Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are getting an unusually heavy amount of traffic for a few URLs, ex:

http://www.example.com/search.php?type=0&mode=search&searchterm=Little

http://www.example.com/product.php?productid=12345678

What's the best way to block these URLs in nginx?

Any other suggestions to limit the amount of connections per second/minute for specific pages?

share|improve this question

4 Answers 4

If the incoming traffic is truly unusual and you are confident in saying that the traffic is spam, consider blocking it at your firewall. The lower in the stack that you can deny the traffic, the better. For example iptables -A INPUT -s 1.1.1.1 -j DROP. Of course, replace 1.1.1.1 with the IP address in question.

A broader tool to secure your server from suspicious incoming connections would be fail2ban. There are also rules that you can make that are specific to Nginx. Fail2ban protects you from many different attacks and isn't just a solution to your specific question.

For a solution specific to Nginx, it comes with a module named ngx_http_access_module that allows you to allow or deny access based on IP address. You would open nginx.conf and add include blockips.conf; Then create blockips.conf in wherever your Nginx configuration files are. Likely it's /usr/local/nginx/conf/. Finally, add deny configurations as desired:

deny 1.1.1.1;
deny 2.2.2.0/24;
deny 3.3.0.0/16;
share|improve this answer
1  
I'd mention ipset when it comes to netfilter use for this purpose. Also, if you're completely blocking the host as with -s … -j DROP blackhole routing is way preferable since there's no overhead for every packet traffic inspection. –  poige Apr 26 '12 at 6:00

Using the same principle from, http://www.sonassi.com/knowledge-base/maintenance-page-with-nginx-with-specific-permitted-access/ and http://wiki.nginx.org/HttpLimitReqModule

The following code would allow you to ban specific IPs from accessing those URLs and also rate limit anyone else trying to access those URLs.

http {
...
limit_req_zone  $binary_remote_addr  zone=one:10m   rate=1r/s;
...
server {
..
 set $deny_access off;

  if ($remote_addr ~ (bad.ip.add.ress|second.bad.ipadd.ress|third.bad.ipadd.ress)) {
   set $deny_access on;
  }
  if ($uri ~ "^/(search\.php|product\.php)\?(type=[0-9]+&mode=[a-z]+searchterm=(.*)+|productid=[0-9]+)$" ) {
   limit_req   zone=one  burst=5;
   set "${$deny_access}on";
  }
  if ($deny_access = onon) {
   return 503;
  }
  location /deny_access{
  }
  error_page 503 @deny_access;
  location @deny_access {
   rewrite ^(.*)$ /deny.html break;
 }
..
}
..
}
share|improve this answer

You can also use the limit_req module to limit the rate at which each source IP can access certain paths.

share|improve this answer

http://nginx.org/en/docs/http/ngx_http_rewrite_module.html#return : «… In addition, the non-standard code 444 closes a connection without sending a response header. …»

— So you just define those specific locations and use return 444 there.

Any other suggestions to limit the amount of connections per second/minute for specific pages?

mgorven has pointed you at already.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.