---
title: "How to block visitors by country with the NGINX GeoIP Module (Debian/Ubuntu)"
url: "https://alex.zappa.dev/blog/how-to-block-visitors-by-country-with-the-nginx-geoip-module-debianubuntu/"
description: "Block visitors by country using NGINX and the GeoIP module. Install the module and database, configure the nginx.conf file, and test the configuration before restarting nginx. Instructions with examples provided."
---

# How to block visitors by country with the NGINX GeoIP Module (Debian/Ubuntu)

April 14, 2019

*   [#nginx](/tags/nginx/),
*   [#geoip](/tags/geoip/),
*   [#debian](/tags/debian/),
*   [#ubuntu](/tags/ubuntu/)

In the last time, I see a lot of attack from botnet with IPs from eastern europe. Several of my projects aren’t concerned about visitors from those countries, so we just block all of them 🙂

## How block visitors by Country?

This tutorial explains how to use the GeoIP module with NGINX to block visitors by country. This is made possible by the GeoIP database which maps users’ IP addresses to countries. NGINX must be version 1.9.11 or higher, and installed the [HttpGeoipModule](http://nginx.org/en/docs/http/ngx_http_geoip_module.html) to use the GeoIP database.

Actually, it’s pretty easy with the latest Nginx release. I use nginx v1.15.5, which I think the last stable one 🙂

## Let’s start. Install GeoIP module and database.

We need install 3 packages using this command

```
apt-get install nginx-module-geoip geoip-database libgeoip1
```

Perhaps the last one package(libgeoip1) you already have on your server 🙂

After that we have to include new module and rules to file

```
/etc/nginx/nginx.conf
```

Add before _http_ block open:

```
[...]
    # Load GeoIP module
    load_module "modules/ngx_http_geoip_module.so";
[...]
```

Place next block in the _http_ block, before any _include_ lines:

```
[...]
    # ISO codes here https://dev.maxmind.com/geoip/legacy/codes/iso3166/
    geoip_country /usr/share/GeoIP/GeoIP.dat;
    map $geoip_country_code $allowed_country {
        default yes;
        RU no;
        UA no;
        BY no;
    }
[...]
```

Now, this actually doesn’t block any country, it just sets the _$allowed\_country_ variable. To actually block countries, you must open your vhost configuration and place the following code in the _server_ container (this can go inside and also outside any _location_ block):

```
[...]
    if ($allowed_country = no) {
        return 444;
    }
[...]
```

Definitely, you can have a bit more complicated config structure, but this is just example how it’s work.

We return **Error 444 connections closed without response.**

A non-standard status code used to instruct nginx to close the connection without sending a response to the client, most commonly used to deny malicious or malformed requests.

This status code is not seen by the client, it only appears in nginx log files. More information on [nginx documentation](http://nginx.org/en/docs/http/ngx_http_rewrite_module.html#return).

## Test NGINX configuration file

Run command

```
nginx -t
```

You have to see this respond

```
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
```

If your configuration pass the test, restart nginx using _systemctl_

```
systemctl restart nginx
```

Admire your great work ? and test how it’s work with VPN service.

May the 4th be with you,  
Alex

*   [PreviousHow remove .DS\_Store files from a Git repository?](/blog/how-remove-dsstore-files-from-a-git-repository/)
*   [NextWP plugin Elementor Multidomain Support](/blog/wp-plugin-elementor-multidomain-support/)