1

I want to have a Rate Limiting code with the following options:

  • I'm using CloudFlare, so I want it to look for the real IP address.
  • I want to have a whitelist option
  • I want to make a file with a list of the blocked IP addresses (IPs who reached the threshold).
  • The rate limiting will be 15 requests per 2 seconds, something like that.

I found this answer: https://serverfault.com/a/642357

And it looks great, but will it look for the real IP address? I have this code:

set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/12;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 199.27.128.0/21;
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;

# use any of the following two
real_ip_header CF-Connecting-IP;
#real_ip_header X-Forwarded-For;

And also, how do I make this code listing the blocked IP addresses into a new file?

  • I don't think Nginx can write the IPs to a file. If you really need that you could look at using fail2ban. – Tim Jul 25 '17 at 19:16
2

It's possible to rate limit using the IP from xff header sent by CF:

http {
limit_req_zone  "$http_x_forwarded_for" zone=zone:10m rate=2r/s;
server {

location /{
            limit_req zone=zone burst=5;
        }

more info: https://www.keycdn.com/blog/x-forwarded-for-cdn/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.