Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What do you suggest I use to rate limit incoming http connections (get/post) based on n connections per minute?

If a particular client makes more than n connections in a given minute, drop all further connections until the minute is up.

I currently use nginx and haproxy, but I'm really looking for the best tool for the job.

Update

Some clients have more connections allowed per minute, would there be a way to add a per client rule? An API would be a bonus.

share|improve this question

2 Answers 2

It depends how gracefully you want to apply the cut off. For DROP/DENY on the TCP layer you can do it with iptables with something like:

iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --set  
iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 5 -j DROP

You can target things to specific clients, with extra alternatives for the second rule e.g.

iptables -I INPUT -s 1.2.3.4 -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 50 -j DROP
iptables -I INPUT -s 4.3.2.1 -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
share|improve this answer

I am not sure if nginx supports such type of limits. However, you can use iptables limit module. You can look at this page for more explanation.

Here is an example to accept the new HTTP connections at rate of 5 conn per minute.

-A FORWARD -d your.server.ip.addr -m state --state NEW -p tcp --dport 80 \
   -m limit --limit 5/minute -j ACCEPT
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.