# Any way to deal with clients breaking the limit zone

**URL:** <https://www.ruby-forum.com/t/any-way-to-deal-with-clients-breaking-the-limit-zone/207738>\
**Category:** NGINX\
**Created:** [June 1, 2011, 4:52pm UTC](https://www.ruby-forum.com/t/any-way-to-deal-with-clients-breaking-the-limit-zone/207738 "2011-06-01T16:52:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [June 1, 2011, 4:52pm UTC](https://www.ruby-forum.com/t/any-way-to-deal-with-clients-breaking-the-limit-zone/207738/1 "2011-06-01T16:52:18Z")

</div>

Just in case it is relevant I’ll explain the setup. It is vbulletin site  
with apache serving php and nginx static content.  
I have this in nginx.conf  
limit\_zone one $binary\_remote\_addr 10m;  
and this in vhost config of the site in question:  
limit\_conn one 35;

I hope that is reasonable setting.  
Haven’t noticed any issues with regular traffic. But occasionally we get  
some ips breaking the zone limit, I am pretty sure it is not a regular  
visitor. And it was generating hundreds of lines in vhost-error\_log:  
limiting connections by zone “one”, client: xx.xx…

So my question is if there is perhaps a way to stop that client after he  
repeats the limit breaking constantly for like 5 minutes, or X times or  
something like that.  
Or at least to stop it generating the logs.  
I ended up blocking that ip with firewall today, but I won’t be there  
all the time to see it and it is gonna create a lot of junk lines in the  
log. It is not that big of an issue but I just thought it is worth a  
shot to see if there is a way around it.

Posted at Nginx Forum:

> **[Any way to deal with clients breaking the limit zone](https://forum.nginx.org/read.php?2,203013,203013#msg-203013)**
>
> Just in case it is relevant I'll explain the setup. It is vbulletin site with apache serving php and nginx static content. I have this in nginx.conf limit\_zone one $binary\_remote\_addr 10m; and this in vhost config of the site in question: limit\_conn...

---

<div class="post-metadata">

**Author:** ![karabaja](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/7ea924/32.png) [@karabaja](https://www.ruby-forum.com/u/karabaja)\
**Post date:** [June 2, 2011, 11:36am UTC](https://www.ruby-forum.com/t/any-way-to-deal-with-clients-breaking-the-limit-zone/207738/2 "2011-06-02T11:36:48Z")

</div>

Hello!

On Wed, Jun 01, 2011 at 10:52:03AM -0400, karabaja wrote:

> visitor. And it was generating hundreds of lines in vhost-error\_log:  
> limiting connections by zone “one”, client: xx.xx…
> 
> So my question is if there is perhaps a way to stop that client after he  
> repeats the limit breaking constantly for like 5 minutes, or X times or  
> something like that.  
> Or at least to stop it generating the logs.  
> I ended up blocking that ip with firewall today, but I won’t be there  
> all the time to see it and it is gonna create a lot of junk lines in the  
> log. It is not that big of an issue but I just thought it is worth a  
> shot to see if there is a way around it.

Usual aproach is to read logs with some script (fail2ban or  
something) and block offenders on firewall by the script.

Maxim D.

---

<div class="post-metadata">

**Author:** ![karabaja](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/7ea924/32.png) [@karabaja](https://www.ruby-forum.com/u/karabaja)\
**Post date:** [January 11, 2012, 10:31pm UTC](https://www.ruby-forum.com/t/any-way-to-deal-with-clients-breaking-the-limit-zone/207738/3 "2012-01-11T22:31:59Z")

</div>

Hello Maxim,

Sorry about highjacking this thread, but I think my question is  
relevant. In the nginx configuration I have:

```
    # limit simultaneous connections
    limit_conn_zone $binary_remote_addr zone=addr:1m;
    limit_conn addr 16;

```

But the error\_log file says:

2012/01/11 21:41:39 [warn] 10140#0: \*2959 limiting connections by zone  
“addr”, client: 127.0.0.1, server: , request: “GET / HTTP/1.0”, host:  
“[mysite.com](http://mysite.com)”, referrer: “[GitHub - shekyan/slowhttptest: Application Layer DoS attack simulator](http://code.google.com/p/slowhttptest/)”  
2012/01/11 21:41:40 [warn] 10140#0: \*2962 limiting connections by zone  
“addr”, client: 127.0.0.1, server: , request: “GET / HTTP/1.0”, host:  
“[mysite.com](http://mysite.com)”, referrer: “[GitHub - shekyan/slowhttptest: Application Layer DoS attack simulator](http://code.google.com/p/slowhttptest/)”

Question is, why 127.0.0.1 for the remote client address? It should  
have nothing to do with loopback host address. It must be external  
IP.

Any workaround? Also, I noticed that “server:” is empty. Any other  
reason for that? I have a dozen of virtual hosts configured with  
fastcgi\_pass to php-fpm.

Many thanks for your assistance.

nginx/1.1.12

Andrejs

Posted at Nginx Forum:

> **[Re: Any way to deal with clients breaking the limit zone](https://forum.nginx.org/read.php?2,203013,221055#msg-221055)**
>
> Just in case it is relevant I'll explain the setup. It is vbulletin site with apache serving php and nginx static content. I have this in nginx.conf limit\_zone one $binary\_remote\_addr 10m; and this in vhost config of the site in question: limit\_conn...

---

<div class="post-metadata">

**Author:** ![karabaja](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/7ea924/32.png) [@karabaja](https://www.ruby-forum.com/u/karabaja)\
**Post date:** [January 12, 2012, 5:11pm UTC](https://www.ruby-forum.com/t/any-way-to-deal-with-clients-breaking-the-limit-zone/207738/4 "2012-01-12T17:11:59Z")

</div>

Hello!

On Wed, Jan 11, 2012 at 04:31:45PM -0500, locojohn wrote:

> 2012/01/11 21:41:39 [warn] 10140#0: \*2959 limiting connections by zone  
> “addr”, client: 127.0.0.1, server: , request: “GET / HTTP/1.0”, host:  
> “[mysite.com](http://mysite.com)”, referrer: “[GitHub - shekyan/slowhttptest: Application Layer DoS attack simulator · GitHub](http://code.google.com/p/slowhttptest/)”  
> 2012/01/11 21:41:40 [warn] 10140#0: \*2962 limiting connections by zone  
> “addr”, client: 127.0.0.1, server: , request: “GET / HTTP/1.0”, host:  
> “[mysite.com](http://mysite.com)”, referrer: “[GitHub - shekyan/slowhttptest: Application Layer DoS attack simulator · GitHub](http://code.google.com/p/slowhttptest/)”
> 
> Question is, why 127.0.0.1 for the remote client address? It should  
> have nothing to do with loopback host address. It must be external  
> IP.

Obvious reason is: because connection was got from 127.0.0.1.

> Any workaround? Also, I noticed that “server:” is empty. Any other  
> reason for that? I have a dozen of virtual hosts configured with  
> fastcgi\_pass to php-fpm.

Obvious reason is: the request was matched by a server{} block  
without server\_name set. See here:

> **[How nginx processes a request](http://nginx.org/en/docs/http/request_processing.html)**

for more details on how nginx matches requests to servers.

Maxim D.

---

<div class="post-metadata">

**Author:** ![karabaja](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/7ea924/32.png) [@karabaja](https://www.ruby-forum.com/u/karabaja)\
**Post date:** [January 13, 2012, 7:58am UTC](https://www.ruby-forum.com/t/any-way-to-deal-with-clients-breaking-the-limit-zone/207738/5 "2012-01-13T07:58:22Z")

</div>

Note: Unfortunately, I cannot edit my messages here. In both error log  
entries, Host: is the same: “testsite”.

Andrejs

Posted at Nginx Forum:

> **[Re: Any way to deal with clients breaking the limit zone](https://forum.nginx.org/read.php?2,203013,221144#msg-221144)**
>
> Just in case it is relevant I'll explain the setup. It is vbulletin site with apache serving php and nginx static content. I have this in nginx.conf limit\_zone one $binary\_remote\_addr 10m; and this in vhost config of the site in question: limit\_conn...

---

<div class="post-metadata">

**Author:** ![karabaja](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/7ea924/32.png) [@karabaja](https://www.ruby-forum.com/u/karabaja)\
**Post date:** [January 13, 2012, 11:37am UTC](https://www.ruby-forum.com/t/any-way-to-deal-with-clients-breaking-the-limit-zone/207738/6 "2012-01-13T11:37:24Z")

</div>

Hello!

On Fri, Jan 13, 2012 at 01:55:38AM -0500, locojohn wrote:

> ```
> server {
> 
> ```
> 
> the slowhttptest program is clearly “testsite” with its own error\_log,  
> HTTP/1.1", host: “[devel.ahlerstoday.com](http://devel.ahlerstoday.com)”, referrer:  
> “[GitHub - shekyan/slowhttptest: Application Layer DoS attack simulator · GitHub](http://code.google.com/p/slowhttptest/)”  
> 2012/01/12 18:10:35 [error] 10508#0: \*15989 limiting connections by zone  
> “addr”, client: 217.24.78.177, server: testsite, request: “GET /  
> HTTP/1.1”, host: “[devel.ahlerstoday.com](http://devel.ahlerstoday.com)”, referrer:  
> “[GitHub - shekyan/slowhttptest: Application Layer DoS attack simulator · GitHub](http://code.google.com/p/slowhttptest/)”

Note HTTP/1.1. It’s likely to be original request.

> /var/log/nginx/error\_log:
> 
> 2012/01/12 18:10:34 [error] 10509#0: \*12134 limiting connections by zone  
> “addr”, client: 127.0.0.1, server: , request: “GET / HTTP/1.0”, host:  
> “testsite”, referrer: “[GitHub - shekyan/slowhttptest: Application Layer DoS attack simulator · GitHub](http://code.google.com/p/slowhttptest/)”  
> 2012/01/12 18:10:35 [error] 10509#0: \*12136 limiting connections by zone  
> “addr”, client: 127.0.0.1, server: , request: “GET / HTTP/1.0”, host:  
> “testsite”, referrer: “[GitHub - shekyan/slowhttptest: Application Layer DoS attack simulator · GitHub](http://code.google.com/p/slowhttptest/)”

Note HTTP/1.0 here. It looks like requests here appear after  
proxy\_pass to 127.0.0.1 in your original “testsite” server.

The fact the request isn’t matched to the same testsite server  
suggests that things happen on different socket, i.e. you use  
listen directive in the server block in question (the one without  
server\_name) either on different port or explicitly on 127.0.0.1.

> Could it have anything to do with the fact that limit\_zone and  
> limit\_conn are defined on http level? Yet, I think the behaviour is  
> not fully correct.

Behaviour seems correct for me.

Maxim D.

---

<div class="post-metadata">

**Author:** ![karabaja](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/7ea924/32.png) [@karabaja](https://www.ruby-forum.com/u/karabaja)\
**Post date:** [January 13, 2012, 7:55am UTC](https://www.ruby-forum.com/t/any-way-to-deal-with-clients-breaking-the-limit-zone/207738/7 "2012-01-13T07:55:52Z")

</div>

Hello Maxim,

I am surely aware of how server requests are matched in nginx. Thanks  
for the info though.

The thing is, I have multiple virtual hosts configured all with  
server\_name defined, of course. Then there’s default fallback server  
configured as this:

# default fallback server

```
    server {
            listen 80 default_server;
            server_name _;
            return 444;
    }

```

After reading your reply I went to check my error logs and the strange  
thing is that error messages go both into one of my virtual host  
server’s error log with correct data (remote address, server name,  
etc.), but also go to nginx default (?) error\_log with entries that I  
reported? How come, if the virtual host server being accessed using  
the slowhttptest program is clearly “testsite” with its own error\_log,  
yet the connection limit error message is reported in two error logs?

slowhttptest -c 1000 -r 1000 -X -u [http://testsite](http://testsite)

results:

/var/log/nginx/testsite/error\_log:

2012/01/12 18:10:34 [error] 10508#0: \*15985 limiting connections by zone  
“addr”, client: 217.24.78.177, server: testsite, request: “GET /  
HTTP/1.1”, host: “[devel.ahlerstoday.com](http://devel.ahlerstoday.com)”, referrer:  
“[GitHub - shekyan/slowhttptest: Application Layer DoS attack simulator · GitHub](http://code.google.com/p/slowhttptest/)”  
2012/01/12 18:10:35 [error] 10508#0: \*15989 limiting connections by zone  
“addr”, client: 217.24.78.177, server: testsite, request: “GET /  
HTTP/1.1”, host: “[devel.ahlerstoday.com](http://devel.ahlerstoday.com)”, referrer:  
“[GitHub - shekyan/slowhttptest: Application Layer DoS attack simulator · GitHub](http://code.google.com/p/slowhttptest/)”

/var/log/nginx/error\_log:

2012/01/12 18:10:34 [error] 10509#0: \*12134 limiting connections by zone  
“addr”, client: 127.0.0.1, server: , request: “GET / HTTP/1.0”, host:  
“testsite”, referrer: “[GitHub - shekyan/slowhttptest: Application Layer DoS attack simulator · GitHub](http://code.google.com/p/slowhttptest/)”  
2012/01/12 18:10:35 [error] 10509#0: \*12136 limiting connections by zone  
“addr”, client: 127.0.0.1, server: , request: “GET / HTTP/1.0”, host:  
“testsite”, referrer: “[GitHub - shekyan/slowhttptest: Application Layer DoS attack simulator · GitHub](http://code.google.com/p/slowhttptest/)”

Could it have anything to do with the fact that limit\_zone and  
limit\_conn are defined on http level? Yet, I think the behaviour is  
not fully correct.

I would appreciate your feedback,

Andrejs

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,203013,221143#msg-221143](http://forum.nginx.org/read.php?2,203013,221143#msg-221143)