How can I implement rate limiting with Apache? (requests per second)

Question

What techniques and/or modules are available to implement robust rate limiting (requests|bytes/ip/unit time) in apache?

Phobos

I am using Linux's tc on the web server, because Red Hat 6 has only Apache 2.2. – Verdure

Answer 1

The best

• mod_evasive (Focused more on reducing DoS exposure)
• mod_cband (Best featured for 'normal' bandwidth control)

and the rest

• mod_limitipconn
• mod_bw
• mod_bwshare

Sporocarp

I couldn't find anything to limit connections per day by IP address. I spent all night searching, that's a shame. – Rinee

Does anyone know if there's a way to get mod_evasive to look at a header instead of the IP, for when running behind a reverse proxy? – Botanist

@StavrosKorokithakis Maybe this will help? stderr.net/apache/rpaf I believe it will make the X-Forwarded IP appear as if it were the source IP to all apache modules loaded after it. – Tellurium

The homepage for mod_cband seems to be down, but there's a GitHub for 0.9.7.5: github.com/maiha/mod_cband – Ejector

according to this bugs.debian.org/cgi-bin/bugreport.cgi?bug=463789 mod_cband is buggy – Tmesis

4 years later, is mod_evasive still "the best"? – Maricela

It could be important information for some, that mod_cband is not possible to use on Windows. apachelounge.com/viewtopic.php?t=4804 – Hatchery

Back up your claim. Why are _evasive and _cband the best? – Clarhe

mod_evasive gets a lot of online recommendations but, as of mid-2017, it seems to have been abandoned by its author, Jonathan Zdziarski who has strangely deleted all references to it from his blog – though the source code is still available as an upload. None of the other projects have been updated in the last 6 years (or 15 years in the case of mod_limitipconn). – Rellia

Answer 2

As stated in this blog post it seems possible to use mod_security to implement a rate limit per second.

The configuration is something like this:

SecRuleEngine On

<LocationMatch "^/somepath">
  SecAction initcol:ip=%{REMOTE_ADDR},pass,nolog
  SecAction "phase:5,deprecatevar:ip.somepathcounter=1/1,pass,nolog"
  SecRule IP:SOMEPATHCOUNTER "@gt 60" "phase:2,pause:300,deny,status:509,setenv:RATELIMITED,skip:1,nolog"
  SecAction "phase:2,pass,setvar:ip.somepathcounter=+1,nolog"
  Header always set Retry-After "10" env=RATELIMITED
</LocationMatch>

ErrorDocument 509 "Rate Limit Exceeded"

Villain

This was perfect for me, with modsec2 already running. Just had to add ids to the rules to match the modsec version, like so: <LocationMatch "^/somepath"> SecAction initcol:ip=%{REMOTE_ADDR},pass,nolog,id:10000001 SecAction "phase:5,deprecatevar:ip.somepathcounter=1/1,pass,nolog,id:10000002" SecRule IP:SOMEPATHCOUNTER "@gt 60" "phase:2,pause:300,deny,status:509,setenv:RATELIMITED,skip:1,nolog,id:10000003" SecAction "phase:2,pass,setvar:ip.somepathcounter=+1,nolog,id:10000004" Header always set Retry-After "10" env=RATELIMITED </LocationMatch> – Hymenium

Also note that you can change how many initial burst requests are allowed by editing the "@gt 60", as well as how quickly it "recharges" the limit by editing the ip.somepathcounter=1/1 bit. 1/1 allows one additional request per second. 1/2 allows one additional request every 2 seconds, etc. – Hymenium

Apache 2.4 will complain about the 509 in ErrorDocument, an option is changing it to 429 (which is -of course- not supported in Apache 2.2). Also, all SecAction and SecRule-s need an id since mod_security 2.7. – Adjure

FYI mod_security is not an Apache project. – Stronski

Answer 3

There are numerous way including web application firewalls but the easiest thing to implement if using an Apache mod.

One such mod I like to recommend is mod_qos. It's a free module that is veryf effective against certin DOS, Bruteforce and Slowloris type attacks. This will ease up your server load quite a bit.

It is very powerful.

The current release of the mod_qos module implements control mechanisms to manage:

• The maximum number of concurrent requests to a location/resource (URL) or virtual host.

• Limitation of the bandwidth such as the maximum allowed number of requests per second to an URL or the maximum/minimum of downloaded kbytes per second.

• Limits the number of request events per second (special request conditions).

• Limits the number of request events within a defined period of time.
• It can also detect very important persons (VIP) which may access the web server without or with fewer restrictions.

• Generic request line and header filter to deny unauthorized operations.

• Request body data limitation and filtering (requires mod_parp).

• Limits the number of request events for individual clients (IP).

• Limitations on the TCP connection level, e.g., the maximum number of allowed connections from a single IP source address or dynamic keep-alive control.

• Prefers known IP addresses when server runs out of free TCP connections.

This is a sample config of what you can use it for. There are hundreds of possible configurations to suit your needs. Visit the site for more info on controls.

Sample configuration:
# minimum request rate (bytes/sec at request reading):
QS_SrvRequestRate                                 120

# limits the connections for this virtual host:
QS_SrvMaxConn                                     800

# allows keep-alive support till the server reaches 600 connections:
QS_SrvMaxConnClose                                600

# allows max 50 connections from a single ip address:
QS_SrvMaxConnPerIP                                 50

# disables connection restrictions for certain clients:
QS_SrvMaxConnExcludeIP                    172.18.3.32
QS_SrvMaxConnExcludeIP                    192.168.10.

http://opensource.adnovum.ch/mod_qos/

Interpellation

this one only works in old apache2.2 not work in apache2.4 + , is it? – Kaffraria

@Kaffraria the mod_quos sourceforge page says it works fine with apache2.4. But there is a specific discussion about a couple of features that don't work here:https://mcmap.net/q/36453/-apache-2-4-1-and-old-mods – Westney

The documentation link is rot – Zeeba

Answer 4

In Apache 2.4, there's a new stock module called mod_ratelimit. For emulating modem speeds, you can use mod_dialup. Though I don't see why you just couldn't use mod_ratelimit for everything.

Enthusiasm

Note that mod_dialup uses an asynchronous SUSPENDED state, not wasting threads on waiting, whereas mod_ratelimit, as of now, is strictly thread-per-connection. cf. thread.gmane.org/gmane.comp.apache.cvs/20490 – Cittern

Answer 5

Sadly, mod_evasive won't work as expected when used in non-prefork configurations (recent apache setups are mainly MPM)

Alanna

Answer 6

Depends on why you want to rate limit.

If it's to protect against overloading the server, it actually makes sense to put NGINX in front of it, and configure rate limiting there. It makes sense because NGINX uses much less resources, something like a few MB per ten thousand connections. So, if the server is flooded, NGINX will do the rate limiting(using an insignificant amount of resources) and only pass the allowed traffic to Apache.

If all you're after is simplicity, then use something like mod_evasive.

As usual, if it's to protect against DDoS or DoS attacks, use a service like Cloudflare which also has rate limiting.

Credo

Nginx is the way to go, stop looking around. All other suggested solutions based on apache modules are either not maintained, complex or inefficient. – Figment

Answer 7

One more option - mod_qos

Not simple to configure - but powerful.

http://opensource.adnovum.ch/mod_qos/

Sigler