构建一个深度防御（Defense-in-Depth）体系、防止被攻击

有风险就加上封禁IP

1. /etc/nginx/blocked-ips.conf

# ============================================================
# Nginx IP 封禁列表
# 格式: IP地址 1;
# 总计: 190+ 个恶意IP
# ============================================================

# ---- 美国攻击源 (209.50.x.x) ----
209.50.187.165 1;
209.50.189.129 1;
209.50.174.41 1;
209.50.180.27 1;
209.50.176.158 1;
209.50.164.188 1;
209.50.181.252 1;
209.50.189.214 1;
209.50.169.36 1;
209.50.183.196 1;
209.50.181.211 1;
209.50.170.22 1;
209.50.171.215 1;
209.50.172.199 1;
209.50.178.155 1;
209.50.165.165 1;
209.50.185.70 1;
209.50.169.202 1;
209.50.176.69 1;
209.50.178.65 1;
209.50.170.180 1;
209.50.180.0 1;
209.50.178.174 1;
209.50.182.150 1;
209.50.168.253 1;
209.50.168.20 1;
209.50.179.117 1;
209.50.186.251 1;
209.50.160.241 1;
209.50.189.157 1;
209.50.179.115 1;
209.50.181.85 1;
209.50.167.217 1;
209.50.176.182 1;
209.50.180.57 1;
209.50.169.210 1;
209.50.167.88 1;
209.50.161.177 1;
209.50.188.219 1;
209.50.169.213 1;
209.50.163.82 1;
209.50.189.226 1;
209.50.176.234 1;
209.50.179.27 1;
209.50.164.189 1;
209.50.168.230 1;
209.50.182.164 1;
209.50.173.25 1;
209.50.161.192 1;
209.50.166.19 1;
209.50.160.56 1;

# ---- 加拿大攻击源 (104.207.x.x) ----
104.207.37.194 1;
104.207.63.20 1;
104.207.52.180 1;
104.207.32.41 1;
104.207.49.80 1;
104.207.35.204 1;
104.207.52.187 1;
104.207.36.6 1;
104.207.36.58 1;
104.207.53.104 1;
104.207.59.107 1;
104.207.33.147 1;
104.207.39.254 1;
104.207.54.248 1;
104.207.41.84 1;
104.207.37.95 1;
104.207.38.139 1;
104.207.55.179 1;
104.207.61.141 1;
104.207.34.191 1;
104.207.39.181 1;
104.207.51.83 1;
104.207.63.15 1;
104.207.55.4 1;
104.207.46.239 1;
104.207.51.119 1;
104.207.38.4 1;
104.207.54.17 1;
104.207.56.158 1;
104.207.44.120 1;
104.207.44.154 1;
104.207.41.174 1;
104.207.50.105 1;
104.207.60.177 1;
104.207.36.255 1;
104.207.52.102 1;
104.207.32.8 1;
104.207.40.101 1;
104.207.63.37 1;
104.207.50.13 1;
104.207.50.101 1;
104.207.53.142 1;
104.207.34.48 1;
104.207.32.21 1;
104.207.47.171 1;
104.207.45.69 1;
104.207.58.42 1;

# ---- 美国攻击源 (65.111.x.x) ----
65.111.21.110 1;
65.111.21.76 1;
65.111.22.103 1;
65.111.5.34 1;
65.111.23.170 1;
65.111.9.133 1;
65.111.30.114 1;
65.111.30.38 1;
65.111.6.52 1;
65.111.23.66 1;
65.111.27.20 1;
65.111.7.209 1;
65.111.11.50 1;
65.111.20.110 1;
65.111.13.239 1;
65.111.26.33 1;
65.111.2.71 1;
65.111.30.52 1;
65.111.25.234 1;
65.111.2.105 1;
65.111.6.75 1;
65.111.7.81 1;
65.111.2.238 1;
65.111.25.6 1;
65.111.25.61 1;
65.111.3.80 1;
65.111.29.22 1;
65.111.27.81 1;
65.111.10.238 1;
65.111.2.92 1;
65.111.29.176 1;
65.111.30.197 1;
65.111.23.179 1;
65.111.1.58 1;
65.111.4.7 1;
65.111.31.224 1;
65.111.15.109 1;
65.111.0.87 1;
65.111.0.174 1;
65.111.15.131 1;
65.111.11.109 1;
65.111.20.34 1;
65.111.24.11 1;
65.111.7.178 1;
65.111.0.211 1;

# ---- 欧洲攻击源 (45.3.x.x) ----
45.3.45.132 1;
45.3.43.188 1;
45.3.33.163 1;
45.3.40.191 1;
45.3.53.113 1;
45.3.43.224 1;
45.3.49.149 1;
45.3.52.0 1;
45.3.34.145 1;
45.3.48.27 1;
45.3.50.152 1;
45.3.41.76 1;
45.3.49.208 1;
45.3.37.197 1;
45.3.32.79 1;
45.3.47.195 1;
45.3.36.219 1;
45.3.38.179 1;
45.3.54.5 1;
45.3.54.167 1;
45.3.54.252 1;
45.3.40.1 1;
45.3.38.125 1;
45.3.41.20 1;
45.3.40.158 1;
45.3.40.178 1;
45.3.46.8 1;
45.3.55.77 1;
45.3.33.110 1;
45.3.54.46 1;
45.3.39.94 1;
45.3.62.110 1;
45.3.62.176 1;
45.3.44.80 1;
45.3.42.40 1;
45.3.52.53 1;
45.3.36.171 1;
45.3.35.201 1;
45.3.34.209 1;
45.3.50.52 1;
45.3.49.43 1;

# ---- 欧洲攻击源（英国/德国） ----
217.181.92.169 1;
217.181.91.206 1;
217.181.91.90 1;
217.181.91.231 1;
217.181.92.28 1;
217.181.92.206 1;
217.181.91.42 1;
217.181.91.251 1;
217.181.90.227 1;
193.56.28.214 1;
193.56.28.104 1;
104.167.19.12 1;
104.167.19.138 1;
104.167.19.36 1;
104.167.19.198 1;
104.167.25.106 1;
104.167.25.54 1;
104.167.25.79 1;

# ---- 美国攻击源（其他网段） ----
151.123.178.52 1;
151.123.178.133 1;
151.123.178.94 1;
151.123.177.96 1;
151.123.177.20 1;
151.123.178.170 1;
216.26.227.141 1;
216.26.230.115 1;
216.26.247.108 1;
216.26.240.210 1;
216.26.253.240 1;
216.26.231.19 1;
216.26.243.108 1;
216.26.240.242 1;
216.26.242.161 1;
216.26.245.203 1;
216.26.252.156 1;
216.26.241.20 1;
216.26.241.42 1;
216.26.243.203 1;
216.26.252.243 1;
216.26.241.21 1;
216.26.231.163 1;
216.26.240.3 1;
216.26.229.249 1;
216.26.254.186 1;
216.26.247.90 1;
216.26.252.159 1;
216.26.244.12 1;
216.26.249.72 1;
216.26.242.158 1;
216.26.246.72 1;
216.26.246.222 1;
216.26.227.126 1;
216.26.252.87 1;
216.26.253.247 1;
216.26.246.15 1;
216.26.230.191 1;
216.26.241.43 1;
216.26.228.125 1;
216.26.229.76 1;
216.26.241.163 1;
216.26.247.32 1;
216.26.244.199 1;
216.26.243.121 1;
216.26.251.12 1;
216.26.244.73 1;
216.26.230.38 1;
216.26.253.2 1;
216.26.248.139 1;

# ---- 其他攻击源 ----
195.96.139.3 1;

---

2. Nginx 核心封禁与安全配置

通常放在 http { ... } 块中，或者放在 conf.d/ 下的独立配置文件中。

建议保存为：/etc/nginx/conf.d/block-ips.conf

# ============================================================
# IP 封禁配置（核心）
# ============================================================

# 1. 加载 IP 封禁列表
map $remote_addr $is_blocked {
    default 0;
    include /etc/nginx/blocked-ips.conf;
}

# 2. 可选：封禁已知恶意用户代理（指纹识别）
map $http_user_agent $is_bad_bot {
    default 0;
    ~*(nmap|sqlmap|nikto|nessus|acunetix|wpscan|burp|wget|curl|python|perl|ruby|php|javaw) 1;
    ~*(masscan|zmap|gobuster|ffuf|dirb|dirbuster) 1;
}

# 3. 隐藏 Nginx 版本号
server_tokens off;

# 4. 防止点击劫持与 MIME 嗅探等
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;

---

3. 在 server { ... } 中执行封禁

上面的 map 只是定义变量，真正"拒绝访问"需要在 server 块中判断：

server {
    listen 80;
    server_name example.com;

    # 如果 IP 在黑名单中，直接返回 403
    if ($is_blocked) {
        return 403;
    }

    # 如果 UA 是恶意机器人，也返回 403
    if ($is_bad_bot) {
        return 403;
    }

    # 其他正常配置...
    location / {
        root /var/www/html;
        index index.html;
    }
}

---

4. 完整整合示例（可直接参考）

如果你希望把封禁列表 + 核心配置 + server 块放在一起，可以整理成类似下面这样：

# ============================================================
# /etc/nginx/nginx.conf 或 /etc/nginx/conf.d/block-ips.conf
# ============================================================

http {
    # ---------- 基础安全 ----------
    server_tokens off;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # ---------- IP 封禁 ----------
    map $remote_addr $is_blocked {
        default 0;
        include /etc/nginx/blocked-ips.conf;
    }

    # ---------- 恶意 UA 封禁 ----------
    map $http_user_agent $is_bad_bot {
        default 0;
        ~*(nmap|sqlmap|nikto|nessus|acunetix|wpscan|burp|wget|curl|python|perl|ruby|php|javaw) 1;
        ~*(masscan|zmap|gobuster|ffuf|dirb|dirbuster) 1;
    }

    server {
        listen 80;
        server_name example.com;

        # 黑名单 IP 拒绝
        if ($is_blocked) {
            return 403;
        }

        # 恶意 UA 拒绝
        if ($is_bad_bot) {
            return 403;
        }

        location / {
            root /var/www/html;
            index index.html;
        }
    }
}

---

5. 使用步骤

1. 创建封禁列表文件：

sudo nano /etc/nginx/blocked-ips.conf

把第 1 部分内容粘贴进去并保存。

2. 创建核心封禁配置：

sudo nano /etc/nginx/conf.d/block-ips.conf

把第 2 部分内容粘贴进去并保存。

3. 在你的站点 server 块中加入：

if ($is_blocked) {
    return 403;
}

if ($is_bad_bot) {
    return 403;
}

4. 测试配置并重载：

sudo nginx -t
sudo systemctl reload nginx

---

6. 注意事项

• map 必须放在 http 块中，不能放在 server 块里。
• include /etc/nginx/blocked-ips.conf; 的路径要确保 Nginx 有读取权限。
• if 在 Nginx 中有一些限制，但用于 return 403 是安全且常见的。
• wget|curl|python 这类 UA 可能会误伤正常爬虫或 API 调用，建议根据业务情况调整。
  把 blocked-ips.conf 按网段合并成 CIDR 形式来减少行数。