To clarify, I do not wish to limit the number of simultaneous connections, nor do I want to limit the number of HTTP requests. I only want to limit the number of NEW connections per IP.

I want to do this because most web crawlers do not have keep-alive functionality and thus they open a new connection for every request.

I vaguely remember reading about a mod that could do this, but I can't remember the name. Hopefully, someone here can help me out.


I wouldn't do it in apache.. I'd do it at network layer with iptables.

iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 86400 --hitcount 100 -j REJECT

Change 86400 to the number of seconds you want to keep the block for (86400 is 1 day), and 100, is the hit count, how many you're prepared to allow per IP.

You can also change -j REJECT to -j DROP, which defines the packet behaviour when the condition is met. DROP seamlessly drops packets, and REJECT returns a "port unreachable" or similar error.

That said, there was a mod_throttle that would do something similar, but I can't seem to find much information about it. I think it feels neater to do this kind of thing at the network/kernel level, rather than in Apache. Apache is good at serving requests. Let it do what it does best, and don't burden it with having to track connections too.

  • Thanks, but I'd like to serve a message to the user's who get blocked, just in case there are any false positives. Any idea how I could do that? I suppose I could run a cron job that checks the output of iptables every few minutes, and places the blacklisted IPs into a .htaccess file or something similar. – user45795 Aug 9 '10 at 0:01
  • A htaccess file probably wouldn't work, because the traffic would never actually hit the server. The best idea would be to rewrite the packet and redirect it. – Tom O'Connor Aug 9 '10 at 17:45

you could tune the iptables rule so that requests beyond the limit are redirected to another port (e.g. TCP 8080) where another instance of Apache serves a static page with your message to users

  • Neat idea, I like it! – Tom O'Connor Aug 9 '10 at 10:44
  • Yeah, that is a good idea. Maybe something a little more lightweight than Apache, though. Thanks – user45795 Aug 9 '10 at 17:29
  • Nginx or Lighttpd perhaps? – Tom O'Connor Aug 9 '10 at 17:45

I think you are looking for mod_qos

  • If I'm not mistaken, that mod only allows you to limit the number of concurrent connections per IP, which isn't what I want to do. – user45795 Aug 9 '10 at 17:30
  • I could be wrong ;) – xenoterracide Aug 9 '10 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy