Tag Info

New answers tagged

0

You can use fail2ban and use following jail with nginx to rate limit misconfigured bots cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local and add this at bottom [nginx-req-limit] enabled = true filter = nginx-req-limit action = iptables-multiport[name=ReqLimit, port="http,https", protocol=tcp] logpath = /var/log/nginx/*error.log findtime = 600 bantime = ...


1

You can certainly do this in nginx with the limit_req_zone module. In nginx.conf setup a zone: limit_req_zone $binary_remote_addr zone=one:1000m rate=100r/m; You can also use X_Forwarded_For instead of binary_remote_addr too. In your site config location block just reference the zone: limit_req zone=one burst=10 nodelay; doc: ...


0

Your rules ACCEPT packets up to a certain rate, but is there anything after that that DROP the traffic when it doesn't match the rules? Either default chain policy (-P) or an explicit rule... What you could do is change your rules to DROP traffic with --hashlimit-above; ex: # iptables -t filter -A it2net -s 10.5.2.43/32 -m hashlimit --hashlimit-above 8kb/s ...


0

To answer your first question: yes. Well, in my personal opinion anyway, don't take it personally. The thing is that you are trying to set the limits on your TCP stack, while you have yourself a loadbalancer in front of it with many counters and options. If you limit yourself in the TCP stack, you run into way more problems when you hit those limits. I would ...



Top 50 recent answers are included