# HttpLimitZoneModule + Varnish (frontend) **URL:** \ **Category:** NGINX\ **Created:** [January 21, 2012, 6:45pm UTC](https://www.ruby-forum.com/t/httplimitzonemodule-varnish-frontend/215987 "2012-01-21T18:45:30Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\ **Post date:** [January 21, 2012, 6:45pm UTC](https://www.ruby-forum.com/t/httplimitzonemodule-varnish-frontend/215987/1 "2012-01-21T18:45:30Z")
Hello, I’m having some troubles with the Module LimitZone. [http://wiki.nginx.org/HttpLimitZoneModule](http://wiki.nginx.org/HttpLimitZoneModule) I want to limit simultaneous connections per client (IP) with “limit\_conn” but it doesn’t work with Varnish-cache which is listening to port 80 and NginX: 8080 To do some tests I put limit\_conn to 1 and I tried to download two files from my server If I write this on my browser adress bar : → [http://mydomain.tld:8080/file\_to\_dl.ext](http://mydomain.tld:8080/file_to_dl.ext) it works of course (I got the error 503) but this : → [http://mydomain.tld/file\_to\_dl.ext](http://mydomain.tld/file_to_dl.ext) doesn’t work: I can download more than 1 file. I’m using php-fpm and $\_SERVER[‘remote\_addr’] give the right Client IP Does anyone have a solution to my problem ? Thanks in advance. Posted at Nginx Forum: > **[HttpLimitZoneModule + Varnish (frontend)](https://forum.nginx.org/read.php?2,221508,221508#msg-221508)** > > Hello, I'm having some troubles with the Module LimitZone. http://wiki.nginx.org/HttpLimitZoneModule I want to limit simultaneous connections per client (IP) with "limit\_conn" but it doesn't work with Varnish-cache which is listening to... ---
**Author:** ![moon35](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f14d63/32.png) [@moon35](https://www.ruby-forum.com/u/moon35)\ **Post date:** [January 22, 2012, 10:44pm UTC](https://www.ruby-forum.com/t/httplimitzonemodule-varnish-frontend/215987/2 "2012-01-22T22:44:25Z")
Hello! On Sat, Jan 21, 2012 at 12:45:02PM -0500, moon35 wrote: > from my server > If I write this on my browser adress bar : > → [http://mydomain.tld:8080/file\_to\_dl.ext](http://mydomain.tld:8080/file_to_dl.ext) > it works of course (I got the error 503) but this : So nginx works as intended. > → [http://mydomain.tld/file\_to\_dl.ext](http://mydomain.tld/file_to_dl.ext) > doesn’t work: I can download more than 1 file. > > I’m using php-fpm and $\_SERVER[‘remote\_addr’] give the right Client IP > > Does anyone have a solution to my problem ? Likely reason is that Varnish either doesn’t pass your second request (or doesn’t pass your requests at all, if it has the file in question cached) or it downloads the file faster that you are able to open second connection. This behaviour is expected for a frontend, but it breaks limiting you are trying to do on a backend (nginx). I doubt you’ll be able solve this. You need frontend to do the limiting, i.e. either use nginx as a frontend, or use similar functionality in Varnish (no idea if one is available). Maxim D. ---
**Author:** ![moon35](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f14d63/32.png) [@moon35](https://www.ruby-forum.com/u/moon35)\ **Post date:** [January 23, 2012, 3:42pm UTC](https://www.ruby-forum.com/t/httplimitzonemodule-varnish-frontend/215987/3 "2012-01-23T15:42:26Z")
Thanks a lot for your reply. Unfortunately, according to what I read (on the internet) there is no way to limit connections per client with varnish so I think I will simply remove it. Thanks again. Posted at Nginx Forum: > **[Re: HttpLimitZoneModule + Varnish (frontend)](https://forum.nginx.org/read.php?2,221508,221541#msg-221541)** > > Hello, I'm having some troubles with the Module LimitZone. http://wiki.nginx.org/HttpLimitZoneModule I want to limit simultaneous connections per client (IP) with "limit\_conn" but it doesn't work with Varnish-cache which is listening to... ---
**Author:** ![moon35](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f14d63/32.png) [@moon35](https://www.ruby-forum.com/u/moon35)\ **Post date:** [January 24, 2012, 8:56am UTC](https://www.ruby-forum.com/t/httplimitzonemodule-varnish-frontend/215987/4 "2012-01-24T08:56:30Z")
On Sun, Jan 22, 2012 at 4:43 PM, Maxim D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > “limit\_conn” but it doesn’t work with Varnish-cache which is listening > > → [http://mydomain.tld/file\_to\_dl.ext](http://mydomain.tld/file_to_dl.ext) > > frontend, but it breaks limiting you are trying to do on a backend > > (nginx). > > I doubt you’ll be able solve this. You need frontend to do the > limiting, i.e. either use nginx as a frontend, or use similar > functionality in Varnish (no idea if one is available). For this kind of perimeter rate limiting technique, you would increment a header value in varnish. Set a custom header in vcl\_recv, qualified or limited by the specific directory or valuable asset, for the external IP to value 1 for the first request, which is allowed, and add a test to see if that flag has been set; add vcl\_error logic to redirect with message, or send 403, if there are subsequent requests, i.e. if the custom header \> 1, or 100, or whatever you set as a limit threshold. Stefan C. > **[ScaleEngine is the Technical Video Streaming CDN Delivering Perfect Streams...](https://www.scaleengine.com/contact)** > > Video CDN, streaming live and on demand securely and reliably. Perfect streams to the world with our developer API, exact usage billing, and direct support ---
**Author:** ![moon35](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f14d63/32.png) [@moon35](https://www.ruby-forum.com/u/moon35)\ **Post date:** [March 25, 2012, 6:55pm UTC](https://www.ruby-forum.com/t/httplimitzonemodule-varnish-frontend/215987/5 "2012-03-25T18:55:43Z")
Extended description of HttpLimitZoneModule and HttpLimitReqModule usage with examples and how to exclude a whitelist of IPs can be found here > **[Limit requests per IP on Nginx using HttpLimitZoneModule and...](https://gadelkareem.com/2012/03/25/limit-requests-per-ip-on-nginx-using-httplimitzonemodule-and-httplimitreqmodule-except-whitelist/)** > > – Make sure to check Nginx, PHP posts for information on Nginx and PHP setup and configuration. Nginx offers two modules, HttpLimitReqModule and HttpLimitZoneModule, to limit simultaneous connections for the... Posted at Nginx Forum: > **[Re: HttpLimitZoneModule + Varnish (frontend)](https://forum.nginx.org/read.php?2,221508,224347#msg-224347)** > > Hello, I'm having some troubles with the Module LimitZone. http://wiki.nginx.org/HttpLimitZoneModule I want to limit simultaneous connections per client (IP) with "limit\_conn" but it doesn't work with Varnish-cache which is listening to...