Skip to content

Commit c8a6a54

Browse files
committed
docs/nginx: Update 429 resolution documentation
The `conn_limit_map` variable doesn't seem to work very reliable. In our testing, we found that `limit_conn_per_ip` is much better.
1 parent e0ac25d commit c8a6a54

File tree

1 file changed

+4
-6
lines changed

1 file changed

+4
-6
lines changed

docs/hypernode-platform/nginx/how-to-resolve-rate-limited-requests-429-too-many-requests.md

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@ redirect_from:
1010
- /knowledgebase/resolving-429-many-requests/
1111
---
1212

13-
<!-- source: https://support.hypernode.com/en/hypernode/nginx/how-to-resolve-rate-limited-requests-429-too-many-requests/ -->
14-
1513
# How to Resolve Rate Limited Requests (429 Too Many Requests)
1614

1715
To protect your Hypernode from all kinds of attacks, bots, brute forces, and scriptkiddies causing downtime, we've implemented several layers of rate limiting.
@@ -130,7 +128,7 @@ To prevent a single IP from using all the FPM workers available simultaneously,
130128
In some cases, it might be necessary to exclude specific IP addresses from the per IP rate limiting. If you wish to exclude an IP address, you can do so by creating a config file called `/data/web/nginx/http.ratelimit` with the following content:
131129

132130
```nginx
133-
geo $conn_limit_map {
131+
geo $limit_conn_per_ip {
134132
default $remote_addr;
135133
198.51.100.69 '';
136134
}
@@ -141,7 +139,7 @@ In this example, we have excluded the IP address **198.51.100.69** by setting an
141139
In addition to excluding a single IP address, it is also possible to allow a whole range of IP addresses. You can do this by using the so-called CIDR notation (e.g., 198.51.100.0/24 to whitelist all IP addresses within the range 198.51.100.0 to 198.51.100.255). In that case, you can use the following snippet in `/data/web/nginx/http.ratelimit` instead:
142140

143141
```nginx
144-
geo $conn_limit_map {
142+
geo $limit_conn_per_ip {
145143
default $remote_addr;
146144
198.51.100.0/24 '';
147145
}
@@ -154,7 +152,7 @@ When your shop performance is very poor, it’s possible all your FPM workers ar
154152
For debugging purposes, however, it could be helpful to disable the per-IP connection limit for all IP’s. With the following snippet in `/data/web/nginx/http.ratelimit` , it is possible to altogether disable IP based rate limiting:
155153

156154
```nginx
157-
geo $conn_limit_map {
155+
geo $limit_conn_per_ip {
158156
default '';
159157
}
160158
```
@@ -179,7 +177,7 @@ if ($request_uri ~ ^\/elasticsearch.php$ ) {
179177
In the example above, the URLs `*/rest/V1/example-call/*` and `/elasticsearch.php` are the ones that have to be excluded. You now have to use the `$ratelimit_request` variable as a default value in the file `/data/web/nginx/http.ratelimit` (see below) to exclude these URLs from the rate limiter and make sure that bots and crawlers will still be rate limited based on their User Agent.
180178

181179
```nginx
182-
geo $conn_limit_map {
180+
geo $limit_conn_per_ip {
183181
default $ratelimit_request_url;
184182
}
185183
```

0 commit comments

Comments
 (0)