Implementing a Dynamic IP Blacklist with Nginx, Lua, and Redis

To block malicious crawlers or users, a dynamic IP blacklist can be built that denies service to IPs on the list.

There are three implementation approaches: OS‑level iptables, Nginx deny or Lua plugin, and application‑level checks.

This guide chooses the Nginx + Lua + Redis solution and shows the architecture diagram.

Steps: install OpenResty (Nginx with Lua modules), deploy a Redis server, configure Nginx with a shared memory dictionary and an access_by_lua_file , write a Lua script that periodically pulls the blacklist from Redis, and store the blacklist in a Redis Set.

Key Nginx configuration snippets:

lua_shared_dict ip_blacklist 1m

access_by_lua_file lua/ip_blacklist.lua;

After reloading Nginx, requests from blacklisted IPs are rejected, as shown in the screenshots.

The solution is lightweight, easy to configure, allows multiple servers to share the blacklist via Redis, and supports dynamic updates.