Blocking UK Traffic with Debian and Nginx

If you need to refuse requests from the UK at the web-server layer, the practical path is MaxMind's free GeoIP database plus Nginx's GeoIP2 module. The official docs gloss over several wiring details, so here is the working setup I used on Debian.

Getting the GeoIP Data Local

Start by creating a free MaxMind account and a license key on their site. Download the config file they supply and save it as /etc/GeoIP.conf — it contains the key and your account ID:

AccountID XXXX
LicenseKey XXXX
EditionIDs GeoLite2-Country

Install the tools that keep the database refreshed and expose it to Nginx:

apt install geoipupdate libnginx-mod-http-geoip2

The package installs a cron job for updates, but you need to pull the database once manually. That initial download takes a few minutes and produces /var/lib/GeoIP/GeoLite2-Country-mmdb:

geoipupdate

Wiring the Database into Nginx

The GeoIP2 module loads through /etc/nginx/modules-enabled/50-mod-http-geoip2.conf. Create a snippet such as /etc/nginx/conf.d/geoblock.conf with two parts. The first opens the MMDB file and captures each visitor's two-letter country code as a variable. The second is a map that turns that code into an $osa_geoblocked flag — 1 when the code is GB, 0 otherwise:

geoip2 /var/lib/GeoIP/GeoLite2-Country.mmdb {
  $geoip2_data_country_iso_code country iso_code;
}

map $geoip2_data_country_iso_code $osa_geoblocked {
  GB      1;
  default 0;
}

Serving a Proper 451

Write the explanation page to something like /var/www/custom_errors/osa.html. Then, in your site's configuration under /etc/nginx/sites-enabled/, point 451 responses at that file:

server {
  ...
  # UK OSA error page
  error_page 451 /osa.html;
  location /osa.html {
    internal;
    root /var/www/custom_errors/;
  }

  # When geoblocked, return 451
  location / {
    if ($osa_geoblocked = 1) {
      return 451;
    }
  }
}

Validate everything with nginx -t, then apply it via service nginx reload. To confirm the block from a UK IP, test through a VPN or a remote browser service such as locabrowser.

Know the Limits

Be aware this is a blunt instrument. MaxMind's free tier is imprecise, and IP-to-country tables drift. It is already documented that people outside the UK — Ireland being a notable example — get caught by these lists. Pushing those users toward Tor or a VPN is a poor experience, but in the current regulatory climate it may be the only lever available.