nGinX Forbidden still triggers request limit

Question

I have some "deny" rules before the request limit config. If a blocked user (by the deny rules) is ddossing the site he still triggers the request limit and therefore creates thousands of log entries. Why? I expected that it will not go past the deny rules.

    include        /etc/nginx/blacklist.conf;
    limit_req zone=limit burst=3 nodelay;

The log shows a forbidden error and right after that hundreds of request limitation errors. That repeats over and over again.

Answer 1

When nginx processes a request, it goes through several phases. Among them : preaccess and access phases. Preaccess is typically where limit_req works while access is where the allow/deny directives work. This means rate limiting is done before IP filtering if both directives are declared in the same context.

So if your will is to try to get some fail2ban alike process (given your other question return code 444) working directly in nginx using native directives, that's simply not possible by nature.

Answer 2

This issue is a bit old, but for anyone having this issue, the best solution I found for this case is to use a map with an if instead of the deny rules (although I try to avoid using ifs in nginx), because like Xavier Lucas said:

rate limiting is done before IP filtering

You can change your blacklist.conf file from:

deny 1.2.3.4;

to:

1.2.3.4 0;

Create a file whitelist.conf:

if ( $whitelist = 0 ) {
    return 403;
}

Then, in nginx.conf, include a map that whitelists every ip, except the ones in blacklist.conf:

http {
    geo $whitelist {
        /etc/nginx/blacklist.conf;
        default 1;
    }

    ...
}

Finally, also in nginx.conf, add before every server directive the whitelist.conf file:

server {
    server_name ...;
    listen 443 ssl;

    include /etc/nginx/whitelist.conf;

    ssl_certificate       /etc/ssl/bundle.crt;
    ssl_certificate_key   /etc/ssl/server.key;

    ...
}

...

The requests from the blacklisted ips will be returned immediatelly and won't be logged in the error logs file.

You can also stop the requests from those ips from being logged in the access logs file with:

access_log /path/to/file if=$whitelist;