生产环境中经常会遇到某个ip地址频繁异常的访问nginx网站，此时我们需要通过安全措施保护我们的服务器，接下来为大家介绍几种方式。

实验环境

版本：redhat6.5
) t: n' D' f" ]ip:172.16.1.100,172.16.10
" G5 A, i3 x" ?6 J1 ?软件：nginx

. T* r7 S! e: ?" O8 R' u1 M

172.16.1.10部署nginx

5 C2 @) \2 u: h6 g. e[root@localhost tools]# ls
nginx-1.11.2.tar.gz
[root@localhost tools]# yum  install gcc gcc-c++ make automake autoconf libtool pcre* zlib openssl openssl-devel
[root@localhost tools]# tar xf nginx-1.11.2.tar.gz
[root@localhost tools]# ls
nginx-1.11.2  nginx-1.11.2.tar.gz
[root@localhost tools]# cd nginx-1.11.2
[root@localhost nginx-1.11.2]# ls
auto  CHANGES  CHANGES.ru  conf  configure  contrib  html  LICENSE  man  README  src
& s1 v  u6 r- h- I' a$ f8 e[root@localhost nginx-1.11.2]# ./configure
4 Z' C( {* g1 B, b' y[root@localhost nginx-1.11.2]# make
& B! [9 c: }. @2 L; [" F0 H1 S# B[root@localhost nginx-1.11.2]# make install

9 B& S: W' P; U; m: t% K) p

, ]4 ?, o/ e" W9 |& ]0 j

测试nginx服务

! @7 x. O6 j& M$ Z[root@localhost ~]# curl -I 172.16.1.100
+ Z1 [2 o: T! h/ Q# n, S6 DHTTP/1.1 200 OK
Server: nginx/1.11.2
Date: Mon, 17 Aug 2020 09:36:29 GMT
: O7 \) k  d6 F. o0 C/ MContent-Type: text/html
' {/ h8 b9 S* j1 hContent-Length: 15
/ P- O6 E% G+ e; n0 a  \8 [  J9 `Last-Modified: Mon, 17 Aug 2020 09:36:19 GMT
9 ?  \$ p# k( _% PConnection: keep-alive
1 S  W7 V5 z1 M' LETag: "5f3a4f93-f"
Accept-Ranges: bytes
9 L- A$ o1 t4 F  m, x, K

nginx 可以正常访问。
9 N; m3 p) p; E6 a. e2 `. P接下来，假设172.16.1.100是黑客主机，频繁访问nginx服务

模拟172.16.1.100访问10次172.16.1.10

! ^, D9 V; v# s

172.16.1.100

[root@localhost ~]# ab -c 1 -n 10 http://172.16.1.10/
3 ^3 X# v, [. FThis is ApacheBench, Version 2.3 <$Revision: 1430300 $>
7 p% o/ f$ a6 d! T" T6 dCopyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
; x$ O/ t- V  t$ ~Licensed to The Apache Software Foundation, http://www.apache.org/

Benchmarking 172.16.1.10 (be patient).....done
# l' v0 K# _& h9 l( b8 \
1 B* B4 Z& M# W. u  G4 D0 ~' p
6 e9 {$ _) P: n7 m# D6 N  U) u; qServer Software:        nginx/1.11.2
9 S) n2 z, n( H; s2 I2 UServer Hostname:        172.16.1.10
Server Port:            80

: t* r7 N' Y! v' @5 P8 iDocument Path:          /
Document Length:        612 bytes
$ f& m+ b, P/ `1 p
+ b) b& N9 u2 G% c; B" T2 {8 V( ~$ P/ |Concurrency Level:      1
6 [1 i" p" y7 M: bTime taken for tests:   0.016 seconds
" o9 l  g8 k% Z9 W/ P! Z% cComplete requests:      10
Failed requests:        0
3 q) f7 R/ v: p8 @  cWrite errors:           0
Total transferred:      8450 bytes
HTML transferred:       6120 bytes
Requests per second:    617.02 [#/sec] (mean)
Time per request:       1.621 [ms] (mean)
Time per request:       1.621 [ms] (mean, across all concurrent requests)
  s+ w5 d! T' G2 L3 I6 mTransfer rate:          509.16 [Kbytes/sec] received
" k& Y( o# w4 C5 G) X% e, u
Connection Times (ms)
% c: p: T$ Z% g  W5 U3 Y: `              min  mean[+/-sd] median   max
Connect:        0    1   0.3      0       1
- p0 ?" B4 N9 r1 A$ a' EProcessing:     1    1   0.3      1       2
. J0 i  U6 e1 t) TWaiting:        0    1   0.3      1       1
8 @! @' u' u* P" q; i2 W5 uTotal:          1    1   0.5      1       2
2 Z; c/ `; C9 x8 t) H, s% E4 P6 NERROR: The median and mean for the initial connection time are more than twice the standard
       deviation apart. These results are NOT reliable.
0 q/ C- e5 d, g' O
9 j2 |7 W8 r/ g; Y5 r4 z2 L. zPercentage of the requests served within a certain time (ms)
/ K" |7 |& w- S% Q( ~# x+ A! `  50%      1
  66%      1
; T3 i! }8 `  Q  k+ S4 k4 e  75%      1
  80%      2
- h4 v, @& F6 z% i+ a  90%      2
  95%      2
  98%      2
' l  }) ~7 X7 w4 P  99%      2
100%      2 (longest request)
1 w" X) `6 F8 u( }' i% N

查看nginx日志

172.16.1.10

[root@localhost ~]# tail /usr/local/nginx/logs/access.log
7 ?" r) l) w/ k; g0 j172.16.1.100 - - [26/Jul/2020:05:58:24 +0800] "GET / HTTP/1.0" 200 612 "-" "ApacheBench/2.3"
; I" m" k, H2 L0 ]172.16.1.100 - - [26/Jul/2020:05:58:24 +0800] "GET / HTTP/1.0" 200 612 "-" "ApacheBench/2.3"
7 u! _3 l' V1 z- M; z0 G+ d172.16.1.100 - - [26/Jul/2020:05:58:24 +0800] "GET / HTTP/1.0" 200 612 "-" "ApacheBench/2.3"
172.16.1.100 - - [26/Jul/2020:05:58:24 +0800] "GET / HTTP/1.0" 200 612 "-" "ApacheBench/2.3"
172.16.1.100 - - [26/Jul/2020:05:58:24 +0800] "GET / HTTP/1.0" 200 612 "-" "ApacheBench/2.3"
172.16.1.100 - - [26/Jul/2020:05:58:24 +0800] "GET / HTTP/1.0" 200 612 "-" "ApacheBench/2.3"
172.16.1.100 - - [26/Jul/2020:05:58:24 +0800] "GET / HTTP/1.0" 200 612 "-" "ApacheBench/2.3"
172.16.1.100 - - [26/Jul/2020:05:58:24 +0800] "GET / HTTP/1.0" 200 612 "-" "ApacheBench/2.3"
172.16.1.100 - - [26/Jul/2020:05:58:24 +0800] "GET / HTTP/1.0" 200 612 "-" "ApacheBench/2.3"
7 `) x: ^" I* J& _6 i3 Z% T172.16.1.100 - - [26/Jul/2020:05:58:24 +0800] "GET / HTTP/1.0" 200 612 "-" "ApacheBench/2.3"

由此可见，一秒钟之内172.16.1.100访问了nginx10次，接下来禁止掉这个问题ip

2 L5 @. P' g- m5 ?3 `4 ^

通过iptables限制ip访问

172.16.1.10

[root@localhost ~]# iptables -I INPUT -s 172.16.1.100 -ptcp --dport 80 -j DROP

172.16.1.100

[root@localhost ~]# curl 172.16.1.10
4 E1 ?  S: ^7 Ncurl: (7) Failed connect to 172.16.1.10:80; 连接超时
! ^# X+ R# n. m1 a1 u! {; d

此时172.16.1.100再也不能访问nginx

" E: H3 ~, b' h, d+ p7 F$ J% J

nginx配置文件限制

' D0 t' V$ m, |* ^  V" q5 X

172.16.1.10

172.16.1.100

[root@localhost ~]# curl -I 172.16.1.10
HTTP/1.1 403 Forbidden
Server: nginx/1.11.2
Date: Sat, 25 Jul 2020 23:12:06 GMT
  u( x* c" e+ ^, t- R. ~( TContent-Type: text/html
Content-Length: 169
0 `. U9 A" r( f) W# k8 pConnection: keep-alive

% m& X* ~. b6 ?* w: m) u

8 i2 P. T0 Y+ n& ~

/ v' q( [7 O, W) e9 l- ~# G% R" C6 E

总    结

1 w0 d, P# v8 y9 I

以上就是两种简单的方法限制ip访问，还有许多方法可以利用工具进行ip限制。

; F7 `5 X) i& e$ P0 @/ I6 J