3

I'm not a specialist in networking, but I am curious is it possible to create such scheme with the help of nginx? The main objective is to hide client real IP address behind proxy layer, where each proxy node has its own IP address and load balancer (LB) balance requests with "round robin" rule. Client is some application in my case and I want to . The desired scenario is the following:

Client (app) makes http request to some.api.com, LB intercept the request and address it to one of the node (e.g. Proxy 1), Proxy 1 receives the request and resends it to some.api.com and sends back the response. With such approach I want to avoid rate limits that exist in some.api.com. Is it possible to do?

enter image description here

Improve this question

1 Answer 1

Reset to default
3

That kind of scheme is called forward proxying- proxying on outbound requests, to be contrasted with reverse proxying, which is proxying on inbound requests. It is possible and easy to do, however in the context of rate limiting there are at least 3 issues arguing against it, two technical and one policy-

  1. Most rate limits are applied by API key, not by IP address (though IP rate limits are a common low level defense.) If you are consuming an authenticated API, your requests will be aggregated together regardless of IP

  2. Public IPs are scarce and NAT- network address translation- is common. You might build a forward proxy load balance scheme only to discover your proxies are being NATed- all given a common client IP on outbound requests- by some piece of downstream infrastructure

  3. The policy issue is- dont disrespect provider rate limits. If you have a business need for more capacity, talk to the provider and pay them for it, or if you cant afford it, explain it and work out some agreement with them.

Improve this answer
3
  • Thank you for such great answer! But I am not sure I catched the 2nd point fully. I know what is NAT, but not sure how it can be applied. Could you please describe it in other words? Thank you in advance.
    – jahra
    May 21, 2018 at 18:36
  • 1
    It is very common for organizations to use private IPs, e.g. addresses prefixed with 10.x.x.x- internally, and apply NAT to their outbound traffic. The NAT makes it appear that traffic from all internal IP addresses- could be hundred or thousands of IPs- originates from a single publicly routable IP. The software doing the NAT at the edge maintains a table of outbound TCP stream -> internal IP address, and readdresses returning packets so they can be delivered appropriately. A NAT would make it seem to an internet service that each proxy in the diagram had the same IP address.
    – Jonah Benton
    May 21, 2018 at 19:05
  • Got it. My plan is to use something like Amazon EC2 instances. Maybe you are familiar with AWS? I suppose that each ec2 instance has unique public IP. I do need only few nodes (~5) for my purposes.
    – jahra
    May 22, 2018 at 6:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .