nginx-access-limit.lua

local client_ip = ngx.req.get_headers()["X-Forwarded-For"]

client_ip = string.match((client_ip or ngx.var.remote_addr), '[%d%.]+')

local passed = false
for allowed_ip in string.gmatch(ngx.var.allowed_ips, '([%d%.]+)') do
    if client_ip == allowed_ip then
        passed = true
    end
end

if not passed then
    ngx.log(ngx.ERR, "Denied: ", client_ip)
    ngx.exit(ngx.HTTP_FORBIDDEN)
end

nginx-conf-snippet.nginx

location /lua {
    set $allowed_ips '
        0.0.0.0
        0.0.0.1
        0.0.0.2
        ';
    access_by_lua_file /etc/nginx/lua-scripts/access_limit.lua;
    echo "Hello, Lua";
}