Skip to main content

Web Server

Nginx Blocklist Tutorial

Block VPN, proxy and Tor IPs at the web server level using Nginx geo module and deny directives loaded from TXT/CSV blocklist files.

Supported formats: TXT (one IP per line) CSV (ip,type columns)

Steps

  1. 1

    Download the blocklist

    Download the IP blocklist as a TXT file from your AntiProxies dashboard. The plain-text format contains one IP/CIDR per line, ready for direct use.

  2. 2

    Place the file on your server

    Copy the downloaded file to a directory readable by Nginx, e.g. /etc/nginx/blocklists/blocked_ips.txt.

  3. 3

    Configure the geo block

    Use the Nginx geo module inside the http context to map blocked IPs to a flag variable, then deny access in your server block.

  4. 4

    Reload Nginx

    Run nginx -t to validate config, then nginx -s reload to apply changes without downtime.

Need the blocklist files?

Download free sample data or subscribe for daily-updated lists.

Free Sample

geo module – IP blocklist

Generate this include file from the TXT blocklist. Each IP/CIDR maps to 1 (blocked).

/etc/nginx/blocklists/blocked_ips.conf 
# Auto-generated from AntiProxies blocklist – do not edit manually

geo $blocked_ip {
    default 0;
    include /etc/nginx/blocklists/blocked_ips.txt;
}

TXT blocklist format

Plain-text file downloaded from AntiProxies – one IP or CIDR per line, followed by the value 1.

/etc/nginx/blocklists/blocked_ips.txt 
1.2.3.4        1;
5.6.7.0/24     1;
10.0.0.1       1;
192.168.100.0/22 1;

Server block – deny blocked IPs

Include the geo config and block matched IPs with a 403 response.

/etc/nginx/sites-available/example.com 
http {
    include /etc/nginx/blocklists/blocked_ips.conf;

    server {
        listen 80;
        server_name example.com;

        # Block IPs flagged as VPN / proxy / Tor
        if ($blocked_ip) {
            return 403 "Access denied";
        }

        location / {
            proxy_pass http://127.0.0.1:3000;
        }
    }
}

Frequently asked questions

Does using geo module slow down Nginx?
No. Nginx builds an in-memory radix tree from the geo data at startup/reload. Lookups are O(1) and add negligible latency (< 1 µs).
Can I block CIDR ranges, not just single IPs?
Yes. The AntiProxies TXT blocklist includes both individual IPs and CIDR blocks (e.g. 10.0.0.0/8). Nginx geo handles both formats natively.
How do I avoid blocking legitimate users?
Use a soft-block strategy: instead of returning 403, set a cookie or redirect to a CAPTCHA page for flagged IPs. Use the $blocked_ip variable to make routing decisions.
What if I run Nginx behind a load balancer?
Use the real_ip module to restore the original client IP before the geo check: set_real_ip_from <LB_CIDR>; and real_ip_header X-Forwarded-For;.

More blocklist guides

Apache HTTP Server

Web Server

View tutorial

Caddy

Web Server

View tutorial

HAProxy

Load Balancer

View tutorial
View all 9 guides

Want to see what's in the database?

Download once, query as many times as you need. €99/year for all 22 databases, unlimited servers, and a full year of monthly updates. No usage limits, no per-query fees, no data leaving your servers.

View Pricing Contact Us
30-day money-back guarantee
All databases included
Monthly updates