# HttpLimitReqModule: Support for IPSet

**URL:** <https://www.ruby-forum.com/t/httplimitreqmodule-support-for-ipset/209253>\
**Category:** NGINX\
**Created:** [July 9, 2011, 12:14pm UTC](https://www.ruby-forum.com/t/httplimitreqmodule-support-for-ipset/209253 "2011-07-09T12:14:18Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [July 9, 2011, 12:14pm UTC](https://www.ruby-forum.com/t/httplimitreqmodule-support-for-ipset/209253/1 "2011-07-09T12:14:18Z")

</div>

I have a proposal for the HttpLimitReqModule: If an IP address exceeds  
a certain rate then nginx automatically adds it to an ip-set (i.e.  
execute “ipset add …”).

You can then configure iptables to automatically ban all IP addresses  
that are in this ip-set. IMO this rate should be different from  
(higher than) the one already used by the HttpLimitReqModule to delay  
requests.

The advantage compared to automatically adding an ip address to such a  
set with only iptables is the following: nginx can differentiate  
between static and dynamic (i.e. PHP) requests. Usually I do not care  
about static requests at all, but many requests to certain dynamic  
scripts can cause a very high load.

IPSet has been integrated into Linux 2.9.39 and is available for older  
Linux versions as a patch. You can read more about IPSet here:  
hhttp://ipset.netfilter.org/

Kind regards  
Steffen W.