Forum Discussion

midhun_108442's avatar
midhun_108442
Icon for Nimbostratus rankNimbostratus
Jan 21, 2012

Help need to create a irule for limit Client Connection

Hi,

 

 

Can anyone help us to create a irule to limit number of client connection hitting to Virtual server , I got the same irule scenario in Dev central site for (iRule.Limit Connection from Client) , but thats not working with me its only logging the message not blocking the connection ,Kindly anyone help me to provide the irule for the same.

 

 

Regards,

 

Midhun P.K

 

 

 

  • Hi Aaron,

     

     

    Thanks for the update ,I applied and its working now for each client different connection limit, Could you please tel me if the IP address which is not mentioned in Data Group list how can we avoid them to skip the irule to check , means only configured IP address in Data group has connection limit , rest who is accessing the web server shouldn't check the irule and drop the connection ,

     

     

    Regards,

     

    Midhun P.K

     

  • Hi Aaron,

     

     

    Could you please update me on my queries

     

     

    Regards,

     

    Midhun P.K

     

  • Hi Midhun,

    Here you go:

    
    when RULE_INIT {
     This defines how long is the sliding window to count the requests. This example allows 10 requests in 3 seconds
    set static::windowSecs 3
    }
    when CLIENT_ACCEPTED {
    
     Max connections per client IP
    set limit [class match -value [IP::client_addr] equals conn_limit_dg]
    log local0. "[IP::client_addr]: \$limit: $limit"
    
    }
    when HTTP_REQUEST {
     Check if client IP is in the connection limit data group and the request is a GET
    if { $limit ne "" and [HTTP::method] eq "GET"} {
    set getCount [table key -count -subtable [IP::client_addr]]
    log local0. "[IP::client_addr]: getCount=$getCount"
    if { $getCount < $limit} {
    incr getCount 1
    table set -subtable [IP::client_addr] $getCount "" indefinite $static::windowSecs
    } else {  log local0. "[IP::client_addr]: exceeded the number of requests allowed. $getCount / $limit"
    HTTP::respond 501 content "Request blocked. Exceeded requests/sec limit."
    }
    }
    }
    

    Aaron
  • I was hoping to use a similar irule to block an IP when it attempts to make more than 200 connections per second. On top of this, I only want this to apply to IP's in China. Can you help me to do this, I believe we have to remove the data group config and use the line if { [whereis [IP::client_addr] country] equals "CN" } Any help is appreciated

     

  • I was wondering if the following simlar strategy could work. For one of our services the connections are much higher versus the others and when there are more connections for this service there tend to be more issues in general and performance degrades. If I were to check that for this specific service; connections have reached a certain amount or % of my virtual server max. In this case, route the traffic to another pool which has standby VMs with no other traffic on them. So, until the number of connections has gone below this threshold, we would be routing to another pool with fresh VMs, no other traffic going through them. The idea is that I think this could improve performance and limit the issues in general for all of our services.

    Here is a quick concept based on the above logic, any thoughts or should I open another thread?

    when RULE_INIT { This defines how long is the sliding window to count the requests. This example allows 10 requests in 3 seconds set static::windowSecs 20 set limit 100 }

    when HTTP_REQUEST { if {[HTTP::uri] contains "/ServiceX"} {

    if { $limit ne "" } {
        set getCount [table key -count -subtable [IP::client_addr]]
        log local0. "[IP::client_addr]: getCount=$getCount"
        if { $getCount < $limit} {
            incr getCount 1
            table set -subtable [IP::client_addr] $getCount "" indefinite $static::windowSecs
        } else {  log local0. "[IP::client_addr]: exceeded the number of requests allowed- rerouting service X. $getCount / $limit"
            pool Service_X_Pool
        }
    }
    

    }

    }