How can I implement rate limiting with Apache requests per second

Question

What techniques and or modules are available to implement robust rate limiting  requests bytes ip unit time  in apache

User · Answer

One more option - mod qos  Not simple to configure - but powerful   http   opensource adnovum ch mod qos

User · Answer

The best   mod evasive  Focused more on reducing DoS exposure  mod cband  Best featured for  normal  bandwidth control    and the rest   mod limitipconn mod bw mod bwshare

User · Answer

Sadly  mod evasive won t work as expected when used in non-prefork configurations  recent apache setups are mainly MPM

User · Answer

There are numerous way including web application firewalls but the easiest thing to implement if using an Apache mod    One such mod I like to recommend is mod qos  It s a free module that is veryf effective against certin DOS  Bruteforce and Slowloris type attacks  This will ease up your server load quite a bit    It is very powerful    The current release of the mod qos module implements control mechanisms to manage    The maximum number of concurrent requests to a location resource  URL  or virtual host   Limitation of the bandwidth such as the maximum allowed number of requests per second to an URL or the maximum minimum of downloaded kbytes per second   Limits the number of request events per second  special request conditions   Limits the number of request events within a defined period of time  It can also detect very important persons  VIP  which may access the web server    without or with fewer restrictions  Generic request line and header filter to deny unauthorized operations  Request body data limitation and filtering  requires mod parp   Limits the number of request events for individual clients  IP   Limitations on the TCP connection level  e g   the maximum number of allowed connections from a single IP source address or dynamic keep-alive control  Prefers known IP addresses when server runs out of free TCP connections    This is a sample config of what you can use it for  There are hundreds of possible configurations to suit your needs  Visit the site for more info on controls   Sample configuration    minimum request rate  bytes sec at request reading   QS SrvRequestRate                                 120    limits the connections for this virtual host  QS SrvMaxConn                                     800    allows keep-alive support till the server reaches 600 connections  QS SrvMaxConnClose                                600    allows max 50 connections from a single ip address  QS SrvMaxConnPerIP                                 50    disables connection restrictions for certain clients  QS SrvMaxConnExcludeIP                    172 18 3 32 QS SrvMaxConnExcludeIP                    192 168 10    http   opensource adnovum ch mod qos

User · Answer

As stated in this blog post it seems possible to use mod security to implement a rate limit per second   The configuration is something like this   SecRuleEngine On   lt LocationMatch    somepath  gt    SecAction initcol ip   REMOTE ADDR  pass nolog   SecAction  phase 5 deprecatevar ip somepathcounter 1 1 pass nolog    SecRule IP SOMEPATHCOUNTER   gt 60   phase 2 pause 300 deny status 509 setenv RATELIMITED skip 1 nolog    SecAction  phase 2 pass setvar ip somepathcounter  1 nolog    Header always set Retry-After  10  env RATELIMITED  lt  LocationMatch gt   ErrorDocument 509  Rate Limit Exceeded

User · Answer

Depends on why you want to rate limit    If it s to protect against overloading the server  it actually makes sense to put NGINX in front of it  and configure rate limiting there  It makes sense because NGINX uses much less resources  something like a few MB per ten thousand connections  So  if the server is flooded  NGINX will do the rate limiting using an insignificant amount of resources  and only pass the allowed traffic to Apache   If all you re after is simplicity  then use something like mod evasive   As usual  if it s to protect against DDoS or DoS attacks  use a service like Cloudflare which also has rate limiting

User · Answer

In Apache 2 4  there s a new stock module called mod ratelimit  For emulating modem speeds  you can use mod dialup  Though I don t see why you just couldn t use mod ratelimit for everything

[apache] How can I implement rate limiting with Apache? (requests per second)

Examples related to apache

Examples related to apache2

Examples related to ddos