As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [rate-limiting]

In computer networks, rate limiting is used to control the rate of traffic sent or received on a network interface.

Filter by
Sorted by
Tagged with
1 vote
1 answer
51 views

Testing rate limiting rules in firewalld

I want to rate limit ssh connections per IP to a server running firewalld. Suppose my sshd listens on port 2222, and I want to limit ssh connections per IP to 3 per minute. I tried: sudo firewall-cmd -...
lonix's user avatar
  • 871
1 vote
0 answers
119 views

Postfix: email forwarding to google, never re-try deliveries

I've a Postfix server with two virtual domains, users and aliases. Some of my users want their email centralized at Gmail and have aliases in place to redirect incoming e-mail to their Gmail accounts. ...
TCB13's user avatar
  • 1,136
0 votes
2 answers
27 views

.io auth. NS refuses UDP response to dnsviz.net – why shouldn’t I, too?

Seriously, say, I block (return, not drop of course) UDP :53 in to my authoritative nameserver. Resolvers will fall back to TCP and I won’t need any rate limiting against spoofed source IPs. Because ...
Al Klimov's user avatar
0 votes
0 answers
53 views

Rate limit specific PHP endpoints when running Nginx with php-fpm

Like many apps, I have some endpoints that are more sensitive than others, such as login & password reset, and need rate limiting. However, nginx handles all requests for PHP resources through a ...
Synchro's user avatar
  • 3,128
1 vote
1 answer
58 views

What things should I consider when identifying and rate limiting bots?

// Not sure if this question is best fit for serverfault or webmasters stack exchange... I am thinking to rate limit access to my sites because identifying and blocking bad bots take most of my time. ...
adrianTNT's user avatar
  • 1,077
0 votes
1 answer
113 views

Is there a way of telling web crawlers / robots about number of requests limit per second / minute / etc

I was thinking on a way similar to robots.txt that is used by good bots crawling a website. In the robots.txt I can define the User-agent, Allow and Disallow. My goal is to pass the message about the ...
Milos Cuculovic's user avatar
0 votes
1 answer
271 views

Maximum QPS with Google Load Balancer

In GCP's documentation, Google claims to support up to 1million queries per second. My team, however, as part of a project, decided to put both the Regional HTTPS LB and Global HTTPS LB to test. Here ...
Olu's user avatar
  • 1
0 votes
0 answers
38 views

How to discard a request from burst queue after a certain time in NGINX?

I want to set a low rate limit such as 5r/s to an upstream. I don't want to reject any request for surpassing QPS limit, So I am setting the burst value to a high number and using default delay value ...
SharifS's user avatar
0 votes
0 answers
92 views

iptables per-ip rate limiting problems

I am trying to deal with a persistent application level DOS attack on a web server (apache httpd 2.4, debian 10). The attacker appears to be spoofing public IP addresses given the sheer number of ...
mhilton's user avatar
0 votes
0 answers
66 views

nginx rate global limit split between two groups?

I've gone through the limit_req_zone docs and also searched through but haven't seen whether it's possible to do this with nginx rate limiting. I want to do the following: set a global rate limit ie. ...
leorio paradiknight's user avatar
0 votes
0 answers
522 views

How to limit concurrent request per ip using iptables for a limited time?

i want to limit request per ip for a certain time like as if daily 2000 request coming from single ip address. i want to block this ip for 24 hours. after 24 hours it is automatically allow from ...
Soikot's user avatar
  • 1
-2 votes
2 answers
214 views

How do you rate limit an Azure Storage account?

I have an Azure storage account that hosts 20 MB files. Users download the files directly from the storage account, and there is no CDN or anything monitoring the traffic. I'm concerned that users can ...
MakotoE's user avatar
  • 99
0 votes
1 answer
292 views

nginx req_limit does not work in regex location

i have nginx file part like this http { limit_req_zone $binary_remote_addr zone=limit:1m rate=10r/s; server { listen 443 ssl; server_name domain.temp; root "/var/www"; ...
yvgwxgtyowvaiqndwo's user avatar
0 votes
0 answers
299 views

Nginx Rate Limit blocks connections even when it doesn't exceed the limit

We are trying to use Nginx as a server for load balancing, and for security reasons, we decided to apply the native rate limiting feature, configuring it so that when there are more than 200 requests ...
Tom's user avatar
  • 269
0 votes
0 answers
169 views

Nginx limit_req_zone misbehavior

I want to block requests by IP and URI. I have this anti-DOS nginx config. It does not work. geo $blacklist { default block; someIPs white; } map $blacklist $limit { block &...
Top Secret's user avatar
1 vote
1 answer
164 views

Nginx ratelimit on ALL files

I set up a ratelimit in my nginx config. Usually you would define a location and define the rate limit zone. I want the zone to apply on ALL files on the web server. limit_req_zone $binary_remote_addr ...
0xPenis's user avatar
  • 11
2 votes
1 answer
285 views

Nginx - disable rate limiting for cached resources

I have an application does full text search on my product database. Certain searches are suggested to the user and are much more common than other searches. As full text searches are expensive, I'm ...
nwarp's user avatar
  • 143
2 votes
1 answer
548 views

traceroute: sometimes routers don't respond and user sees timeouts

I'm an admin of small network and I'm investigating a problem my users complain about. The root of their complaints is traceroute: sometimes routers along the path simply don't respond to traceroute ...
ico's user avatar
  • 21
1 vote
0 answers
362 views

What's The Difference Between Rate-Limiting and Throttling?

I keep hearing the terms used interchangeably, but is there an actual difference? In this article they mention: Rate Limiting and Throttling policies are designed to limit API access, but have ...
Alex Weitz's user avatar
0 votes
0 answers
162 views

What is the difference between 10r/s burst=0 and 1r/s burst=9 nodelay?

What is the difference between: 10r/s and burst=0 1r/s and burst=9 nodelay 1st case has processing size capacity of 10r/s. So it allows 10 requests to happen in parallel per second, 11th concurrent ...
variable's user avatar
  • 157
0 votes
0 answers
305 views

nginx limit_req_zone rate limiting granularity

How should the rate be interpreted in the nginx rate limiting module? 10 r/s means 1 request every 100ms - this means granularity is 100ms; and 2nd request within the 100ms will get rejected. Does 30 ...
variable's user avatar
  • 157
0 votes
1 answer
3k views

How to limit Nginx to max 50 request per second independent from IP

I'm looking for a way to limit Nginx for location to a number of requests per second independent of the origin IP. From my understanding the rate limiting feature is IP sensitive which cannot be ...
frlan's user avatar
  • 573
0 votes
1 answer
25 views

Postfix Rate limiting according to a particular user

So this question is again on the table. I have tried to get my answer from forums documents but I wasn't able to find the desired answer. So, Here is my question I have created a mail server with ...
sanjib's user avatar
  • 63
2 votes
1 answer
1k views

Rate Limiting Only the Home Page With NGINX limit_req_zone

I have a Wordpress multisite installation and I have some bots hammering the home pages. I would like to set a rate limit only on the home page(s) of the site(s) but leave the other pages unlimited. ...
Elkrat's user avatar
  • 25
0 votes
0 answers
56 views

Handling DDoS HTTP Attack

I’ve experiencing DDoS attack today and I’ve configured Cloudflare rate limiter, also activated WAF. Cloudflare blocked several hundred thousands request. Unfortunately, my server still experiencing ...
Putra's user avatar
  • 1
0 votes
1 answer
271 views

In rsync the "bwlimit" parameter is explicitly ignored, how to fix this

I have rsyncd version 3.1.2 listening on port 873 and I want to limit the bandwidth with which my files are downloaded by a client connecting to me. I added a bwlimit both in the config file: uid = ...
Mnemosyne's user avatar
  • 131
1 vote
1 answer
365 views

How to force Linux users to respect max login rate

How does one set a rate-based throttle and/or quota for SSH logins per user on a shared system? For example: limit an SSH login to one time per 10 seconds. Things I've looked at: pam throttle and ...
EdwardTeach's user avatar
0 votes
1 answer
170 views

Possible to create an AWS API Gateway to Route all requests to Classic Load Balancer?

I have a questions (hopefully not dumb). I am the IT guy of a business hosting various applications with AWS and we currently have a Classic Load Balancer sitting in front of 2 to 3 EC2 instances ...
realnsleo's user avatar
  • 117
1 vote
1 answer
216 views

Logging nginx rate-limited IPs into a specific file

I'm looking for an approach to synchronize rate-limited IPs between nginx nodes. I want to log these IPs and after that pushing them into a database and developing an agent to update blocked IPs in ...
Little Apocrypha's user avatar
1 vote
0 answers
191 views

named rate limiting - DDOS prevention

I'm wanting to implement some rate-limiting onto our named servers and am looking for some help on making sure the values are "sane". This is what I'm thinking... rate-limit { errors-per-...
Egyas's user avatar
  • 141
1 vote
1 answer
209 views

Ratelimit IPs for UDP traffic in ipset list before being sent over GRE tunnel

I am using nat DNAT to forward traffic on a certain port to another Centos server over a GRE tunnel however I want to rate limit a bunch of datacenter IPs I have in a ipset list 'blacklist'. So that ...
Rushy's user avatar
  • 21
0 votes
1 answer
76 views

Why do some elements of the joomla site not load after setting limit_req?

I have an Nginx reverse proxy that forwards http and https requests to contianers from a Docker server. Recently, I set up a DoS / DDoS protection on the proxy so that the docker server resources don'...
campos's user avatar
  • 17
1 vote
0 answers
414 views

How to Implement Rate Limiting in Azure Web Application Firewall(WAF)?

I am looking to implement global rate limiting to Azure WAF. I have created custom rate limiting rules but they are IP based. I know Azure DDoS protection provides a certain coverage limit. But my ...
Kalana Wijethunga's user avatar
0 votes
0 answers
114 views

Differentiate and limit nginx bandwith for download connections, website content

Is it possible (without additional tools or the addition of another distribution system) to limit the bandwith of overall download connections (upload to peers that requested to download a file) so ...
loopend's user avatar
  • 11
1 vote
1 answer
764 views

Rate limiting in postfix

So i have been trying to make a mail servddder which is functioning fine now what i want now is i want to limit the amount of mail a mail user can send I have tried and failed with policyd I also ...
sanjib's user avatar
  • 63
1 vote
0 answers
206 views

How can I limit incoming/outgoing connection speeds based off IPs?

I want to limit the speed each IP can download/upload files for every application on my server to 1Mb/s Example IP 192.168.0.1 is downloading at sustained 900Kb/s through FTP server if the IP then ...
Toodarday's user avatar
  • 205
0 votes
1 answer
213 views

`iptables` rate limiting & blocking IP addresses based on total download size?

I have a webserver which serves either tiny, or very large files. I want to rate limit IPs by bandwidth. i.e. you can download X GB per day, and then you get blocked for Y hours. Is it possible in ...
Amandasaurus's user avatar
  • 31.1k
2 votes
1 answer
425 views

Nginx rate limiting on unique IPs

we've been dealing with constant attacks on our authentication url, we're talking millions of requests per day, my guess is they are trying to brute force passwords. Whenever we would block the IP ...
Julien's user avatar
  • 232
2 votes
2 answers
343 views

Is there is a way to limit access per hour per user in apache2?

When requesting, POST form with userID is already required, so if I can log the userID of the POST form, I think there would be a way to limit to n times(I think 3 time per hour is good for me) of ...
SJang's user avatar
  • 21
1 vote
1 answer
1k views

Stop Ubiquiti ICMP restrictions (two concurrent pings at once from same host for traceroute)

How do I change the Ubiquiti Security Gateway's default icmp restrictions from inside the LAN? It seems that my Ubiquiti Security Gateway's default settings will drop icmp packets if I'm doing more ...
Michael Altfield's user avatar
1 vote
0 answers
540 views

Is it possible to tell nginx to delay a response from a reverse proxied server?

I have an application server sitting behind nginx, and in some cases (e.g. wrong password), I want to intentionally delay the response by 500ms or more. Implementing this delay in the application ...
CaptainCodeman's user avatar
3 votes
1 answer
1k views

Can I use rate-limiting with HTTP basic authentication in Apache?

So I'm running a few popular web applications on my server. I want these to be reachable from any computer without creating too many vulnerabilities. I am using Apache 2.4.29 as my HTTP server. My ...
CodeFlo's user avatar
  • 33
0 votes
1 answer
2k views

Exchange (2016) many mailbox delegations and throttling policies

At a customers site with 20+ employees per team I get an outlook warning message roughly translated to "The amount of elements opened at once has been limited by the server administrator". ...
Silberling's user avatar
4 votes
1 answer
9k views

How do I limit linux CPU and RAM usage per user

I would like to limit CPU and ram usage per user. So, let's say there is user john. He can run as many processes as he wants, but he also needs to have 2048 megabytes of ram and 2 CPU cores. I know ...
Mario Mlinaric's user avatar
1 vote
0 answers
1k views

Nginx responding with 429s but I don't have it configured in my config

I'm hosting a rails app on AWS elastic beanstalk and am noticing my nginx server returning 429s in the nginx log. The problem is, I'm not seeing where the limit_req is being defined so I'm struggling ...
Johnny's user avatar
  • 11
2 votes
1 answer
2k views

Exclude location from NGINX rate limiting

I have both limit_req_zone and limit_req defined in the http block of nginx so it will apply to all server and location blocks. Is there a way to exclude a certain location or server block from that ...
Finrod Felagund's user avatar
0 votes
1 answer
610 views

Linux HTB: More than 70% of ceil rate is never achieved

Background:- I have an arm based system, which has HTB setup on the eth and wlan interface. Here is the HTB configuration:- tc class add dev eth1 parent 1:1 classid 1:1 htb rate 1Gbit ceil 1Gbit ...
Vo1dSpace's user avatar
0 votes
1 answer
572 views

Postfix limit connections

I have a question about Postfix. Last night someone tried to access my Postfix server, he/she connected like ~30 times to it. Is there any way to limit simultaneous connections? Here is a part of the ...
Taoiseach's user avatar
2 votes
0 answers
801 views

HAProxy Rate limiting per IP with queuing

I'm moving towards HA using it to replace also NGINX and I've a question regarding how to do a Rate Limiting in HA that enables queuing the request instead of closing them. I was able to limit per IP ...
EsseTi's user avatar
  • 245
2 votes
0 answers
153 views

Flush old entries from nftable meter list

I use nftables to do rate limiting: chain input: { type filter hook input priority 0; policy accept; tcp dport http ct state new jump rate-limit } chain rate-limit { meter httplimit4 { ...
router's user avatar
  • 21

1
2 3 4 5