置IP白名单，将不可信的IP拒绝访问

二：流程

1、配置脚本

 #!/bin/bash# 配置DB_USER="xxx"DB_PASS="xxx!@#"DB_HOST="xxx"DB_PORT="3306"DB_NAME="mall"DB_TABLE="xxx"IP_COLUMN="ip"# 生成文件路径DB_WHITE_IP_TXT="/etc/nginx/white_ip/tmp/ip_list.txt"NGINX_WHITE_IP_CONF="/etc/nginx/white_ip/white_ip.conf"# 临时文件TMP_FILE="/etc/nginx/white_ip/tmp/white_ip_tmp.conf"# 查询数据库，获取IP列表，生成allow规则mysql -u${DB_USER} -p${DB_PASS} -h${DB_HOST} -P${DB_PORT} -N -e "SELECT ${IP_COLUMN} FROM ${DB_NAME}.${DB_TABLE} where ${IP_COLUMN} != '127.0.0.1';" > ${DB_WHITE_IP_TXT}if [ $? -ne 0 ]; then    echo "$(date '+%F %T') ERROR: 数据库查询失败" >&2    exit 1fi# 清空临时文件> $TMP_FILE# 生成allow规则，过滤掉空行或不合法IP可以用简单正则校验while read ip; do    # 简单 IP 格式校验（IPv4）    if [[ $ip =~ ^([0-9]{1,3}.){3}[0-9]{1,3}$ ]]; then        echo "allow $ip;" >> $TMP_FILE    else        echo "$(date '+%F %T') WARNING: IP格式不正确，忽略 $ip" >&2    fidone < ${DB_WHITE_IP_TXT}# 添加最后一行拒绝所有echo "deny all;" >> $TMP_FILE# 测试Nginx配置语法（include新白名单文件）sudo nginx -tif [ $? -ne 0 ]; then    echo "$(date '+%F %T') ERROR: Nginx配置语法错误，放弃更新" >&2    exit 2fi# 替换白名单配置文件mv $TMP_FILE $NGINX_WHITE_IP_CONFif [ $? -ne 0 ]; then    echo "$(date '+%F %T') ERROR: 替换白名单配置文件失败" >&2    exit 3fi# 重载Nginx配置systemctl reload nginxif [ $? -eq 0 ]; then    echo "$(date '+%F %T') INFO: Nginx重载成功，白名单更新完成"else    echo "$(date '+%F %T') ERROR: Nginx重载失败" >&2    exit 4fiexit 0

2、white_ip.conf

allow 112.345.5.34；。。。。deny all;

3、xxl_ssl.conf

server {    listen 80;    server_name gogs.xxx.com;    return 301 https://$host$request_uri;}server {    listen  443  ssl;    server_name  gogs.xxx.com;   #禁止访问敏感文件   location ~ /. {        deny all;        access_log off;        log_not_found off;    }        location /{        include /etc/nginx/white_ip/white_ip.conf;deny all;proxy_pass http://localhost:3000/;       proxy_set_header Host $host;        proxy_set_header X-Real-IP $remote_addr;        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;        proxy_set_header X-Forwarded-Proto $scheme;}    ssl_certificate /etc/nginx/keys/xxx.com.pem;    ssl_certificate_key /etc/nginx/keys/xxx.com.key;    ssl_session_timeout 5m;    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;    ssl_prefer_server_ciphers on;    error_page 404 /404.html;        location = /40x.html {    }    error_page 500 502 503 504 /50x.html;        location = /50x.html {    }}

4、创建基本临时文件

创建tmp文件下：ip_list.txtwhite_ip_tmp.conf

5、设置crontab

0 * * * * /etc/nginx/white_ip/update_white_ip.sh >> /etc/nginx/white_ip/task_update_white_ip.log 2>&1