Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How can you set rate limit access to API using Iptables. Tried to set limit using port 80, but I don't want to set limit to the web access entirely. Is there a way to specified a subdomain rather than port. Example: set rate limit to api.example.com not example.com?

If there is no way to set rate limit by subdomain, what is the suggested rate limit access to port 80 without risking blocking a legitimate web user? One connection per second would be enough?

share|improve this question

3 Answers 3

Can you add a second address to your web server and host your api domain on a separate IP address? If you assign a second address then building a separate rule just for that address shouldn't be too hard.

share|improve this answer
1  
You should probably be doing this already. Makes management of traffic and monitoring far easier if you can segregate API requests from the bulk of your website traffic. Also would make moving, the API handling services, to a separate server somewhat easier. –  Tom O'Connor May 4 '10 at 8:08

Not exactly what you're looking for, but mod_memcache_block (http://github.com/netik/mod_memcache_block) might be useful.

share|improve this answer

AFAIK netfilter does not "understand" HTTP well enough to make choices based on hostname in the HTTP request. You should do it in the HTTP server instead.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.