What techniques and/or modules are available to implement robust rate limiting (requests|bytes/ip/unit time) in apache?

share|improve this question
    
I am using Linux's tc on the web server, because Red Hat 6 has only Apache 2.2. – ceving May 19 '14 at 12:17
up vote 48 down vote accepted

The best

  • mod_evasive (Focused more on reducing DoS exposure)
  • mod_cband (Best featured for 'normal' bandwidth control)

and the rest

share|improve this answer
10  
I couldn't find anything to limit connections per day by IP address. I spent all night searching, that's a shame. – Greg Jun 8 '09 at 12:56
1  
Does anyone know if there's a way to get mod_evasive to look at a header instead of the IP, for when running behind a reverse proxy? – Stavros Korokithakis Nov 15 '10 at 17:57
1  
@StavrosKorokithakis Maybe this will help? stderr.net/apache/rpaf I believe it will make the X-Forwarded IP appear as if it were the source IP to all apache modules loaded after it. – Eli Oct 25 '11 at 21:32
5  
4 years later, is mod_evasive still "the best"? – Zac Thompson Feb 15 '14 at 7:38
4  
Back up your claim. Why are _evasive and _cband the best? – Jakar Mar 18 '15 at 17:52

There are numerous way including web application firewalls but the easiest thing to implement if using an Apache mod.

One such mod I like to recommend is mod_qos. It's a free module that is veryf effective against certin DOS, Bruteforce and Slowloris type attacks. This will ease up your server load quite a bit.

It is very powerful.

The current release of the mod_qos module implements control mechanisms to manage:

  • The maximum number of concurrent requests to a location/resource (URL) or virtual host.

  • Limitation of the bandwidth such as the maximum allowed number of requests per second to an URL or the maximum/minimum of downloaded kbytes per second.

  • Limits the number of request events per second (special request conditions).

  • Limits the number of request events within a defined period of time.
  • It can also detect very important persons (VIP) which may access the web server without or with fewer restrictions.
  • Generic request line and header filter to deny unauthorized operations.

  • Request body data limitation and filtering (requires mod_parp).

  • Limits the number of request events for individual clients (IP).

  • Limitations on the TCP connection level, e.g., the maximum number of allowed connections from a single IP source address or dynamic keep-alive control.

  • Prefers known IP addresses when server runs out of free TCP connections.

This is a sample config of what you can use it for. There are hundreds of possible configurations to suit your needs. Visit the site for more info on controls.

Sample configuration:
# minimum request rate (bytes/sec at request reading):
QS_SrvRequestRate                                 120

# limits the connections for this virtual host:
QS_SrvMaxConn                                     800

# allows keep-alive support till the server reaches 600 connections:
QS_SrvMaxConnClose                                600

# allows max 50 connections from a single ip address:
QS_SrvMaxConnPerIP                                 50

# disables connection restrictions for certain clients:
QS_SrvMaxConnExcludeIP                    172.18.3.32
QS_SrvMaxConnExcludeIP                    192.168.10.

http://opensource.adnovum.ch/mod_qos/

share|improve this answer
    
this one only works in old apache2.2 not work in apache2.4 + , is it? – BOBO May 18 '17 at 3:52

Sadly, mod_evasive won't work as expected when used in non-prefork configurations (recent apache setups are mainly MPM)

share|improve this answer

As stated in this blog post it seems possible to use Apache's mod_security to implement a rate limit per second.

The configuration is something like this:

SecRuleEngine On

<LocationMatch "^/somepath">
  SecAction initcol:ip=%{REMOTE_ADDR},pass,nolog
  SecAction "phase:5,deprecatevar:ip.somepathcounter=1/1,pass,nolog"
  SecRule IP:SOMEPATHCOUNTER "@gt 60" "phase:2,pause:300,deny,status:509,setenv:RATELIMITED,skip:1,nolog"
  SecAction "phase:2,pass,setvar:ip.somepathcounter=+1,nolog"
  Header always set Retry-After "10" env=RATELIMITED
</LocationMatch>

ErrorDocument 509 "Rate Limit Exceeded"
share|improve this answer
1  
This was perfect for me, with modsec2 already running. Just had to add ids to the rules to match the modsec version, like so: <LocationMatch "^/somepath"> SecAction initcol:ip=%{REMOTE_ADDR},pass,nolog,id:10000001 SecAction "phase:5,deprecatevar:ip.somepathcounter=1/1,pass,nolog,id:1‌​0000002" SecRule IP:SOMEPATHCOUNTER "@gt 60" "phase:2,pause:300,deny,status:509,setenv:RATELIMITED,skip:1‌​,nolog,id:10000003" SecAction "phase:2,pass,setvar:ip.somepathcounter=+1,nolog,id:10000004‌​" Header always set Retry-After "10" env=RATELIMITED </LocationMatch> – Nathan Stretch Feb 5 '14 at 7:42
1  
Also note that you can change how many initial burst requests are allowed by editing the "@gt 60", as well as how quickly it "recharges" the limit by editing the ip.somepathcounter=1/1 bit. 1/1 allows one additional request per second. 1/2 allows one additional request every 2 seconds, etc. – Nathan Stretch Feb 5 '14 at 7:44
    
Apache 2.4 will complain about the 509 in ErrorDocument, an option is changing it to 429 (which is -of course- not supported in Apache 2.2). Also, all SecAction and SecRule-s need an id since mod_security 2.7. – Mrten Jul 7 '15 at 12:51

One more option - mod_qos

Not simple to configure - but powerful.

http://opensource.adnovum.ch/mod_qos/

share|improve this answer

In Apache 2.4, there's a new stock module called mod_ratelimit. For emulating modem speeds, you can use mod_dialup. Though I don't see why you just couldn't use mod_ratelimit for everything.

share|improve this answer
    
Note that mod_dialup uses an asynchronous SUSPENDED state, not wasting threads on waiting, whereas mod_ratelimit, as of now, is strictly thread-per-connection. cf. thread.gmane.org/gmane.comp.apache.cvs/20490 – ArtemGr Jul 31 '13 at 15:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.