Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're using HAproxy as a front end load balancer / proxy and are looking for solutions to block random IP addresses from jamming the cluster.

Is anyone familiar with a conf for HAProxy that can block requests if they exceed a certain threshold from a single IP within a defined period of time. Or can anyone suggest a software solution which could be placed in front of HAProxy to handle this kind of blocking.

share|improve this question

migrated from Dec 2 '09 at 20:17

This question came from our site for professional and enthusiast programmers.

fail2ban is able to add firewall (iptables) rules to block traffic in response to logfile entries so if you can make HAProxy write log entries for requests, fail2ban can rate limit for you.

share|improve this answer

Just use regular IPtables. Example below is for ssh, hopefully you get the idea.


iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

There is also "hashlimit" module, but I haven't tried that

share|improve this answer

Depending on whether you wish for the denied ips to be retained over reboots or not. These routes are lost during a reboot (unless you add to rc.local etc). But in a pinch when I have had nasty people hammering at some of our systems I just add a null route to the haproxy server.

route add -host[net] Target[/prefix] gw

This is fast, does not require editing iptables and can be pulled simply by removing the route.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.