# Limit\_req seems to have no effect, but I would prefer it did **URL:** \ **Category:** NGINX\ **Created:** [October 9, 2012, 11:20am UTC](https://www.ruby-forum.com/t/limit-req-seems-to-have-no-effect-but-i-would-prefer-it-did/223551 "2012-10-09T11:20:33Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\ **Post date:** [October 9, 2012, 11:20am UTC](https://www.ruby-forum.com/t/limit-req-seems-to-have-no-effect-but-i-would-prefer-it-did/223551/1 "2012-10-09T11:20:33Z")
I’m attempting to rate limit requests, and I’m unable to make the limit\_req directive have any effect. I’ve trimmed it down to a minimal test case. Here’s my complete nginx.conf (with only the server\_name changed to protect the innocent): * * * worker\_processes 2; events { worker\_connections 8192; } http { #keepalive\_timeout 0s; #keepalive\_requests 0; #limit\_conn\_zone $binary\_remote\_addr zone=conn\_res:10m; #limit\_conn conn\_res 1; limit\_req\_zone $binary\_remote\_addr zone=req\_res:10m rate=1r/s; limit\_req zone=req\_res; ## server { listen 80; server\_name [example.com](http://example.com) \*.example.com; location / { return 410; } } } I’ve tried various combinations of burst=2, nodelay, 1r/s or 1r/m, with and without limit\_conn, with and without keepalive, with and without “location /”, etc… and requests are never being limited, as shown by the access.log entries below: * * * while true; do curl 55.55.55.55 -H’Host: [test.example.com](http://test.example.com)’ done ## 12.34.56.78 - - [09/Oct/2012:08:47:03 +0000] “GET / HTTP/1.1” 410 158 “-” “curl/7.21.1 (i686-pc-mingw32) libcurl/7.21.1 OpenSSL/0.9.8r zlib/1.2.3” 12.34.56.78 - - [09/Oct/2012:08:47:03 +0000] “GET / HTTP/1.1” 410 158 “-” “curl/7.21.1 (i686-pc-mingw32) libcurl/7.21.1 OpenSSL/0.9.8r zlib/1.2.3” 12.34.56.78 - - [09/Oct/2012:08:47:03 +0000] “GET / HTTP/1.1” 410 158 “-” “curl/7.21.1 (i686-pc-mingw32) libcurl/7.21.1 OpenSSL/0.9.8r zlib/1.2.3” 12.34.56.78 - - [09/Oct/2012:08:47:04 +0000] “GET / HTTP/1.1” 410 158 “-” “curl/7.21.1 (i686-pc-mingw32) libcurl/7.21.1 OpenSSL/0.9.8r zlib/1.2.3” etc… The error.log file is empty. I’m running nginx 1.3.7, compiled from source, on an Amazon EC2 micro instance with the default image. (For kicks, I also tried 1.0.15, with no luck.) Here is /proc/version: Linux version 3.2.21-1.32.6.amzn1.x86\_64 (mockbuild@gobi-build-31004) (gcc version 4.4.6 20110731 (Red Hat 4.4.6-3) (GCC) ) #1 SMP Sat Jun 23 02:32:15 UTC 2012 Am I missing something obvious here? Posted at Nginx Forum: > **[limit\_req seems to have no effect, but I would prefer it did](https://forum.nginx.org/read.php?2,231530,231530#msg-231530)** > > I'm attempting to rate limit requests, and I'm unable to make the limit\_req directive have any effect. I've trimmed it down to a minimal test case. Here's my complete nginx.conf (with only the server\_name changed to protect the innocent):... ---
**Author:** ![zildjohn01](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/ce7236/32.png) [@zildjohn01](https://www.ruby-forum.com/u/zildjohn01)\ **Post date:** [October 9, 2012, 12:15pm UTC](https://www.ruby-forum.com/t/limit-req-seems-to-have-no-effect-but-i-would-prefer-it-did/223551/2 "2012-10-09T12:15:28Z")
On Tuesday 09 October 2012 13:20:00 zildjohn01 wrote: > I’m attempting to rate limit requests, and I’m unable to make the limit\_req > directive have any effect. I’ve trimmed it down to a minimal test case. > Here’s my complete nginx.conf (with only the server\_name changed to protect > the innocent): […] > limit\_req\_zone $binary\_remote\_addr zone=req\_res:10m rate=1r/s; > limit\_req zone=req\_res; > > server { > listen 80; > server\_name [example.com](http://example.com) \*.example.com; > location / { > return 410; > } > } > […] > > Am I missing something obvious here? “return” is a directive from the rewrite module which works on the rewrite phase. “limit\_req” works on the preaccess phase that comes later. So, your request doesn’t reach the limit\_req module. wbr, Valentin V. Bartenev – > **[Technical Support for NGINX and NGINX Plus Software](https://www.nginx.com/support/)** > > Get the help you need with support directly from the authors and maintainers of NGINX Open Source and NGINX Plus. ---
**Author:** ![zildjohn01](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/ce7236/32.png) [@zildjohn01](https://www.ruby-forum.com/u/zildjohn01)\ **Post date:** [October 11, 2012, 11:32am UTC](https://www.ruby-forum.com/t/limit-req-seems-to-have-no-effect-but-i-would-prefer-it-did/223551/3 "2012-10-11T11:32:31Z")
On Thursday 11 October 2012 05:17:19 zildjohn01 wrote: > That definitely explains the behavior I was seeing. But to me, any way to > bypass the rate limiter seems like a security hole. Just “return 410;” is the much cheaper than the whole request limitation thing. And it’s a good reason to save the resources and don’t do limitation at all in this case. The limit modules should be used to limit access to any resource consumption tasks, not trivial. Limiting for “return 410;” seems pointless to me. > Is there any way to change the phase/order of these two directives, No, there is no way. > or to otherwise cause rewritten requests to be rate limited? You can try some workaround like this: location / { try\_files /410 @410; } location @410 { return 410; } wbr, Valentin V. Bartenev – > **[Technical Support for NGINX and NGINX Plus Software](https://www.nginx.com/support/)** > > Get the help you need with support directly from the authors and maintainers of NGINX Open Source and NGINX Plus. ---
**Author:** ![zildjohn01](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/ce7236/32.png) [@zildjohn01](https://www.ruby-forum.com/u/zildjohn01)\ **Post date:** [October 11, 2012, 3:17am UTC](https://www.ruby-forum.com/t/limit-req-seems-to-have-no-effect-but-i-would-prefer-it-did/223551/4 "2012-10-11T03:17:36Z")
That definitely explains the behavior I was seeing. But to me, any way to bypass the rate limiter seems like a security hole. Is there any way to change the phase/order of these two directives, or to otherwise cause rewritten requests to be rate limited? Posted at Nginx Forum: > **[Re: limit\_req seems to have no effect, but I would prefer it did](https://forum.nginx.org/read.php?2,231530,231611#msg-231611)** > > I'm attempting to rate limit requests, and I'm unable to make the limit\_req directive have any effect. I've trimmed it down to a minimal test case. Here's my complete nginx.conf (with only the server\_name changed to protect the innocent):...