Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [rate-limiting]

In computer networks, rate limiting is used to control the rate of traffic sent or received on a network interface.

Filter by
Sorted by
Tagged with
1 vote
0 answers
60 views

NGINX Rate Limiting Configuration Leading to 404 Error for Specific Route in Plesk-Managed CakePHP App

I'm using Plesk 18 with NGINX as a proxy in front of Apache2 for a CakePHP application. I have set up rate limiting in my NGINX configuration (/etc/nginx/nginx.conf) with limit_req_zone $...
magic.77's user avatar
  • 111
0 votes
1 answer
31 views

RateLimit is doing weird maths and wrong numbers on kernel

I'm trying to apply a set of rate limit within iptables, and it's doing some weird maths that i'm not able to see on the kernel why this is happen. I tried to execute same code on my local machine, ...
JustDevZero's user avatar
0 votes
1 answer
73 views

What is the minimum and maximum value for --limit option in iptables?

I have below iptable rule iptables -A PRIO_IN -p tcp -s 203.0.113.0 --sport 5432 -d 203.0.113.0 --dport 5432 -j ACCEPT -m limit --limit 100000/sec When i run this rule, i get error as Rate too fast ...
Karma Yogi's user avatar
0 votes
1 answer
107 views

Defining Burst and No Delay for NGINX

I'm trying to limit my server (an API) to only allow 3 requests to be made per second (by IP, coming from Cloudflare), and after that the user receives an HTTP 429 code. I don't want to allow anything ...
Tom's user avatar
  • 289
2 votes
1 answer
184 views

Rate limiting PHP requests in the absence of WordPress/WooCommerce cookies in Nginx

I want to rate limit PHP requests in the absence of wp-*, wordpress-*, comment_*, woocommerce_* cookies. I have the following configuration, which works, but it doesn't include the cookie check: http {...
László Monda's user avatar
0 votes
0 answers
61 views

How to verify XFF_IP is from a known Proxy or CDN while enforcing key in Google Cloud Armor Security Policy?

I'm currently working on a project where I want to apply rate limiting at the load balancer level to each user's IP address. The idea is to throttle any user that crosses a certain request limit in a ...
Aviral Srivastava's user avatar
1 vote
1 answer
508 views

Testing rate limiting rules in firewalld

I want to rate limit ssh connections per IP to a server running firewalld. Suppose my sshd listens on port 2222, and I want to limit ssh connections per IP to 3 per minute. I tried: sudo firewall-cmd -...
lonix's user avatar
  • 978
1 vote
2 answers
70 views

.io auth. NS refuses UDP response to dnsviz.net – why shouldn’t I, too?

Seriously, say, I block (return, not drop of course) UDP :53 in to my authoritative nameserver. Resolvers will fall back to TCP and I won’t need any rate limiting against spoofed source IPs. Because ...
Al Klimov's user avatar
  • 100
1 vote
1 answer
486 views

Rate limit specific PHP endpoints when running Nginx with php-fpm

Like many apps, I have some endpoints that are more sensitive than others, such as login & password reset, and need rate limiting. However, nginx handles all requests for PHP resources through a ...
Synchro's user avatar
  • 3,250
1 vote
1 answer
153 views

What things should I consider when identifying and rate limiting bots?

// Not sure if this question is best fit for serverfault or webmasters stack exchange... I am thinking to rate limit access to my sites because identifying and blocking bad bots take most of my time. ...
adrianTNT's user avatar
  • 1,169
0 votes
1 answer
589 views

Is there a way of telling web crawlers / robots about number of requests limit per second / minute / etc

I was thinking on a way similar to robots.txt that is used by good bots crawling a website. In the robots.txt I can define the User-agent, Allow and Disallow. My goal is to pass the message about the ...
Milos Cuculovic's user avatar
0 votes
1 answer
1k views

Maximum QPS with Google Load Balancer

In GCP's documentation, Google claims to support up to 1million queries per second. My team, however, as part of a project, decided to put both the Regional HTTPS LB and Global HTTPS LB to test. Here ...
Olu's user avatar
  • 1
0 votes
0 answers
760 views

How to limit concurrent request per ip using iptables for a limited time?

i want to limit request per ip for a certain time like as if daily 2000 request coming from single ip address. i want to block this ip for 24 hours. after 24 hours it is automatically allow from ...
Soikot's user avatar
  • 1
-2 votes
2 answers
712 views

How do you rate limit an Azure Storage account?

I have an Azure storage account that hosts 20 MB files. Users download the files directly from the storage account, and there is no CDN or anything monitoring the traffic. I'm concerned that users can ...
MakotoE's user avatar
  • 99
0 votes
1 answer
730 views

nginx req_limit does not work in regex location

i have nginx file part like this http { limit_req_zone $binary_remote_addr zone=limit:1m rate=10r/s; server { listen 443 ssl; server_name domain.temp; root "/var/www"; ...
yvgwxgtyowvaiqndwo's user avatar
2 votes
1 answer
521 views

Best way to rate-limit all files across the entire web server in Nginx?

I set up a ratelimit in my nginx config. Usually you would define a location and define the rate limit zone. I want the zone to apply on ALL files on the web server. limit_req_zone $binary_remote_addr ...
0xPenis's user avatar
  • 21
2 votes
1 answer
732 views

Nginx - disable rate limiting for cached resources

I have an application does full text search on my product database. Certain searches are suggested to the user and are much more common than other searches. As full text searches are expensive, I'm ...
nwarp's user avatar
  • 143
2 votes
1 answer
1k views

traceroute: sometimes routers don't respond and user sees timeouts

I'm an admin of small network and I'm investigating a problem my users complain about. The root of their complaints is traceroute: sometimes routers along the path simply don't respond to traceroute ...
ico's user avatar
  • 21
2 votes
0 answers
558 views

What's The Difference Between Rate-Limiting and Throttling?

I keep hearing the terms used interchangeably, but is there an actual difference? In this article they mention: Rate Limiting and Throttling policies are designed to limit API access, but have ...
Alex Weitz's user avatar
0 votes
0 answers
397 views

What is the difference between 10r/s burst=0 and 1r/s burst=9 nodelay?

What is the difference between: 10r/s and burst=0 1r/s and burst=9 nodelay 1st case has processing size capacity of 10r/s. So it allows 10 requests to happen in parallel per second, 11th concurrent ...
variable's user avatar
  • 249
0 votes
0 answers
494 views

nginx limit_req_zone rate limiting granularity

How should the rate be interpreted in the nginx rate limiting module? 10 r/s means 1 request every 100ms - this means granularity is 100ms; and 2nd request within the 100ms will get rejected. Does 30 ...
variable's user avatar
  • 249
0 votes
1 answer
4k views

How to limit Nginx to max 50 request per second independent from IP

I'm looking for a way to limit Nginx for location to a number of requests per second independent of the origin IP. From my understanding the rate limiting feature is IP sensitive which cannot be ...
frlan's user avatar
  • 583
0 votes
1 answer
39 views

Postfix Rate limiting according to a particular user

So this question is again on the table. I have tried to get my answer from forums documents but I wasn't able to find the desired answer. So, Here is my question I have created a mail server with ...
sanjib's user avatar
  • 73
3 votes
1 answer
2k views

Rate-limiting only the homepage with Nginx limit_req_zone module?

I have a Wordpress multisite installation and I have some bots hammering the home pages. I would like to set a rate limit only on the home page(s) of the site(s) but leave the other pages unlimited. ...
Elkrat's user avatar
  • 35
0 votes
0 answers
85 views

Handling DDoS HTTP Attack

I’ve experiencing DDoS attack today and I’ve configured Cloudflare rate limiter, also activated WAF. Cloudflare blocked several hundred thousands request. Unfortunately, my server still experiencing ...
Putra's user avatar
  • 1
0 votes
1 answer
394 views

In rsync the "bwlimit" parameter is explicitly ignored, how to fix this

I have rsyncd version 3.1.2 listening on port 873 and I want to limit the bandwidth with which my files are downloaded by a client connecting to me. I added a bwlimit both in the config file: uid = ...
Mnemosyne's user avatar
  • 131
2 votes
1 answer
695 views

How to force Linux users to respect max login rate

How does one set a rate-based throttle and/or quota for SSH logins per user on a shared system? For example: limit an SSH login to one time per 10 seconds. Things I've looked at: pam throttle and ...
EdwardTeach's user avatar
0 votes
1 answer
407 views

Possible to create an AWS API Gateway to Route all requests to Classic Load Balancer?

I have a questions (hopefully not dumb). I am the IT guy of a business hosting various applications with AWS and we currently have a Classic Load Balancer sitting in front of 2 to 3 EC2 instances ...
realnsleo's user avatar
  • 117
1 vote
1 answer
454 views

Logging nginx rate-limited IPs into a specific file

I'm looking for an approach to synchronize rate-limited IPs between nginx nodes. I want to log these IPs and after that pushing them into a database and developing an agent to update blocked IPs in ...
Little Apocrypha's user avatar
1 vote
0 answers
297 views

named rate limiting - DDOS prevention

I'm wanting to implement some rate-limiting onto our named servers and am looking for some help on making sure the values are "sane". This is what I'm thinking... rate-limit { errors-per-...
Egyas's user avatar
  • 185
1 vote
1 answer
346 views

Ratelimit IPs for UDP traffic in ipset list before being sent over GRE tunnel

I am using nat DNAT to forward traffic on a certain port to another Centos server over a GRE tunnel however I want to rate limit a bunch of datacenter IPs I have in a ipset list 'blacklist'. So that ...
Rushy's user avatar
  • 21
0 votes
1 answer
92 views

Why do some elements of the joomla site not load after setting limit_req?

I have an Nginx reverse proxy that forwards http and https requests to contianers from a Docker server. Recently, I set up a DoS / DDoS protection on the proxy so that the docker server resources don'...
campos's user avatar
  • 115
1 vote
0 answers
613 views

How to Implement Rate Limiting in Azure Web Application Firewall(WAF)?

I am looking to implement global rate limiting to Azure WAF. I have created custom rate limiting rules but they are IP based. I know Azure DDoS protection provides a certain coverage limit. But my ...
Kalana Wijethunga's user avatar
0 votes
0 answers
153 views

Differentiate and limit nginx bandwith for download connections, website content

Is it possible (without additional tools or the addition of another distribution system) to limit the bandwith of overall download connections (upload to peers that requested to download a file) so ...
loopend's user avatar
  • 11
1 vote
1 answer
2k views

Rate limiting in postfix

So i have been trying to make a mail servddder which is functioning fine now what i want now is i want to limit the amount of mail a mail user can send I have tried and failed with policyd I also ...
sanjib's user avatar
  • 73
1 vote
0 answers
265 views

How can I limit incoming/outgoing connection speeds based off IPs?

I want to limit the speed each IP can download/upload files for every application on my server to 1Mb/s Example IP 192.168.0.1 is downloading at sustained 900Kb/s through FTP server if the IP then ...
Toodarday's user avatar
  • 235
0 votes
1 answer
254 views

`iptables` rate limiting & blocking IP addresses based on total download size?

I have a webserver which serves either tiny, or very large files. I want to rate limit IPs by bandwidth. i.e. you can download X GB per day, and then you get blocked for Y hours. Is it possible in ...
Amandasaurus's user avatar
  • 32.4k
2 votes
1 answer
523 views

Nginx rate limiting on unique IPs

we've been dealing with constant attacks on our authentication url, we're talking millions of requests per day, my guess is they are trying to brute force passwords. Whenever we would block the IP ...
Julien's user avatar
  • 252
2 votes
2 answers
835 views

Is there is a way to limit access per hour per user in apache2?

When requesting, POST form with userID is already required, so if I can log the userID of the POST form, I think there would be a way to limit to n times(I think 3 time per hour is good for me) of ...
SJang's user avatar
  • 21
1 vote
1 answer
2k views

Stop Ubiquiti ICMP restrictions (two concurrent pings at once from same host for traceroute)

How do I change the Ubiquiti Security Gateway's default icmp restrictions from inside the LAN? It seems that my Ubiquiti Security Gateway's default settings will drop icmp packets if I'm doing more ...
Michael Altfield's user avatar
1 vote
0 answers
769 views

Is it possible to tell nginx to delay a response from a reverse proxied server?

I have an application server sitting behind nginx, and in some cases (e.g. wrong password), I want to intentionally delay the response by 500ms or more. Implementing this delay in the application ...
CaptainCodeman's user avatar
3 votes
1 answer
1k views

Can I use rate-limiting with HTTP basic authentication in Apache?

So I'm running a few popular web applications on my server. I want these to be reachable from any computer without creating too many vulnerabilities. I am using Apache 2.4.29 as my HTTP server. My ...
CodeFlo's user avatar
  • 33
0 votes
1 answer
3k views

Exchange (2016) many mailbox delegations and throttling policies

At a customers site with 20+ employees per team I get an outlook warning message roughly translated to "The amount of elements opened at once has been limited by the server administrator". ...
Silberling's user avatar
5 votes
1 answer
14k views

How do I limit linux CPU and RAM usage per user

I would like to limit CPU and ram usage per user. So, let's say there is user john. He can run as many processes as he wants, but he also needs to have 2048 megabytes of ram and 2 CPU cores. I know ...
Mario Mlinaric's user avatar
1 vote
0 answers
2k views

Nginx responding with 429s but I don't have it configured in my config

I'm hosting a rails app on AWS elastic beanstalk and am noticing my nginx server returning 429s in the nginx log. The problem is, I'm not seeing where the limit_req is being defined so I'm struggling ...
Johnny's user avatar
  • 11
4 votes
1 answer
3k views

Exclude location from NGINX rate limiting

I have both limit_req_zone and limit_req defined in the http block of nginx so it will apply to all server and location blocks. Is there a way to exclude a certain location or server block from that ...
Finrod Felagund's user avatar
0 votes
1 answer
781 views

Linux HTB: More than 70% of ceil rate is never achieved

Background:- I have an arm based system, which has HTB setup on the eth and wlan interface. Here is the HTB configuration:- tc class add dev eth1 parent 1:1 classid 1:1 htb rate 1Gbit ceil 1Gbit ...
Vo1dSpace's user avatar
0 votes
1 answer
833 views

Postfix limit connections

I have a question about Postfix. Last night someone tried to access my Postfix server, he/she connected like ~30 times to it. Is there any way to limit simultaneous connections? Here is a part of the ...
Taoiseach's user avatar
3 votes
1 answer
1k views

HAProxy Rate limiting per IP with queuing

I'm moving towards HA using it to replace also NGINX and I've a question regarding how to do a Rate Limiting in HA that enables queuing the request instead of closing them. I was able to limit per IP ...
EsseTi's user avatar
  • 257
2 votes
0 answers
222 views

Flush old entries from nftable meter list

I use nftables to do rate limiting: chain input: { type filter hook input priority 0; policy accept; tcp dport http ct state new jump rate-limit } chain rate-limit { meter httplimit4 { ...
router's user avatar
  • 21

1
2 3 4 5