Rate limiting (cutting off) if exceed n connections per minute

Question

What do you suggest I use to rate limit incoming http connections (get/post) based on n connections per minute?

If a particular client makes more than n connections in a given minute, drop all further connections until the minute is up.

I currently use nginx and haproxy, but I'm really looking for the best tool for the job.

Update

Some clients have more connections allowed per minute, would there be a way to add a per client rule? An API would be a bonus.

Answer 1

It depends how gracefully you want to apply the cut off. For DROP/DENY on the TCP layer you can do it with iptables with something like:

iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --set  
iptables -I INPUT -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 5 -j DROP

You can target things to specific clients, with extra alternatives for the second rule e.g.

iptables -I INPUT -s 1.2.3.4 -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 50 -j DROP
iptables -I INPUT -s 4.3.2.1 -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP

Answer 2

I am not sure if nginx supports such type of limits. However, you can use iptables limit module. You can look at this page for more explanation.

Here is an example to accept the new HTTP connections at rate of 5 conn per minute.

-A FORWARD -d your.server.ip.addr -m state --state NEW -p tcp --dport 80 \
   -m limit --limit 5/minute -j ACCEPT