Nginx 限流与安全防护：limit_req、白名单与防爬实践

# 在 http 上下文定义共享内存区域
limit_req_zone $binary_remote_addr zone=req_zone:10m rate=10r/s;

location /api/ {
    limit_req zone=req_zone burst=20 nodelay;
    proxy_pass http://backend;
}

# 基础限流示例
limit_req zone=req_zone burst=5;
limit_req_status 429;             # 自定义返回状态码
limit_req_log_level warn;         # 超限写入日志级别

limit_conn_zone $binary_remote_addr zone=conn_zone:10m;

server {
    limit_conn conn_zone 10;          # 每 IP 最多 10 个并发连接
    limit_conn_status 429;
}

http {
    limit_conn_zone $binary_remote_addr zone=perip:10m;
    server {
        keepalive_timeout 20;
        limit_conn perip 10;          # 含长连接数，注意别设太小
    }
}

location /admin/ {
    allow 10.0.0.0/8;                # 内网放行
    allow 203.0.113.0/24;
    deny  all;                       # 其余拒绝
}

geo $whitelist {
    default 0;
    10.0.0.0/8        1;
    203.0.113.0/24    1;
}

server {
    if ($whitelist = 0) {
        return 403;                  # 不在白名单直接拒绝
    }
}

location /internal/ {
    satisfy any;                     # 满足任一条件即放行
    allow 10.0.0.0/8;               # 内网或
    valid_referers none blocked example.com;  # 合法来源
    deny all;
}

map $http_user_agent $bad_bot {
    default 0;
    "~*curl|wget|python-requests|Scrapy|AhrefsBot|SemrushBot" 1;
}

server {
    if ($bad_bot) {
        return 403;
    }
}

limit_req_zone $http_user_agent zone=bot_zone:10m rate=1r/m;

location / {
    limit_req zone=bot_zone burst=1;      # 对可疑 UA 极低频率
    proxy_pass http://backend;
}

server {
    client_body_timeout   10s;      # 读请求体超时
    client_header_timeout 10s;      # 读请求头超时
    client_max_body_size  10m;      # 请求体上限
    send_timeout          30s;      # 响应发送超时
}

server {
    listen 80 backlog=1024;         # 控制 accept 队列
    keepalive_timeout 10;           # 缩短空闲 keepalive
    client_body_buffer_size 128k;   # 限制请求体缓冲
}

add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options SAMEORIGIN always;
add_header Referrer-Policy strict-origin-when-cross-origin always;
add_header Content-Security-Policy "default-src 'self'" always;

server_tokens off;                   # 隐藏 Nginx 版本号
# 上游异常时不透传错误详情
proxy_hide_header X-Powered-By;

log_format limited '$remote_addr - [$time_local] "$request" '
                   '$status $request_length rt=$request_time '
                   'ua="$http_user_agent"';

limit_req_log_level warn;
error_log /var/log/nginx/error.log warn;   # 超限记录在此

# 统计 5 分钟 429/403 高频 IP 并写入 deny 文件
awk '{print $1}' /var/log/nginx/access.log \
  | sort | uniq -c | sort -rn \
  | awk '$1>200 {print "deny "$2";"}' > /etc/nginx/conf.d/blocked.conf

nginx -t && nginx -s reload        # 应用封禁

# fail2ban 配置：扫描 Nginx 日志的 429 高频 IP 自动封禁
[nginx-limit-req]
enabled   = true
filter    = nginx-limit-req
action    = iptables-multiport[name=nginx, port="80,443"]
logpath   = /var/log/nginx/error.log
maxretry  = 3
findtime  = 300
bantime   = 3600