Implementing IP Filtering and Access Control

plugins:
  - name: ip-restriction
    config:
      allow: ["10.0.0.0/8", "203.0.113.0/24"]
      status: 403
      message: "Access denied"

geoip2 /etc/geoip2/GeoLite2-Country.mmdb {
  $geoip_country source=$remote_addr country iso_code;
}
map $geoip_country $blocked {
  default 0;
  CU 1; IR 1; KP 1; SY 1;
}
if ($blocked) { return 451; }

set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
# Last untrusted IP becomes $remote_addr

geo $backend {
  default          public-backend;
  10.0.0.0/8       internal-backend;
  192.0.2.0/24     partner-backend;
}
location / { proxy_pass http://$backend; }