Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

To clarify, I do not wish to limit the number of simultaneous connections, nor do I want to limit the number of HTTP requests. I only want to limit the number of NEW connections per IP.

I want to do this because most web crawlers do not have keep-alive functionality and thus they open a new connection for every request.

I vaguely remember reading about a mod that could do this, but I can't remember the name. Hopefully, someone here can help me out.

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

I wouldn't do it in apache.. I'd do it at network layer with iptables.

iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set

iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 86400 --hitcount 100 -j REJECT

Change 86400 to the number of seconds you want to keep the block for (86400 is 1 day), and 100, is the hit count, how many you're prepared to allow per IP.

You can also change -j REJECT to -j DROP, which defines the packet behavior when the condition is met. DROP seamlessly drops packets, and REJECT returns a "port unreachable" or similar error.

That said, there was a mod_throttle that would do something similar, but I can't seem to find much information about it. I think it feels neater to do this kind of thing at the network/kernel level, rather than in apache. Apache is good at serving requests. Let it do what it does best, and don't burden it with having to track connections too.

share|improve this answer
    
Thanks, but I'd like to serve a message to the user's who get blocked, just in case there are any false positives. Any idea how I could do that? I suppose I could run a cron job that checks the output of iptables every few minutes, and places the blacklisted IPs into a .htaccess file or something similar. –  user45795 Aug 9 '10 at 0:01
    
A htaccess file probably wouldn't work, because the traffic would never actually hit the server. The best idea would be to rewrite the packet and redirect it. –  Tom O'Connor Aug 9 '10 at 17:45
add comment

you could tune the iptables rule so that requests beyond the limit are redirected to another port (e.g. TCP 8080) where another instance of Apache serves a static page with your message to users

share|improve this answer
    
Neat idea, I like it! –  Tom O'Connor Aug 9 '10 at 10:44
    
Yeah, that is a good idea. Maybe something a little more lightweight than Apache, though. Thanks –  user45795 Aug 9 '10 at 17:29
    
Nginx or Lighttpd perhaps? –  Tom O'Connor Aug 9 '10 at 17:45
add comment

I think you are looking for mod_qos

share|improve this answer
    
If I'm not mistaken, that mod only allows you to limit the number of concurrent connections per IP, which isn't what I want to do. –  user45795 Aug 9 '10 at 17:30
    
I could be wrong ;) –  xenoterracide Aug 9 '10 at 22:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.