<div dir="ltr"><div style="font-size:small;color:rgb(51,51,153)" class="gmail_default">You could also generate 304 responses for content you won't provide (cf. return).<br>nginx is good at dealing with loads of requests, no problem on that side. And since return generates an in-memory answer by default, you won't be hammering your resources. If yo uare CPU or RAM-limited because of those requests, then I would suggest you evaluate the sizing of your server(s).<br>You might wish to seperate logging for these requests from the standard flow to improve their readability, or deactivate them altogether if you consider they add little-to-no value.<br><br></div><div style="font-size:small;color:rgb(51,51,153)" class="gmail_default">My 2¢,<br></div><div class="gmail_extra"><div><div class="gmail_signature"><font size="1"><span style="color:rgb(102,102,102)">---<br></span><b><span style="color:rgb(102,102,102)">B. R.</span></b><span style="color:rgb(102,102,102)"></span></font></div></div>
<br><div class="gmail_quote">On Sun, Sep 11, 2016 at 9:16 PM, <span dir="ltr"><<a target="_blank" href="mailto:lists@lazygranch.com">lists@lazygranch.com</a>></span> wrote:<br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><a target="_blank" rel="noreferrer" href="https://www.nginx.com/blog/tuning-nginx/">https://www.nginx.com/blog/<wbr>tuning-nginx/</a><br>
<br>
I have far more faith in this write up regarding tuning than the anti-ddos, though both have similarities. <br>
<br>
My interpretation is the user bandwidth is connections times rate. But you can't limit the connection to one because (again my interpretation) there can be multiple users behind one IP. Think of a university reading your website. Thus I am more comfortable limiting bandwidth than I am limiting the number of connections. The 512k rate limit is fine. I wouldn't go any higher. <br>
<br>
I don't believe their is one answer here because it depends on how the user interacts with the website. I only serve static content. In fact, I only allow the verbs "head" and "get" to limit the attack surface. A page of text and photos itself can be many things. Think of a photo gallery versus a forum page. The forum has mostly text sprinkled with avatar photos, while the gallery can be mostly images with just a line of text each. <br>
<br>
Basically you need to experiment. Even then, your setup may be better or worse than the typical user. That said, if you limited the rate to 512k bytes per second, most users could achieve that rate. <br>
<br>
I just don't see evidence of download managers. I see plenty of wget, curl, and python. Those people get my 444 treatment. I use the map module as indicated in my other post to do this. <br>
<br>
What I haven't mentioned is filtering out machines. If you are really concerned about your system being overloaded, think about the search engines you want to support. Assuming you want Google, you need to set up your website in a manner so that Google knows you own it, then you can throttle it back. Google is maybe 20% of my referrals.<br>
<br>
If you have a lot of photos, you can set up nginx to block hit linking. This is significant because Google images will hot link everything you have. What you want is for Google itself to see your images, which it will present in reduced resolution, but block the Google hot link. If someone really wants to see your image, Google supplies the referal page. <br>
<br>
<a target="_blank" rel="noreferrer" href="http://nginx.org/en/docs/http/ngx_http_referer_module.html">http://nginx.org/en/docs/http/<wbr>ngx_http_referer_module.html</a><br>
<br>
I make my own domain a valid, but maybe that is assumed. If you want to place a link to an image on your website in a forum, you need to make that forum valid. <br>
<br>
Facebook will steal your images.<br>
<a target="_blank" rel="noreferrer" href="http://badbots.vps.tips/info/facebookexternalhit-bot">http://badbots.vps.tips/info/<wbr>facebookexternalhit-bot</a><br>
<br>
I would use the nginx map module since you will probably be blocking many bots. <br>
<br>
Finally, you may want to block "the cloud" using your firewall. Only block the browser ports since mail servers will be on the cloud. I block all of AWS for example. My nginx.conf also flags certain requests such as logging into WordPress since I'm not using WordPress! Clearly that IP is a hacker. I have plenty more signatures in the map. I have a script that pulls the IP addresses out of the access.log. I get maybe 20 addresses a day. I feed them to ip2location. Any address that goes to a cloud, VPS, colo, hosting company gets added to the firewall blocking list. I don't just block the IP, but I use the Hurricane Electric BGP tool to get the entire IP space to block. As a rule, I don't block schools, libraries, or ISPs. The idea here is to allow eyeballs but not machines. <br>
<br>
You can also use commercial blocking services if you trust them. (I don't. )<br>
<br>
<br>
Original Message <br>
From: Grant<br>
Sent: Sunday, September 11, 2016 10:28 AM<br>
<span class="gmail-im gmail-HOEnZb">To: <a href="mailto:nginx@nginx.org">nginx@nginx.org</a><br>
Reply To: <a href="mailto:nginx@nginx.org">nginx@nginx.org</a><br>
Subject: Re: limit-req and greedy UAs<br>
<br>
</span><div class="gmail-HOEnZb"><div class="gmail-h5">> This page has all the secret sauce, including how to limit the number of connections.<br>
><br>
> <a target="_blank" rel="noreferrer" href="https://www.nginx.com/blog/mitigating-ddos-attacks-with-nginx-and-nginx-plus/">https://www.nginx.com/blog/<wbr>mitigating-ddos-attacks-with-<wbr>nginx-and-nginx-plus/</a><br>
><br>
> I set up the firewall with a higher number as a "just in case."<br>
<br>
<br>
Should I basically duplicate my limit_req and limit_req_zone<br>
directives into limit_conn and limit_conn_zone? In what sort of<br>
situation would someone not do that?<br>
<br>
- Grant<br>
<br>
______________________________<wbr>_________________<br>
nginx mailing list<br>
<a href="mailto:nginx@nginx.org">nginx@nginx.org</a><br>
<a target="_blank" rel="noreferrer" href="http://mailman.nginx.org/mailman/listinfo/nginx">http://mailman.nginx.org/<wbr>mailman/listinfo/nginx</a><br>
<br>
______________________________<wbr>_________________<br>
nginx mailing list<br>
<a href="mailto:nginx@nginx.org">nginx@nginx.org</a><br>
<a target="_blank" rel="noreferrer" href="http://mailman.nginx.org/mailman/listinfo/nginx">http://mailman.nginx.org/<wbr>mailman/listinfo/nginx</a></div></div></blockquote></div><br></div></div>