# Limit\_req and IP white listing on 0.8.55

**URL:** <https://www.ruby-forum.com/t/limit-req-and-ip-white-listing-on-0-8-55/228629>\
**Category:** NGINX\
**Created:** [May 1, 2013, 1:25am UTC](https://www.ruby-forum.com/t/limit-req-and-ip-white-listing-on-0-8-55/228629 "2013-05-01T01:25:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nauger](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/ce73a5/32.png) [@nauger](https://www.ruby-forum.com/u/nauger)\
**Post date:** [May 1, 2013, 1:25am UTC](https://www.ruby-forum.com/t/limit-req-and-ip-white-listing-on-0-8-55/228629/1 "2013-05-01T01:25:55Z")

</div>

Hello!

I’ve followed this reference:

> **[Re: Whitelisting IP addresses for ratelimiting](https://forum.nginx.org/read.php?2,228956,228961#msg-228961)**
>
> I have my configuration set up based on the information at http://gadelkareem.com/2012/03/25/limit-requests-per-ip-on-nginx-using-httplimitzonemodule-and-httplimitreqmodule-except-whitelist/ as follows: http { .... geo $unlimited { default 1;

To produce the following config:  
http {  
geo $public\_vs\_our\_networks {  
default 1;  
127.0.0.1/32 0;  
… my networks …  
}  
map $public\_vs\_our\_networks $limit\_public {  
1 $binary\_remote\_addr;  
0 “”;  
}  
limit\_req\_zone $limit\_public zone=public\_facing\_network:10m  
rate=40r/m;  
…  
server {  
…  
location / {  
…  
limit\_req zone=public\_facing\_network burst=5  
nodelay;  
…  
proxy\_pass http://my\_upstream;  
}  
}  
}

Unfortunately-- my error logs quickly filled up with clients who were  
incorrectly rate limited. It was as if this configuration created 1  
bucket  
for ALL the public facing clients, as opposed to individually bucketing  
each  
public client by their $binary\_remote\_addr. Please advise on what I  
might  
be missing.

Thanks for your help!

-Nick

Posted at Nginx Forum:

> **[limit\_req and IP white listing on 0.8.55](https://forum.nginx.org/read.php?2,238757,238757#msg-238757)**
>
> Hello! I've followed this reference: http://forum.nginx.org/read.php?2,228956,228961#msg-228961 To produce the following config: http { geo $public\_vs\_our\_networks { default 1;

---

<div class="post-metadata">

**Author:** ![nauger](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/ce73a5/32.png) [@nauger](https://www.ruby-forum.com/u/nauger)\
**Post date:** [May 1, 2013, 2:12am UTC](https://www.ruby-forum.com/t/limit-req-and-ip-white-listing-on-0-8-55/228629/2 "2013-05-01T02:12:40Z")

</div>

Hello!

On Tue, Apr 30, 2013 at 07:25:22PM -0400, nauger wrote:

> ```
> 127.0.0.1/32 0;
> ...
> 
> ```
> 
> Unfortunately-- my error logs quickly filled up with clients who were  
> incorrectly rate limited. It was as if this configuration created 1 bucket  
> for ALL the public facing clients, as opposed to individually bucketing each  
> public client by their $binary\_remote\_addr. Please advise on what I might  
> be missing.

Variables can be used as a result of a map only in nginx 0.9.0+,  
see [Module ngx\_http\_map\_module](http://nginx.org/r/map). You have to upgrade for the above to  
work.

–  
Maxim D.

> **[nginx: donation](http://nginx.org/en/donation.html)**

---

<div class="post-metadata">

**Author:** ![nauger](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/ce73a5/32.png) [@nauger](https://www.ruby-forum.com/u/nauger)\
**Post date:** [May 1, 2013, 6:04am UTC](https://www.ruby-forum.com/t/limit-req-and-ip-white-listing-on-0-8-55/228629/3 "2013-05-01T06:04:32Z")

</div>

Hi Maxim,

Thank you-- that makes sense. Before upgrading, is it possible to  
implement  
this white list behavior using a different mechanism?

Thanks again,

-Nick

Posted at Nginx Forum:

> **[Re: limit\_req and IP white listing on 0.8.55](https://forum.nginx.org/read.php?2,238757,238760#msg-238760)**
>
> Hello! I've followed this reference: http://forum.nginx.org/read.php?2,228956,228961#msg-228961 To produce the following config: http { geo $public\_vs\_our\_networks { default 1;

---

<div class="post-metadata">

**Author:** ![nauger](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/ce73a5/32.png) [@nauger](https://www.ruby-forum.com/u/nauger)\
**Post date:** [May 1, 2013, 7:31pm UTC](https://www.ruby-forum.com/t/limit-req-and-ip-white-listing-on-0-8-55/228629/4 "2013-05-01T19:31:57Z")

</div>

Hello!

On Wed, May 01, 2013 at 12:04:12AM -0400, nauger wrote:

> Hi Maxim,
> 
> Thank you-- that makes sense. Before upgrading, is it possible to implement  
> this white list behavior using a different mechanism?

You may try to use if + set at server level instead of map.

–  
Maxim D.

> **[nginx: donation](http://nginx.org/en/donation.html)**