Can G6 Firewall be converted to be used on NGINX? - apache

Question

I'm a big fan of the G6 firewall (previously G5) htaccess rules. I was wondering if it would be possible, as well as beneficial, to convert this to be used with NGINX? The source article can be found here: https://perishablepress.com/6g/. If it's possible to rewrite this, would you provide the NGINX equivalent rule set? I think it would be helpful to a lot of developers out there.
Here's the orignal .htaccess rules:
# 6G FIREWALL/BLACKLIST
# # https://perishablepress.com/6g/
# 6G:[QUERY STRINGS]
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} (eval\() [NC,OR]
RewriteCond %{QUERY_STRING} (127\.0\.0\.1) [NC,OR]
RewriteCond %{QUERY_STRING} ([a-z0-9]{2000}) [NC,OR]
RewriteCond %{QUERY_STRING} (javascript:)(.*)(;) [NC,OR]
RewriteCond %{QUERY_STRING} (base64_encode)(.*)(\() [NC,OR]
RewriteCond %{QUERY_STRING} (GLOBALS|REQUEST)(=|\[|%) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)(.*)script(.*)(>|%3) [NC,OR]
RewriteCond %{QUERY_STRING} (\\|\.\.\.|\.\./|~|`|<|>|\|) [NC,OR]
RewriteCond %{QUERY_STRING} (boot\.ini|etc/passwd|self/environ) [NC,OR]
RewriteCond %{QUERY_STRING} (thumbs?(_editor|open)?|tim(thumb)?)\.php [NC,OR]
RewriteCond %{QUERY_STRING} (\'|\")(.*)(drop|insert|md5|select|union) [NC]
RewriteRule .* - [F]
</IfModule>
# 6G:[REQUEST METHOD]
<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_METHOD} ^(connect|debug|delete|move|put|trace|track) [NC]
RewriteRule .* - [F]
</IfModule>
# 6G:[REFERRERS]
<IfModule mod_rewrite.c>
RewriteCond %{HTTP_REFERER} ([a-z0-9]{2000}) [NC,OR]
RewriteCond %{HTTP_REFERER} (semalt.com|todaperfeita) [NC]
RewriteRule .* - [F]
</IfModule>
# 6G:[REQUEST STRINGS]
<IfModule mod_alias.c>
RedirectMatch 403 (?i)([a-z0-9]{2000})
RedirectMatch 403 (?i)(https?|ftp|php):/
RedirectMatch 403 (?i)(base64_encode)(.*)(\()
RedirectMatch 403 (?i)(=\\\'|=\\%27|/\\\'/?)\.
RedirectMatch 403 (?i)/(\$(\&)?|\*|\"|\.|,|&|&?)/?$
RedirectMatch 403 (?i)(\{0\}|\(/\(|\.\.\.|\+\+\+|\\\"\\\")
RedirectMatch 403 (?i)(~|`|<|>|:|;|,|%|\\|\s|\{|\}|\[|\]|\|)
RedirectMatch 403 (?i)/(=|\$&|_mm|cgi-|etc/passwd|muieblack)
RedirectMatch 403 (?i)(&pws=0|_vti_|\(null\)|\{\$itemURL\}|echo(.*)kae|etc/passwd|eval\(|self/environ)
RedirectMatch 403 (?i)\.(aspx?|bash|bak?|cfg|cgi|dll|exe|git|hg|ini|jsp|log|mdb|out|sql|svn|swp|tar|rar|rdf)$
RedirectMatch 403 (?i)/(^$|(wp-)?config|mobiquo|phpinfo|shell|sqlpatch|thumb|thumb_editor|thumbopen|timthumb|webshell)\.php
</IfModule>
# 6G:[USER AGENTS]
<IfModule mod_setenvif.c>
SetEnvIfNoCase User-Agent ([a-z0-9]{2000}) bad_bot
SetEnvIfNoCase User-Agent (archive.org|binlar|casper|checkpriv|choppy|clshttp|cmsworld|diavol|dotbot|extract|feedfinder|flicky|g00g1e|harvest|heritrix|httrack|kmccrew|loader|miner|nikto|nutch|planetwork|postrank|purebot|pycurl|python|seekerspider|siclab|skygrid|sqlmap|sucker|turnit|vikspider|winhttp|xxxyy|youda|zmeu|zune) bad_bot
<limit GET POST PUT>
Order Allow,Deny
Allow from All
Deny from env=bad_bot
</limit>
</IfModule>
# 6G:[BAD IPS]
<Limit GET HEAD OPTIONS POST PUT>
Order Allow,Deny
Allow from All
# uncomment/edit/repeat next line to block IPs
# Deny from 123.456.789
</Limit>
Thank you in advance for your help or thoughts on this and a big shout-out to Perishable Press for writing this htaccess. Thank you!

Answer 1

## Add here all user agents that are to be blocked.
map $http_user_agent $bad_bot {
default 0;
"~*([a-z0-9]{2000})" 1;
~*(archive.org|binlar|casper|checkpriv|choppy|clshttp|cmsworld|diavol|dotbot|extract|feedfinder|flicky|g00g1e|harvest|heritrix|htmlparser|libwww|httrack|kmccrew|loader|miner|nikto|nutch|planetwork|postrank|purebot|pycurl|python|seekerspider|siclab|skygrid|sqlmap|sucker|turnit|vikspider|winhttp|xxxyy|youda|zmeu|zune) 1;
}
## Add here all referrers that are to blocked.
map $http_referer $bad_referer {
default 0;
"~*([a-z0-9]{2000})" 1;
~*(semalt.com|todaperfeita) 1;
}
# query strings that should be blocked
map $query_string $bad_querystring {
default 0;
~*(eval\() 1;
~*(127\.0\.0\.1) 1;
"~*([a-z0-9]{2000})" 1;
"~*(javascript:)(.*)(;)" 1;
~*(base64_encode)(.*)(\() 1;
~*(GLOBALS|REQUEST)(=|\[|%) 1;
~*(<|%3C)(.*)script(.*)(>|%3) 1;
~*(\\|\.\.\.|\.\./|~|`|<|>|\|) 1;
~*(boot\.ini|etc/passwd|self/environ) 1;
~*(thumbs?(_editor|open)?|tim(thumb)?)\.php 1;
~*(\'|\")(.*)(drop|insert|md5|select|union|concat) 1;
}
map $request_uri $bad_request {
default 0;
"~*([a-z0-9]{2000})" 1;
~*(https?|ftp|php):/ 1;
~*(base64_encode)(.*)(\() 1;
~*(=\\\'|=\\%27|/\\\'/?)\. 1;
"~*/(\$(\&)?|\*|\"|\.|,|&|&?)/?$" 1;
~*(\{0\}|\(/\(|\.\.\.|\+\+\+|\\\"\\\") 1;
"~*(~|`|<|>|:|;|,|%|\\|\s|\{|\}|\[|\]|\|)" 1;
~*/(=|\$&|_mm|cgi-|etc/passwd|muieblack) 1;
"~*(&pws=0|_vti_|\(null\)|\{\$itemURL\}|echo(.*)kae|etc/passwd|eval\(|self/environ)" 1;
~*\.(aspx?|bash|bak?|cfg|cgi|dll|exe|git|hg|ini|jsp|log|mdb|out|sql|svn|swp|tar|rar|rdf)$ 1;
~*/(^$|(wp-)?config|mobiquo|phpinfo|shell|sqlpatch|thumb|thumb_editor|thumbopen|timthumb|webshell)\.php 1;
}
map $request_method $not_allowed_method {
default 0;
~*^(connect|debug|delete|move|put|trace|track) 1;
}
Then in the server directive I add this
server {
...
if ($bad_bot) { return 444; }
if ($bad_referer) { return 444; }
if ($bad_querystring) { return 444; }
if ($bad_request) { return 444; }
if ($not_allowed_method) { return 405; }
## Filesystem root of the site and index.
root /home/$DOMAIN/public;
index index.php;
...
}