# Protection against massiv requests from single server / ip **URL:** \ **Category:** NGINX\ **Created:** [January 31, 2010, 8:36am UTC](https://www.ruby-forum.com/t/protection-against-massiv-requests-from-single-server-ip/182622 "2010-01-31T08:36:57Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [January 31, 2010, 8:36am UTC](https://www.ruby-forum.com/t/protection-against-massiv-requests-from-single-server-ip/182622/1 "2010-01-31T08:36:57Z")
Hello Nginx community, what is the best way protecting my nginx webserver against massiv request from single server/ips? I made some tests with openload and see one server with openload can fill the whole 100Mbit connection to my server. What are your setups against a lot of request from single servers? Thanks for your help. ## Kind regrads. Jetzt kostenlos herunterladen: Internet Explorer 8 und Mozilla Firefox 3.5 - sicherer, schneller und einfacher! [Aktuelle Nachrichten aus Politik, Wirtschaft & Panorama | GMX](http://portal.gmx.net/de/go/atbrowser) – Jetzt kostenlos herunterladen: Internet Explorer 8 und Mozilla Firefox 3.5 - sicherer, schneller und einfacher! [Aktuelle Nachrichten aus Politik, Wirtschaft & Panorama | GMX](http://portal.gmx.net/de/go/atbrowser) ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [January 31, 2010, 8:46am UTC](https://www.ruby-forum.com/t/protection-against-massiv-requests-from-single-server-ip/182622/2 "2010-01-31T08:46:54Z")
On 1/31/10 2:36 AM, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Hello Nginx community, > > what is the best way protecting my nginx webserver against massiv request from single server/ips? I made some tests with openload and see one server with openload can fill the whole 100Mbit connection to my server. > **[GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki...](https://github.com/nginxinc/nginx-wiki)** > > ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com > **[GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki...](https://github.com/nginxinc/nginx-wiki)** > > ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com These should do the trick for you. – Jim O. ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [January 31, 2010, 1:37pm UTC](https://www.ruby-forum.com/t/protection-against-massiv-requests-from-single-server-ip/182622/3 "2010-01-31T13:37:09Z")
2010/1/31 [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid): > What are your setups against a lot of request from single servers? For larger installations firewalls or properly configured routers before any servers. For tiny, home and experimental setups iptables [1] with rules such as: -A INPUT -s 300.300.300.0/24 -j ACCEPT -A INPUT -m recent --rcheck --seconds 120 --name ATTACKER --rsource -j DROP -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j syn-flood -A syn-flood -m limit --limit 14/sec --limit-burst 30 -j RETURN -A syn-flood -j LOG --log-prefix "Firewall: SYN-flood " -A syn-flood -m recent --set --name ATTACKER --rsource -A syn-flood -j DROP … where lots of requests equal a syn-flood. But beware, someone could exploit these rules by forging source IPs (see source address validation [2]) and your server is still doing work discarding these request packets, therefore could become unresponsive if the request amount is very high (at least take a look on syncookies [3]). – W-Mark K. > **[Open Source Software Entwicklung Heidelberg | OSSDL](https://ossdl.de/)** > > OSSDL — Open Source Software Development Labs Heidelberg. Softwareentwicklung, Architektur, Linux und DevOps auf Basis offener Technologien. [1] [http://www.netfilter.org/](http://www.netfilter.org/) [2] [Source Address Validation Improvements (savi)](http://tools.ietf.org/wg/savi/) [3] [SYN cookies - Wikipedia](http://en.wikipedia.org/wiki/SYN_cookies) ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [February 1, 2010, 5:31pm UTC](https://www.ruby-forum.com/t/protection-against-massiv-requests-from-single-server-ip/182622/4 "2010-02-01T17:31:41Z")
Hello Jim, thanks for your help. I am right that HttpLimitReq and HttpLimitZone is a per user limit? Every client (ip) get this limit and not all client together? Is $binary\_remote\_addr the right value if my nginx is behind haproxy? Or must i use something like X-Real-IP, i am not sure how i can debug what $binary\_remote\_addr includes behind haproxy, perhaps it is the haproxy ip and not the clients ip address? Kind regards -------- Original-Nachricht -------- > Datum: Sun, 31 Jan 2010 02:46:32 -0500 > Von: Jim O. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > An: [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > Betreff: Re: Protection against massiv requests from single server / ip > [GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com · GitHub](http://wiki.nginx.org/NginxHttpLimitZoneModule) > [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx) > – > GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! > Jetzt freischalten unter [http://portal.gmx.net/de/go/maxdome01](http://portal.gmx.net/de/go/maxdome01)