# Tool to BAN IPs based on amount of requests and response codes **URL:** \ **Category:** NGINX\ **Created:** [July 8, 2012, 11:41pm UTC](https://www.ruby-forum.com/t/tool-to-ban-ips-based-on-amount-of-requests-and-response-codes/221319 "2012-07-08T23:41:39Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\ **Post date:** [July 8, 2012, 11:41pm UTC](https://www.ruby-forum.com/t/tool-to-ban-ips-based-on-amount-of-requests-and-response-codes/221319/1 "2012-07-08T23:41:39Z")
Hello all!! Is there a log parser OR nginx module out there that can do this? I prefer this to be a tool that can invoke an iptables action, but not necessarily. BAN If an IP makes more then X requests per hour or day (limit zone module only limits based on r/m, and r/s) EXAMPLE USE: No IP should be able to send 600 requests to a site with 60 pages per day. BAN If an IP makes more then X requests to a SINGLE url per hour or day (this is not the same as the first, the first being any URL total, this being single URL total) EXAMPLE USE: No IP should be able to send 60 requests as GET / per day. BAN if an IP produces more then X requests per hour or day that result in 400, or 404 errors. EXAMPLE USE: Only scanners generate more then 40 400s, or 404s to my site. Fail2Ban doesnt work on this because it does not do accounting as far as I understand, i also understand that preferably the tool should work on RAM rather then parsing logs because of intensive IO consumption. If it doesnt exist can anybody orientate me if one can be created and what could i base it off? Joseph ---
**Author:** ![jchengj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/d78d45/32.png) [@jchengj](https://www.ruby-forum.com/u/jchengj)\ **Post date:** [July 9, 2012, 6:50am UTC](https://www.ruby-forum.com/t/tool-to-ban-ips-based-on-amount-of-requests-and-response-codes/221319/2 "2012-07-09T06:50:28Z")
These may be of help: [http://blog.bodhizazen.net/linux/prevent-dos-with-iptables/](http://blog.bodhizazen.net/linux/prevent-dos-with-iptables/) > **[Using fail2ban with nginx in Debian](https://codelog.climens.net/2011/02/13/using-fail2ban-with-nginx-in-debian/)** > > A personal blog from Marc Climent about my experiences as a developer, geek and father. > **[Top 25 Nginx Web Server Best Security Practices - nixCraft](https://www.cyberciti.biz/tips/linux-unix-bsd-nginx-webserver-security.html)** > > This pages shows how to secure Nginx web server including various hardening approaches and best security on Linux or Unix-like system. On Sun, Jul 8, 2012 at 5:41 PM, Joseph C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > EXAMPLE USE: No IP should be able to send 600 requests to a site with 60 > 400, or 404 errors. > > Joseph > > * * * > > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) – [image: Josh Parker WordPress Consultant] [http://www.7mediaws.org](http://www.7mediaws.org) Joshua Parker WordPress Consultant & PHP Developer 888.255.1798 x701 Skype: seven-media 7 Media Web Solutions, LLC > **[7mediaws.org — Coming Soon](http://7mediaws.org)** [image: Twitter] [http://twitter.com/#!/7mediaws](http://twitter.com/#%21/7mediaws)[image: Linkedin][http://www.linkedin.com/in/joshmac](http://www.linkedin.com/in/joshmac)[image: Josh Parker :: WordPress Consultant] [http://www.7mediaws.org/feed/](http://www.7mediaws.org/feed/)[image: Skype][image: Google+] [http://gplus.to/joshuaparker](http://gplus.to/joshuaparker)[image: WordPress Profile] [http://wordpress.org/extend/plugins/profile/parkerj](http://wordpress.org/extend/plugins/profile/parkerj)[image: [About.me](http://About.me)] [http://about.me/joshuaparker](http://about.me/joshuaparker)[image: Gravatar][http://en.gravatar.com/joshmac3](http://en.gravatar.com/joshmac3)