# Whitelisting IP addresses for ratelimiting

**URL:** <https://www.ruby-forum.com/t/whitelisting-ip-addresses-for-ratelimiting/221678>\
**Category:** NGINX\
**Created:** [July 25, 2012, 2:54pm UTC](https://www.ruby-forum.com/t/whitelisting-ip-addresses-for-ratelimiting/221678 "2012-07-25T14:54:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [July 25, 2012, 2:54pm UTC](https://www.ruby-forum.com/t/whitelisting-ip-addresses-for-ratelimiting/221678/1 "2012-07-25T14:54:31Z")

</div>

I have my configuration set up based on the information at

> **[Limit requests per IP on Nginx using HttpLimitZoneModule and...](https://gadelkareem.com/2012/03/25/limit-requests-per-ip-on-nginx-using-httplimitzonemodule-and-httplimitreqmodule-except-whitelist/)**
>
> – Make sure to check Nginx, PHP posts for information on Nginx and PHP setup and configuration. Nginx offers two modules, HttpLimitReqModule and HttpLimitZoneModule, to limit simultaneous connections for the...

as follows:

http {  
…  
geo $unlimited {  
default 1;  
192.168.45.56/32 0;  
}  
…  
limit\_req\_zone $binary\_remote\_addr zone=unlimited:10m rate=10r/m;  
…  
server {  
…  
location / {  
limit\_req zone=unlimited burst=5;  
}  
}  
}

I believe this should mean that requests from IP address 192.168.45.56  
are not subject to the rate limiting, but it isn’t working (they do get  
blocked by the rate limiting) and I can’t see why.

Is my configuration obviously wrong somewhere?

And if not, is there any way I can easily debug why the rate-limiting is  
being applied?

Thanks,  
James

---

<div class="post-metadata">

**Author:** ![James\_Fidell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f1d935/32.png) [@James\_Fidell](https://www.ruby-forum.com/u/James_Fidell)\
**Post date:** [July 25, 2012, 2:56pm UTC](https://www.ruby-forum.com/t/whitelisting-ip-addresses-for-ratelimiting/221678/2 "2012-07-25T14:56:52Z")

</div>

On 25/07/12 13:53, James Fidell wrote:

> }  
> …  
> limit\_req\_zone $binary\_remote\_addr zone=unlimited:10m rate=10r/m;  
> …  
> server {  
> …  
> location / {  
> limit\_req zone=unlimited burst=5;  
> }  
> }  
> }

I realise it may be much clearer if I did s/unlimited/limited/ on this  
config file 🙂

James

---

<div class="post-metadata">

**Author:** ![James\_Fidell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f1d935/32.png) [@James\_Fidell](https://www.ruby-forum.com/u/James_Fidell)\
**Post date:** [July 25, 2012, 3:46pm UTC](https://www.ruby-forum.com/t/whitelisting-ip-addresses-for-ratelimiting/221678/3 "2012-07-25T15:46:34Z")

</div>

Hello!

On Wed, Jul 25, 2012 at 01:53:41PM +0100, James Fidell wrote:

> …  
> I believe this should mean that requests from IP address 192.168.45.56  
> are not subject to the rate limiting, but it isn’t working (they do get  
> blocked by the rate limiting) and I can’t see why.
> 
> Is my configuration obviously wrong somewhere?

Yes, it’s obviously wrong, as well as blogpost you’ve followed.  
You don’t use $unlimited variable anywhere in your config, and  
just use $binary\_remote\_addr for limiting without any exceptions.

To make an exception, you have to provide empty value for a  
variable in limit\_req\_zone (see [Module ngx\_http\_limit\_req\_module](http://nginx.org/r/limit_req_zone)).

Correct config for exceptions based geo would be (involving  
intermediate map as geo doesn’t allow variables in a resulting  
value):

```
geo $limited {
    default 1;
    192.168.45.56/32 0;
}

map $limited $limit {
    1 $binary_remote_addr;
    0 "";
}

limit_req_zone $limit zone=foo:1m rate=10r/m;
limit_req zone=foo burst=5;

```

As you can see from the above config, limit\_req\_zone now works  
based on a $limit variable, which is either client address, or an  
empty string. In a latter case client isn’t limited.

Maxim D.

---

<div class="post-metadata">

**Author:** ![James\_Fidell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f1d935/32.png) [@James\_Fidell](https://www.ruby-forum.com/u/James_Fidell)\
**Post date:** [July 25, 2012, 4:00pm UTC](https://www.ruby-forum.com/t/whitelisting-ip-addresses-for-ratelimiting/221678/4 "2012-07-25T16:00:36Z")

</div>

On 25/07/12 14:45, Maxim D. wrote:

> Yes, it’s obviously wrong, as well as blogpost you’ve followed.  
> You don’t use $unlimited variable anywhere in your config, and  
> just use $binary\_remote\_addr for limiting without any exceptions.

I did wonder how the $unlimited variable had any effect. Foolish of  
me to assume that a blog is accurate 🙂

Thanks for your help.

James