41

It is really better to avoid using the "if" directive. When the key in limit_req_zone (and limit_conn_zone) is empty the limits are not applied. You can use this in conjunction with the map and geo modules to create a whitelist of IPs where the throttle limits are not applied. This example shows how to configure a limit for both concurrent requests and ...


29

I find limit_req documentation clear enough. burst is documented that way: Excessive requests are delayed until their number exceeds the maximum burst size [...] nodelay is documented that way: If delaying of excessive requests while requests are being limited is not desired, the parameter nodelay should be used Requests are limited to fit the ...


14

Thanks to a comment by EEAA, I was able to solve this using fail2ban. There's very little documentation about how to use fail2ban with HAProxy, however - so little in fact that this page is already nearing the top of a Google search for "haproxy fail2ban", so I'll detail how I did it. First of all, install fail2ban. If you can't do that bit you probably ...


13

TL;DR: The nodelay option is useful if you want to impose a rate limit without constraining the allowed spacing between requests. I had a hard time digesting the other answers, and then I discovered new documentation from Nginx with examples that answers this: https://www.nginx.com/blog/rate-limiting-nginx/ Here's the pertinent part. Given: ...


12

I was just trying to do this myself, was having no luck, and decided to resort to my google-fu. The top result for me when looking for multiple levels of rate limiting was this, and I got really excited. Then I saw it had no answers and initially fell into an existential pit of despair. After digging myself out, I kept hacking, and by some stroke of luck, I ...


10

Try with: firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT_direct 0 -p tcp --dport 22 -m state --state NEW -m recent --set firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT_direct 1 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 30 --hitcount 4 -j REJECT --reject-with tcp-reset firewall-cmd --reload A full ...


10

Here is a solution, how to do traffic shaping for data rate limiting of individual clients with tc (traffic control) using a script called by OpenVPN. The traffic control settings are handled in a script tc.sh with the following features: Called by OpenVPN using directives: up, down, client-connect and client-disconnect All settings are passed via ...


8

The comments on the original answer seem wrong. The question at hand is what the difference between, say rate=6r/s burst=0 and rate=1r/s burst=5 nodelay The answers are great about explaining the difference when the nodelay option is NOT present -- in which case, the requests queue up with the burst, and are 503'd without the burst. The original answer ...


8

While I dearly wish that ISC would document these features better for the sake of users with an experience level below "expert", that is wishful thinking. There are two separate implementations of rate limiting within BIND as of 9.11, and they are targeted at solving two completely different problems. DNS RRL The first form of rate-limiting is DNS Response ...


7

The "error" you're getting is more of a warning/notice than an error. trickle can be run standalone or as a client of trickled. It always looks for the default socket of the daemon and if not found it prints that message. You can safely ignore it. And about rate limiting Firefox, I'm pretty sure it has to do with the forking of the process, as David Fraser ...


7

We just setup Riemann to handle alerting based on log messages. Riemann can read a stream of log messages from logstash and send out alerts based on the contents. One of the advantages with riemann is you can rollup all messages from a certain time into one email. This way you will not get to many e-mails but you will still get all your messages. Much ...


7

Expanding on HBruijn's answer, I recommend this ACL segment: # Keep authenticated users under control deny authenticated = * set acl_c_msg_limit=${lookup{$sender_address}nwildlsearch{/etc/exim/send_limits}} ratelimit = $acl_c_msg_limit / 1d / strict / $authenticated_id Then you create the /etc/exim/send_limits file and have this in there: # ...


7

A fairly common infrastructure is one where none of the actual application servers have public IPv4 IP-addresses, they will be in a RFC 1918 private network range behind a load-balancer and any outgoing request they make is either: routed through a NAT gateway, giving the appearance of a single source IP-address must be made through a proxy server, which ...


6

By default, nginx will return a 503 service temporarily unavailable error code. The limit_req_status directive exists to change the error code in case they hit the limit_req : location = /search/bulk { limit_req zone=one burst=2; limit_req_status 404; } The problem is that this directive only allows a range from 400 to 599, so you ...


6

The way I see it is as follows: Requests will be served as fast as possible until the zone rate is exceeded. The zone rate is "on average", so if your rate is 1r/s and burst 10 you can have 10 requests in 10 second window. After the zone rate is exceeded: a. Without nodelay, further requests up to burst will be delayed. b. With nodelay, further requests ...


6

If you want to use rate-limit sessions, is the following feasible for you? frontend http_in bind 0.0.0.0:80 acl is_path url_beg /path/example/ use_backend forwarder if is_path backend forwarder server localhost 127.0.0.1:4444 send-proxy frontend limit_path_backend bind 127.0.0.1:4444 accept-proxy rate-limit sessions 10 default_backend ...


6

The usual reason for these questions is that most of these directives cannot be used from within the context of the if statement, hence, how would one be able to conditionally specify different limits? The answer is to use intermediate variables — just as in the linked answer, use set the limits using variables, where, subsequently, the values of those ...


6

There is no native mechanism within the Azure Application Gateway to apply rate limiting. Probably the simplest would be to look at the Azure Front Door service: https://docs.microsoft.com/en-us/azure/frontdoor/front-door-overview In particular the client rate limiting WAF rules: https://docs.microsoft.com/en-us/azure/frontdoor/waf-overview#waf-rules ...


5

With burst and nodelay specified I find it easier to understand the mechanism like this (the other way around than it is usually understood): You allow a maximum of burst requests. With $binary_remote_addr that's the maximum number of requests that you accept from a given address. Every request increases an internal counter. When the counter reaches burst ...


5

Andy, The trick is to add another backend that you only use for the extra stick table. You can only have one stick table per backend - BUT you can use them in ANY front/back end... So I just add one called Abuse that you can then use as a global 60 minute ban for any backend... You will need to change my example but try something like this: # ABUSE SECTION ...


5

FWIIW, I've also looked at the other "weird" answer to the question you link — it was written in 2011, had only 3 upvotes earlier today in 2017, compared to 23 upvotes for the more recent answer circa 2014 that you quote. Perhaps somewhat surprisingly, the older ignored answer does actually work without any issues as well! Here's my take at the full MVP ...


5

It wouldn't be a good practice to do what you are requesting for as it would also log any legitimate attempts i.e. actual passwords. Even logging just the failures would log any mistyped passwords, too. Instead, you could automatically block an IP address after certain amount of failed attempts. See this question: Does fail2ban do Windows?


5

The flexibility of IPv6 with addressing is great, but it does indeed make things like this harder. An algorithm that I would recommend: Start by blocking separate IPv6 addresses (a /128). It might be a single user on a network with multiple users, and you want to avoid blocking innocent users (which happens with IPv4 all the time because of NAT, let's not ...


4

Use a status code other than 503 for your "maintenance mode." As we can clearly see, users don't actually get served a 503 when you are using "maintenance mode" anyway, so there's no benefit to using that status code internally in your configuration. Make up another code (593?) and use that. Or better yet, skip the extra location and just send the rewrite ...


4

Look at "policyd" for Postfix. That should be able to fix your ratelimiting. That said, 10 SMTP connections per minute seems stupidly low, and I'd challenge the provider on that (600 per hour may be reasonable)


4

"is there any way to detect whether an online backup service is doing IP-based throttling" - Even though your question is Off-Topic for ServerFault, I'll help before a Meta post shows up. Since you mention it is Backblaze, they provide a service URL to test your speed: http://www.backblaze.com/speedtest/ And on that same page discuss how to check if ...


4

CentOS 7 has changed a few things that people have become comfortable with and they squirm - wiggle away - and run from - the reality of the changes usually. Many people do not know or realize that firewalld is not a "new" firewall - it is a "front-end" to iptables that Red Hat is incorporating as a GUI capable enabled product add-on. For those familiar ...


4

You can set the key to whatever you want in limit_req_zone. limit_req_zone "$binary_remote_addr$request_uri" zone=req_dev:10m rate=2r/s; Note that this requires at least nginx 1.7.6.


4

According to the documentation you can specify in requests per second or requests per minute, not requests per hour, so no it's not possible. The rate is specified in requests per second (r/s). If a rate of less than one request per second is desired, it is specified in request per minute (r/m). For example, half-request per second is 30r/m. I suggest you ...


4

I'm glad that you seem to have solved the immediate problem with fail2ban, and it does make sense to block at the iptables level, but you can do the exact same thing in your HAProxy config: You can use acl's with src_http_req_rate() or even src_http_err_rate(Abuse): I've used them in some examples of haproxy configs for DDOS mitigation here. Longer term: It ...


Only top voted, non community-wiki answers of a minimum length are eligible