# Understanding HttpLimitReqModule

**URL:** <https://www.ruby-forum.com/t/understanding-httplimitreqmodule/203699>\
**Category:** NGINX\
**Created:** [February 25, 2011, 11:06am UTC](https://www.ruby-forum.com/t/understanding-httplimitreqmodule/203699 "2011-02-25T11:06:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [February 25, 2011, 11:06am UTC](https://www.ruby-forum.com/t/understanding-httplimitreqmodule/203699/1 "2011-02-25T11:06:54Z")

</div>

Hi all:

I’m trying to understand the HttpLimitReqModule, the wiki is a bit  
unverbose about the terminology.  
I’m trying to mimic Apache’s mod\_evasive module, specifically there is  
an annoying user that likes to request the same image once every  
second for hours at a time. I would like to log this and then use  
fail2ban to block the IP for a specific time. The problem is that the  
image in question is a legitimate request that shows up on every page  
of the site in question. What I had in mind:

limit\_req\_zone $binary\_remote\_addr zone=one:1m rate=50r/m;  
#offending user: 60r/m

```
server {
    location = /path/to/image.jpg {
        limit_req zone=one burst=???;
        limit_req_log_level error
    }

```

The problem is the low rate with which the offending requests are  
made. mod\_evasive lets you set up a timespan in which a specific  
number of requests are made, while nginx checks “online” if a second  
request is made after 1/rate. In my case (1 offending request per  
second), legitimate users would be blocked if they load 2 pages in one  
second, which of course happens frequently.

Any suggestions?

Thanks,  
Adrian

---

<div class="post-metadata">

**Author:** ![Adrian\_von\_Stechow](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/dbc845/32.png) [@Adrian\_von\_Stechow](https://www.ruby-forum.com/u/Adrian_von_Stechow)\
**Post date:** [February 25, 2011, 2:20pm UTC](https://www.ruby-forum.com/t/understanding-httplimitreqmodule/203699/2 "2011-02-25T14:20:36Z")

</div>

Hello!

On Fri, Feb 25, 2011 at 11:04:34AM +0100, Adrian von Stechow wrote:

> made. mod\_evasive lets you set up a timespan in which a specific  
> number of requests are made, while nginx checks “online” if a second  
> request is made after 1/rate. In my case (1 offending request per  
> second), legitimate users would be blocked if they load 2 pages in one  
> second, which of course happens frequently.
> 
> Any suggestions?

Set burst= to be high enough to accomodate occasional request  
bursts from legitimate users, and rate= to be somewhere between  
typical one for legitimate users (on average during relatively  
long time period) and offending one.

If you just want to block offending user which does 60 requests  
per minute, and your typical users do about 1 requests per  
minute, but occasinally may produce something like 100 requests in  
short time frame, you may set something like:

```
limit_req_zone $binary_remote_addr zone=one:1m rate=10r/m;

location ... {
    limit_req zone=one burst=100 nodelay;
}

```

This will allow legitimate users to do 10r/m on average and up to  
100 requests in the very same second. On the other hand,  
offending user with 60 r/m will start getting 503’s after about 2  
minutes: 120 requests with 20 allowed by rate will overflow  
burst.

Please refer to [Leaky bucket - Wikipedia](http://en.wikipedia.org/wiki/Leaky_Bucket) for  
algorithm details.

I also recommend using “nodelay” flag unless you really want to  
control rate at which requests are passed to backends or something  
like this.

Maxim D.

---

<div class="post-metadata">

**Author:** ![Adrian\_von\_Stechow](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/dbc845/32.png) [@Adrian\_von\_Stechow](https://www.ruby-forum.com/u/Adrian_von_Stechow)\
**Post date:** [February 25, 2011, 3:09pm UTC](https://www.ruby-forum.com/t/understanding-httplimitreqmodule/203699/3 "2011-02-25T15:09:27Z")

</div>

Aha! I didn’t know leaky bucket was a (common) thing - thanks for the  
link and for clarifying!