GeoIP2 (HTTP)

The GeoIP2 module reads MaxMind's binary database format and hands you geographic data as nginx variables. Country code, country name, city, continent, ASN: all of it as $geoip2_* variables, usable in access rules, upstream selection, conditional headers, logging, rate limiting, wherever. The GeoLite2 databases are free with a MaxMind account and updated weekly. Paid databases are more accurate. This is the HTTP module, for http {} and server {} blocks. If you need GeoIP2 in TCP/UDP stream proxying, you want nginx-module-stream-geoip2.

• Block or redirect traffic by country code in nginx access rules
• Route users to geographically close backend servers
• Serve localised content or different landing pages by region
• Restrict admin panels to specific countries
• Log geographic data alongside standard access logs

A starting point. Adjust to taste.

# geoip2 and map go in your http {} block; use the variables in server/location:
geoip2 /var/lib/GeoIP/GeoLite2-Country.mmdb {
  $geoip2_country_code country iso_code;
  $geoip2_country_name country names en;
}

map $geoip2_country_code $blocked_country {
  default 0;
  XX      1;
  YY      1;
}

server {
  if ($blocked_country) {
    return 403;
  }
}

You'll need nginx from nginx.org configured first. These packages won't load on the distro nginx. Then add the Blendbyte repository if you haven't already:

sudo install -d -m 0755 /etc/apt/keyrings

curl -fsSL https://apt.blendbyte.net/nginx/blendbyte-archive-keyring.gpg \
  | sudo tee /etc/apt/keyrings/blendbyte.gpg >/dev/null

echo "deb [signed-by=/etc/apt/keyrings/blendbyte.gpg] https://apt.blendbyte.net/nginx $(lsb_release -cs) main" \
  | sudo tee /etc/apt/sources.list.d/blendbyte.list

sudo apt update
sudo apt install nginx-module-geoip2

Most modules auto-enable on install. If yours didn't:

$ sudo ln -s /etc/nginx/modules-available/50-mod-geoip2.conf \
  /etc/nginx/modules-enabled/
$ sudo nginx -t && sudo systemctl reload nginx

This replaces libnginx-mod-http-geoip2 from the old Sury nginx repository. The package declares Replaces and Conflicts, so once your apt sources point at nginx.org and Blendbyte, a regular apt upgrade swaps it in. No manual cleanup.

Switching sources also moves you from Sury's nginx binary to nginx.org's. The migration guide walks through it in one go.

We package this from the upstream open-source project. If it's a bug in the module itself (not in our packaging), report it upstream at github.com/leev/ngx_http_geoip2_module ↗