The ngx_http_geoip_module module (0.8.6+) creates variables whose values depend on the client IP address, using the precompiled MaxMind databases.

This module is not built by default, it should be enabled with the --with-http_geoip_module configuration parameter.

This module requires the MaxMind GeoIP library.

http {
    geoip_country         GeoIP.dat;
    geoip_city            GeoLiteCity.dat;
    geoip_proxy           192.168.100.0/24;
    geoip_proxy           2001:0db8::/32;
    geoip_proxy_recursive on;
    ...

Specifies a database used to determine a country depending on the client IP address. The following variables are available when using this database:

$geoip_country_code

two-letter country code, for example, “RU”, “US”.

$geoip_country_code3

three-letter country code, for example, “RUS”, “USA”.

$geoip_country_name

country name, for example, “Russian Federation”, “United States”.

Specifies a database used to determine a country, region, and city depending on the client IP address. The following variables are available when using this database:

$geoip_city_country_code

two-letter country code, for example, “RU”, “US”.

$geoip_city_country_code3

three-letter country code, for example, “RUS”, “USA”.

$geoip_city_country_name

country name, for example, “Russian Federation”, “United States”.

$geoip_region

country region name (region, territory, state, province, federal land and the like), for example, “Moscow City”, “DC”.

$geoip_city

city name, for example, “Moscow”, “Washington”.

$geoip_postal_code

postal code.

Specifies a database used to determine an organization depending on the client IP address. The following variable is available when using this database:

$geoip_org

organization name, for example, “The University of Melbourne”.

Defines trusted addresses. When a request comes from a trusted address, an address from the “X-Forwarded-For” request header field will be used instead.

geoip_proxy_recursive off;

If recursive search is disabled then instead of an original client address that matches one of the trusted addresses, the last address sent in “X-Forwarded-For” will be used. If recursive search is enabled then instead an original client address that matches one of the trusted addresses, the last non-trusted address sent in “X-Forwarded-For” will be used.