# Block dos attack nginx behind cloudflare and loadbalancer

**URL:** <https://www.ruby-forum.com/t/block-dos-attack-nginx-behind-cloudflare-and-loadbalancer/218322>\
**Category:** NGINX\
**Created:** [March 28, 2012, 9:35am UTC](https://www.ruby-forum.com/t/block-dos-attack-nginx-behind-cloudflare-and-loadbalancer/218322 "2012-03-28T09:35:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [March 28, 2012, 9:35am UTC](https://www.ruby-forum.com/t/block-dos-attack-nginx-behind-cloudflare-and-loadbalancer/218322/1 "2012-03-28T09:35:01Z")

</div>

i have 4 webserver behind cloudflare and a loadbalancer, nginx is the  
web browser, php-fpm manage the php pages. i don’t know how to block a  
simple dos attack …

i’m able to detect this attack by use the http\_limit\_req module from  
nginx [Module ngx\_http\_limit\_req\_module](http://wiki.nginx.org/HttpLimitReqModule)

but this is not block the attack at all, yes can mitigate but webservers  
are hit and hit again, and php-fpm goes to 80% and in a minute the  
website is unreachable.

i’m trying to find a way to block this kind of request.

i know how to block certain ip address or certain useragent with nginx  
but i want to do it automatically. I think that i cannot block the ip  
with iptables because the request come from the loadbalancer ☹ but i’m  
still able to detect the correct ip address with the set\_real\_ip\_from  
and real\_ip\_header X-Forwarded-For with nginx.

i have the log file (error.log) filled with the correct ip address as  
you can see:

2012/03/27 18:34:02 [error] 31234#0: \*1283 limiting connections by zone  
“staging”, client: XX.XX.XX.XXX, server: [www.xxxxxxx.com](http://www.xxxxxxx.com), request: “HEAD  
/it HTTP/1.1”, host: “[www.xxxxxxx.com](http://www.xxxxxxx.com)”

Someone have an idea and can teach me how to block automatically this  
ip?

thanks in advance!

Posted at Nginx Forum:

> **[block dos attack nginx behind cloudflare and loadbalancer](https://forum.nginx.org/read.php?2,224517,224517#msg-224517)**
>
> i have 4 webserver behind cloudflare and a loadbalancer, nginx is the web browser, php-fpm manage the php pages. i don't know how to block a simple dos attack ... i'm able to detect this attack by use the http\_limit\_req module from nginx...

---

<div class="post-metadata">

**Author:** ![ilmetu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/bbce88/32.png) [@ilmetu](https://www.ruby-forum.com/u/ilmetu)\
**Post date:** [March 28, 2012, 10:53am UTC](https://www.ruby-forum.com/t/block-dos-attack-nginx-behind-cloudflare-and-loadbalancer/218322/2 "2012-03-28T10:53:43Z")

</div>

Hi,

On Mar 28, 2012, at 11:34 AM, ilmetu wrote:

> 2012/03/27 18:34:02 [error] 31234#0: \*1283 limiting connections by zone  
> “staging”, client: XX.XX.XX.XXX, server: [www.xxxxxxx.com](http://www.xxxxxxx.com), request: “HEAD  
> /it HTTP/1.1”, host: “[www.xxxxxxx.com](http://www.xxxxxxx.com)”
> 
> Someone have an idea and can teach me how to block automatically this  
> ip?

Can you show your limit\_conn/limit\_req configuration?

> **[Module ngx\_http\_limit\_conn\_module](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html)**

> **[Module ngx\_http\_limit\_req\_module](http://nginx.org/en/docs/http/ngx_http_limit_req_module.html)**

---

<div class="post-metadata">

**Author:** ![ilmetu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/bbce88/32.png) [@ilmetu](https://www.ruby-forum.com/u/ilmetu)\
**Post date:** [March 28, 2012, 11:16am UTC](https://www.ruby-forum.com/t/block-dos-attack-nginx-behind-cloudflare-and-loadbalancer/218322/3 "2012-03-28T11:16:03Z")

</div>

hi, this is my configuration :

```
# Create a global request accounting pool to prevent DOS
 limit_zone staging $binary_remote_addr 5m;
 limit_conn staging 5;

```

Posted at Nginx Forum:

> **[Re: block dos attack nginx behind cloudflare and loadbalancer](https://forum.nginx.org/read.php?2,224517,224526#msg-224526)**
>
> i have 4 webserver behind cloudflare and a loadbalancer, nginx is the web browser, php-fpm manage the php pages. i don't know how to block a simple dos attack ... i'm able to detect this attack by use the http\_limit\_req module from nginx...

---

<div class="post-metadata">

**Author:** ![ilmetu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/bbce88/32.png) [@ilmetu](https://www.ruby-forum.com/u/ilmetu)\
**Post date:** [March 28, 2012, 11:43am UTC](https://www.ruby-forum.com/t/block-dos-attack-nginx-behind-cloudflare-and-loadbalancer/218322/4 "2012-03-28T11:43:22Z")

</div>

Hello!

On Mar 28, 2012, at 13:15 , ilmetu wrote:

> hi, this is my configuration :
> 
> # Create a global request accounting pool to prevent DOS
> 
> ```
> limit_zone staging $binary_remote_addr 5m;
> limit_conn staging 5;
> 
> ```

You’re trying to limit a number of connections using limit\_conn module.  
The thing is that a lot of requests may proceed through a single  
connection.

If you want to set a maximum allowed requests rate, you should use  
limit\_req module instead:

> **[Module ngx\_http\_limit\_req\_module](http://nginx.org/en/docs/http/ngx_http_limit_req_module.html)**

Best regards,  
Andrey.