# Limit\_req with IP whitelisting

**URL:** <https://www.ruby-forum.com/t/limit-req-with-ip-whitelisting/209141>\
**Category:** NGINX\
**Created:** [July 6, 2011, 6:28pm UTC](https://www.ruby-forum.com/t/limit-req-with-ip-whitelisting/209141 "2011-07-06T18:28:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [July 6, 2011, 6:28pm UTC](https://www.ruby-forum.com/t/limit-req-with-ip-whitelisting/209141/1 "2011-07-06T18:28:43Z")

</div>

Hi folks,

1. 

I want to use limit\_req with whitelisting some subnet, I have seen this  
post: [limit\_req white list](http://forum.nginx.org/read.php?21,200815,200815#msg-200815) and  
done some test but it’s not working.

I have added to server context:

geo $rate {  
default 5; # 5r/s  
10.0.0.0/24 -;  
192.168.0.0/24 -;  
10.1.0.0 -;  
}

limit\_req\_zone $binary\_remote\_addr zone=ratezone:10m rate=$rate;  
limit\_req zone=ratezone burst=10 nodelay;

And I receive as error: nginx: [emerg] invalid rate “rate=$rate”

Any idea how to fix this issue?

1. Is it possible to use limit\_req for a single domaine “$host”?

Thanks in advance.

* * *

Matt

Posted at Nginx Forum:

> **[limit\_req with IP whitelisting](https://forum.nginx.org/read.php?2,211989,211989#msg-211989)**
>
> Hi folks, 1) I want to use limit\_req with whitelisting some subnet, I have seen this post: http://forum.nginx.org/read.php?21,200815,200815#msg-200815 and done some test but it's not working. I have added to server context: geo $rate { defa

---

<div class="post-metadata">

**Author:** ![LeMaitre](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/a183cd/32.png) [@LeMaitre](https://www.ruby-forum.com/u/LeMaitre)\
**Post date:** [July 6, 2011, 7:27pm UTC](https://www.ruby-forum.com/t/limit-req-with-ip-whitelisting/209141/2 "2011-07-06T19:27:24Z")

</div>

Hello!

On Wed, Jul 06, 2011 at 12:27:57PM -0400, LeMaitre wrote:

> Hi folks,
> 
> 1. 
> 
> I want to use limit\_req with whitelisting some subnet, I have seen this  
> post: [http://forum.nginx.org/read.php?21,200815,200815#msg-200815](http://forum.nginx.org/read.php?21,200815,200815#msg-200815) and  
> done some test but it’s not working.

And not expected to: it’s only design idea. It wasn’t (yet?)  
implemented.

> limit\_req zone=ratezone burst=10 nodelay;
> 
> And I receive as error: nginx: [emerg] invalid rate “rate=$rate”
> 
> Any idea how to fix this issue?

Right now you may try something like this:

```
geo $nolimit {
    default 0;
    10.0.0.0/24 1;
    192.168.0.0/24 1;
}

limit_req_zone $binary_remote_addr zone=ratezone:10m rate=5r/s;

server {
    ...

    location / {
        error_page 418 = @nolimit;

        if ($nolimit) {
            return 418;
        }

        limit_req zone=ratezone burst=10 nodelay;

        # ...
    }

    location @nolimit {
        # ... no limit_req here
    }
}

```

This will process requests in “location /” by default with  
limit\_req set, though users with ip addresses you specify will go  
to “location @nolimit” where there are no limit\_req.

> 1. Is it possible to use limit\_req for a single domaine “$host”?

Just define it in an appropriate server{} block.

Maxim D.

---

<div class="post-metadata">

**Author:** ![LeMaitre](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/a183cd/32.png) [@LeMaitre](https://www.ruby-forum.com/u/LeMaitre)\
**Post date:** [July 6, 2011, 8:44pm UTC](https://www.ruby-forum.com/t/limit-req-with-ip-whitelisting/209141/3 "2011-07-06T20:44:37Z")

</div>

Hello Maxim,

I have tried and I got error 403.

http {  
…  
geo $nolimit {  
default 0;  
10.0.0.0/24 1; # my network  
192.168.0/24 1; #my network  
}  
limit\_req\_zone $binary\_remote\_addr zone=ratezone:10m rate=5r/s;  
…

server {  
location / {  
error\_page 418 = @nolimit;  
if ($nolimit) {  
return 418;  
}  
limit\_req zone=ratezone burst=10 nodelay;  
index.html index.php;  
if (!-f $request\_filename) {  
rewrite ^/(.\*)$ /index.php last;  
}  
}

location @nolimit {  
}  
…  
}

Is it right?

My goal is to block/reduce some DDoS without disturbing the internal  
subnet network.

P.S: I’m using geoip to redirect some country to a static file but from  
time to time there’s some botnet on the allowed county.

Thanks in advance

Posted at Nginx Forum:

> **[Re: limit\_req with IP whitelisting](https://forum.nginx.org/read.php?2,211989,211991#msg-211991)**
>
> Hi folks, 1) I want to use limit\_req with whitelisting some subnet, I have seen this post: http://forum.nginx.org/read.php?21,200815,200815#msg-200815 and done some test but it's not working. I have added to server context: geo $rate { defa

---

<div class="post-metadata">

**Author:** ![LeMaitre](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/a183cd/32.png) [@LeMaitre](https://www.ruby-forum.com/u/LeMaitre)\
**Post date:** [July 6, 2011, 9:01pm UTC](https://www.ruby-forum.com/t/limit-req-with-ip-whitelisting/209141/4 "2011-07-06T21:01:58Z")

</div>

On 6 Jul 2011 19h43 WEST, removed\_email\_address@domain.invalid wrote:

It seems that’s got nothing to do with Maxim’s suggestion but with  
your (apparent) lack of configuration for serving PHP files. What type  
of upstream are you using:

1. Apache with mod\_php?

2. php-fpm or php-cgi?

Also your block:

if (!-f $request\_filename) {  
rewrite ^/(.\*)$ /index.php last;  
}

Is a deprecated way of routing the request. Use try\_files. Also since  
you’re not using the captured pattern why the capture?

See: [http://wiki.nginx.org/HttpCoreModule#try\_files](http://wiki.nginx.org/HttpCoreModule#try_files)

— appa

---

<div class="post-metadata">

**Author:** ![LeMaitre](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/a183cd/32.png) [@LeMaitre](https://www.ruby-forum.com/u/LeMaitre)\
**Post date:** [July 7, 2011, 12:40am UTC](https://www.ruby-forum.com/t/limit-req-with-ip-whitelisting/209141/5 "2011-07-07T00:40:11Z")

</div>

Thanks for your help Maxim and António. It works now.

I’ll correct the ifevil tomorrow.

Just another question, can you please tell me which value should I use  
for the rate and burst?

Actually, I use:  
limit\_req\_zone $binary\_remote\_addr zone=ratezone:20m  
rate=30r/s;  
limit\_req zone=ratezone burst=100 nodelay;

There’s almost more then 20k domains behind it and a lot of connections

Thanks

Posted at Nginx Forum:

> **[Re: limit\_req with IP whitelisting](https://forum.nginx.org/read.php?2,211989,211997#msg-211997)**
>
> Hi folks, 1) I want to use limit\_req with whitelisting some subnet, I have seen this post: http://forum.nginx.org/read.php?21,200815,200815#msg-200815 and done some test but it's not working. I have added to server context: geo $rate { defa

---

<div class="post-metadata">

**Author:** ![LeMaitre](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/a183cd/32.png) [@LeMaitre](https://www.ruby-forum.com/u/LeMaitre)\
**Post date:** [July 6, 2011, 9:10pm UTC](https://www.ruby-forum.com/t/limit-req-with-ip-whitelisting/209141/6 "2011-07-06T21:10:00Z")

</div>

Hello!

On Wed, Jul 06, 2011 at 02:43:52PM -0400, LeMaitre wrote:

> }  
> index.html index.php;  
> Just a side note: this doesn’t looks like correct config, probably  
> “index” directive was missed somewhere.

> if (!-f $request\_filename) {  
> rewrite ^/(.\*)$ /index.php last;  
> }  
> }
> 
> location @nolimit {  
> }

You have to replicate your normal config in the “location  
@nolimit”. Most likely you’ve got 403 due to no index defined  
here.

> …  
> }

Note well that if you have other locations, you may want to limit  
them too (in a similar fashion).

Maxim D.