我想将阻止IP地址添加到nginx配置中。但是，仍然可以使用curl访问它！

...
log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent $request_time "$http_referer" '
                      '"$http_user_agent" REALIP"$http_x_forwarded_for"';
location  / {
        include /usr/local/nginx/blockip.conf;
        root   html;
        index  index.html index.htm;
        proxy_set_header    Host             $host;
        proxy_set_header    X-Real-IP        $remote_addr;
        proxy_set_header    X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_set_header    HTTP_X_FORWARDED_FOR $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_pass http://127.0.0.1:8080;
        }
...

blockip.conf的内容为

deny 1.2.3.4;
deny 3.4.5.6;

这里有两种情况。

1.直接使用域名（A记录）连接服务器，blockip可以很好地工作。

2.当添加ddos防御服务器时，nginx拒绝规则不再起作用！

但是我可以从nginx访问日志中获得真实IP。 这里提供一个日志样例：

defence-server-IP - - [23/Mar/2020:14:15:59 +0800] "GET /walle HTTP/1.1" 404 1079 0.001 "-" "curl/7.58.0" REALIP"1.2.3.4"
defence-server-IP - - [23/Mar/2020:14:16:07 +0800] "GET /walle HTTP/1.1" 404 1079 0.000 "-" "curl/7.58.0" REALIP"3.4.5.6"

解决方案

顺便提一下，我将nginx更改为openresty

server {
...
    set_real_ip_from defence-server-ip-ranges/24;
    ...
    real_ip_header X-Forwarded-For;
    include /usr/local/nginx/blockip.conf;

    localtion {...}
...
}