Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to limit the number of requests that we get from single IPs, using squid (assume I have to use squid for political reasons), blocking those that make too many requests in a set period of time.

I was considering writing a short Perl script and an external_acl_type, with a delay pool, but I am unsure as to what parameters I can pass to the helper function.

something like:

external_acl_type rate_limit /usr/bin/squid-access-control dst

but I am not sure if that would work?

share|improve this question
    
How many users do you have? –  diegows Jun 22 '12 at 22:40

1 Answer 1

So the solution I came up with, which I think is quite worth documenting, is as follows:

  • Squid logs all of the requests it receives
  • For CDN requests, squid follows the X-forwarded-For header, leaving the actual client IP in the logs
  • Fail2ban checks the logs, recording how many requests are being made by clients per minute etc
  • When a client makes X number of requests, it is put into the squirm IP list, which has the request rewritten to point to a webserver on the loadbalancer.
  • Squid picks this up, denies this request access to the actual webservers and allows them access to a thttpd server running on the loadbalancer, which hosts a webpage of "you're banned!"
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.