Hot answers tagged

27

This can be done using the LimitReqModule with Nginx. However if this is for a reverse proxy you might want to try out the new rate limiting supported by HAProxy. I found the nginx rate limiting to be a little bit confusing to get the exact rate you want. But you basically have something like: limit_req_zone $binary_remote_addr zone=default:10m ...


13

Yes, typical rate-limiting configuration definition string looks like: limit_req_zone $binary_remote_addr zone=zone:16m rate=1r/s; where $binary_remote_addr is the unique key for limiter. You should try changing it to $http_x_forwarded_for variable which gets the value of X-Forwarded-For header. Although this will increase memory consumption because ...


12

UFW is designed to be "uncomplicated," which in this case means you don't have control over the particulars of the rate to which connections are limited. If you want to dig into the Python source of UFW, you could find out how to tweak it. The appropriate information is (on my Ubuntu 10.04 system) in /usr/share/pyshared/ufw/backend_iptables.py Setting the ...


11

It is really better to avoid using the "if" directive. When the key in limit_req_zone (and limit_conn_zone) is empty the limits are not applied. You can use this in conjunction with the map and geo modules to create a whitelist of IPs where the throttle limits are not applied. This example shows how to configure a limit for both concurrent requests and ...


7

While I dearly wish that ISC would document these features better for the sake of users with an experience level below "expert", that is wishful thinking. There are two separate implementations of rate limiting within BIND as of 9.11, and they are targeted at solving two completely different problems. DNS RRL The first form of rate-limiting is DNS Response ...


6

We just setup Riemann to handle alerting based on log messages. Riemann can read a stream of log messages from logstash and send out alerts based on the contents. One of the advantages with riemann is you can rollup all messages from a certain time into one email. This way you will not get to many e-mails but you will still get all your messages. Much ...


6

Try with: firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp --dport 22 -m state --state NEW -m recent --set firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT_direct 1 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 30 --hitcount 4 -j REJECT --reject-with tcp-reset firewall-cmd --reload A full ...


6

The documentation here has an explanation that sounds like what you want to know: The directive specifies the zone (zone) and the maximum possible bursts of requests (burst). If the rate exceeds the demands outlined in the zone, the request is delayed, so that queries are processed at a given speed From what I understand, requests over the ...


5

You can use ratepipe. I downloaded and tried it out and it seems to DTRT. It should work for you: tar --remove-files -cvif - 2011-08-02_14-05-09 | ratepipe -r 20 > 2011-08-02_14-05-09.tar


5

You need to set default_destination_recipient_limit = 2 instead of 1. Because if set to 1 then the limit will only apply to the same recipient, not domain.


5

try to use http://opensource.adnovum.ch/mod_qos/ mod_qos now taking care of anything :)


5

Changing the rsync command or wrapping it in a shell script to include the ionice command/parameters is an option. Also, You can leverage the --rsync-path option, which tells rsync which command to execute on the remote server. Something like --rsync-path="ionice -c2 -n7 rsync" will ensure that ionice runs on the destination. I'll add that ionice is not ...


5

I user Netlimiter 2 for my personal stuff. http://www.netlimiter.com/ I know they've moved to 3, but I haven't. Its absolutely fantastic for my purposes. You can block/limit inbound and outbound seperately, by application, by port (although I don't think you can just do port filtering...) Its USD29.99 so will definitely break the bank (If Sam's answer is ...


4

Yes, don't load the server up. But seriously, if you have a CPU thermal issue, it's best to take care of it now, and not later. It's not very good for (sensitive) electronics to be continually overheated and put back to work. I'm not familiar with cpufreqd, does it throttle frequency based on current load? If so, it may be scaling frequency back up when ...


4

A rate limit is not a prevention but rather an invitation to DoS - especially in the flavor presented above where packets are going to be dropped if a certain rate of unauthenticated packets without state information has been exceeded. Since everybody can forge packets (including source IP addresses) at this connection state without greater effort, a new DoS ...


4

The 5400zl series supports a very full feature list to provide quality of service (QoS) and traffic management. And for your specific requirement it also supports rate-limiting. Your best bet will be to upgrade to the latest version (K.15.8 at this point in time). The reference is the Advanced Traffic Management guide (current version) What you need to do ...


4

From my experiments it seems that per minutes is just a way to write rates that are on sub-second intervals. So 60r/m == 1r/s. This can be demonstrated by setting it to 60 requests per minute and then launching say 2 requests per second. It will be limited from the start, not only after 60 requests have been made. That being said, I still don't fully ...


4

One thing is for sure - if you use security groups, the filtered traffic never reaches your server, so it reduces the load the server needs to take to process firewall rules. This is important if you talk about DDoS. The security groups seems to have just simple filtering rules, while with iptables you can do really fancy things. But do you need them? ...


4

The way I see it is as follows: Requests will be served as fast as possible until the zone rate is exceeded. The zone rate is "on average", so if your rate is 1r/s and burst 10 you can have 10 requests in 10 second window. After the zone rate is exceeded: a. Without nodelay, further requests up to burst will be delayed. b. With nodelay, further requests ...


4

I was just trying to do this myself, was having no luck, and decided to resort to my google-fu. The top result for me when looking for multiple levels of rate limiting was this, and I got really excited. Then I saw it had no answers and initially fell into an existential pit of despair. After digging myself out, I kept hacking, and by some stroke of luck, I ...


4

Look at "policyd" for Postfix. That should be able to fix your ratelimiting. That said, 10 SMTP connections per minute seems stupidly low, and I'd challenge the provider on that (600 per hour may be reasonable)


4

In short, Yes traffic control software can indeed drop packets when shaping traffic. That's ok for TCP protocols as TCP will take care of ensuring that lost packets get resent. The Traffic Shaping Wiki describes some of the methods used to shape the traffic. There are many algorithms available such as RED, tail drop and others. Will the traffic control ...


4

No shipping version of Windows Server has any built-in functionality to do rate-limiting like you're looking for, either in the IP stack or in the DNS server. You're stuck putting a firewall that can rate-limit in front of the Windows machine if you want this type of functionality.


4

rate limit can by changed on the ufw rules file which can be found /lib/ufw/user.rules. by default there are no limits enabled for all ports. you should add every port manualy or by editing user.rules file.


4

Use a status code other than 503 for your "maintenance mode." As we can clearly see, users don't actually get served a 503 when you are using "maintenance mode" anyway, so there's no benefit to using that status code internally in your configuration. Make up another code (593?) and use that. Or better yet, skip the extra location and just send the ...


4

"is there any way to detect whether an online backup service is doing IP-based throttling" - Even though your question is Off-Topic for ServerFault, I'll help before a Meta post shows up. Since you mention it is Backblaze, they provide a service URL to test your speed: http://www.backblaze.com/speedtest/ And on that same page discuss how to check if ...


4

A fairly common infrastructure is one where none of the actual application servers have public IPv4 IP-addresses, they will be in a RFC 1918 private network range behind a load-balancer and any outgoing request they make is either: routed through a NAT gateway, giving the appearance of a single source IP-address must be made through a proxy server, which ...


3

Expanding on HBruijn's answer, I recommend this ACL segment: # Keep authenticated users under control deny authenticated = * set acl_c_msg_limit=${lookup{$sender_address}nwildlsearch{/etc/exim/send_limits}} ratelimit = $acl_c_msg_limit / 1d / strict / $authenticated_id Then you create the /etc/exim/send_limits file and have this in there: # ...


3

On Amazon EC2, you are not charged for incoming traffic. You are only charged for outgoing traffic. src: http://aws.amazon.com/ec2/pricing/#DataTransfer One thing to know is that you cannot add or remove a security group to a running instance. You can however change the rules in the security group you used for that instance.



Only top voted, non community-wiki answers of a minimum length are eligible