# How to do Nginx: rate limiting behind Cloudflare on docker **URL:** \ **Category:** Resources\ **Tags:** docker-compose, docker-networking, nginx, docker\ **Created:** [October 11, 2024, 2:48am UTC](https://forum.hhf.technology/t/how-to-do-nginx-rate-limiting-behind-cloudflare-on-docker/167 "2024-10-11T02:48:43Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [October 11, 2024, 2:48am UTC](https://forum.hhf.technology/t/how-to-do-nginx-rate-limiting-behind-cloudflare-on-docker/167/1 "2024-10-11T02:48:43Z")
# How to do `Nginx:` rate limiting behind `Cloudflare` on docker `docker-compose.yml`: ```yaml services: n1: image: nginx:alpine volumes: - ./n1.conf:/etc/nginx/conf.d/default.conf ports: - 8080:80 n2: image: nginx:alpine volumes: - ./n2.conf:/etc/nginx/conf.d/default.conf s: build: . command: perl server.pl init: true ``` `n1.conf`: ```nginx server { location / { proxy_pass http://n2; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } } ``` `n2.conf`: ```nginx limit_req_zone $binary_remote_addr zone=one:10m rate=12r/m; server { real_ip_header X-Forwarded-For; set_real_ip_from 172.16.0.0/12; set_real_ip_from 192.168.0.0/16; real_ip_recursive on; location /unlim { return 200 "hello world (nginx)"; } location / { limit_req zone=one burst=5; proxy_pass http://s; # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # nginx < 1.9.7, it will add the overriden $remote_addr to X-Forwarded-For proxy_set_header X-Forwarded-For "$http_x_forwarded_for, $realip_remote_addr"; # nginx >= 1.9.7 } } ``` `Dockerfile`: ```dockerfile FROM alpine:3.20 RUN apk add perl perl-http-daemon COPY server.pl server.pl ``` `server.pl`: ```pl use strict; use warnings; use HTTP::Daemon; $| = 1; my $d = HTTP::Daemon->new(LocalPort => 80) or die; while (my $c = $d->accept) { while (my $r = $c->get_request) { print $r->as_string; $c->send_response(200, undef, [ 'Content-Type' => 'text/html; charset=utf-8', ], "hello world (perl)\n"); } $c->close; } ``` 2 `/` requests from different end user IPs (both requests are served immediately): ```auto $ curl -sSv localhost:8080; docker compose exec n1 curl -sSv localhost s-1 | GET / HTTP/1.0 s-1 | Connection: close s-1 | Accept: */* s-1 | Host: s s-1 | User-Agent: curl/8.10.1 s-1 | X-Forwarded-For: 192.168.0.1, 192.168.0.3 s-1 | n2-1 | 192.168.0.1 - - [04/Oct/2024:03:32:39 +0000] "GET / HTTP/1.0" 200 19 "-" "curl/8.10.1" "192.168.0.1" n1-1 | 192.168.0.1 - - [04/Oct/2024:03:32:39 +0000] "GET / HTTP/1.1" 200 19 "-" "curl/8.10.1" "-" s-1 | GET / HTTP/1.0 s-1 | Connection: close s-1 | Accept: */* s-1 | Host: s s-1 | User-Agent: curl/7.88.1 s-1 | X-Forwarded-For: 127.0.0.1, 192.168.0.3 s-1 | n2-1 | 127.0.0.1 - - [04/Oct/2024:03:32:39 +0000] "GET / HTTP/1.0" 200 19 "-" "curl/7.88.1" "127.0.0.1" n1-1 | 127.0.0.1 - - [04/Oct/2024:03:32:39 +0000] "GET / HTTP/1.1" 200 19 "-" "curl/7.88.1" "-" ``` 2 `/` requests from the same end user IP (the second request blocks): ```auto $ curl -sSv localhost:8080; curl -sSv localhost:8080 s-1 | GET / HTTP/1.0 s-1 | Connection: close s-1 | Accept: */* s-1 | Host: s s-1 | User-Agent: curl/8.10.1 s-1 | X-Forwarded-For: 192.168.0.1, 192.168.0.3 s-1 | n2-1 | 192.168.0.1 - - [04/Oct/2024:03:32:58 +0000] "GET / HTTP/1.0" 200 19 "-" "curl/8.10.1" "192.168.0.1" n1-1 | 192.168.0.1 - - [04/Oct/2024:03:32:58 +0000] "GET / HTTP/1.1" 200 19 "-" "curl/8.10.1" "-" n2-1 | 2024/10/04 03:32:58 [warn] 31#31: *7 delaying request, excess: 0.999, by zone "one", client: 192.168.0.1, server: , request: "GET / HTTP/1.0", host: "n2" s-1 | GET / HTTP/1.0 s-1 | Connection: close s-1 | Accept: */* s-1 | Host: s s-1 | User-Agent: curl/8.10.1 s-1 | X-Forwarded-For: 192.168.0.1, 192.168.0.3 s-1 | n2-1 | 192.168.0.1 - - [04/Oct/2024:03:33:03 +0000] "GET / HTTP/1.0" 200 19 "-" "curl/8.10.1" "192.168.0.1" n1-1 | 192.168.0.1 - - [04/Oct/2024:03:33:03 +0000] "GET / HTTP/1.1" 200 19 "-" "curl/8.10.1" "-" ``` 2 `/unlim` requests: ```auto $ curl -sSv localhost:8080/unlim; curl -sSv localhost:8080/unlim n1-1 | 192.168.0.1 - - [04/Oct/2024:03:33:14 +0000] "GET /unlim HTTP/1.1" 200 12 "-" "curl/8.10.1" "-" n2-1 | 192.168.0.1 - - [04/Oct/2024:03:33:14 +0000] "GET /unlim HTTP/1.0" 200 12 "-" "curl/8.10.1" "192.168.0.1" n2-1 | 192.168.0.1 - - [04/Oct/2024:03:33:14 +0000] "GET /unlim HTTP/1.0" 200 12 "-" "curl/8.10.1" "192.168.0.1" n1-1 | 192.168.0.1 - - [04/Oct/2024:03:33:14 +0000] "GET /unlim HTTP/1.1" 200 12 "-" "curl/8.10.1" "-" ``` _ **this logic can be applied to non-docker nginx also.** _ ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [October 11, 2024, 5:13am UTC](https://forum.hhf.technology/t/how-to-do-nginx-rate-limiting-behind-cloudflare-on-docker/167/2 "2024-10-11T05:13:49Z")
_ **nginx cloudflare** _ ```nginx #CloudFlare set_real_ip_from 103.21.244.0/22; set_real_ip_from 103.22.200.0/22; set_real_ip_from 103.31.4.0/22; set_real_ip_from 104.16.0.0/12; set_real_ip_from 108.162.192.0/18; set_real_ip_from 141.101.64.0/18; set_real_ip_from 162.158.0.0/15; set_real_ip_from 172.64.0.0/13; set_real_ip_from 173.245.48.0/20; set_real_ip_from 188.114.96.0/20; set_real_ip_from 190.93.240.0/20; set_real_ip_from 197.234.240.0/22; set_real_ip_from 198.41.128.0/17; set_real_ip_from 199.27.128.0/21; set_real_ip_from 2400:cb00::/32; set_real_ip_from 2606:4700::/32; set_real_ip_from 2803:f800::/32; set_real_ip_from 2405:b500::/32; set_real_ip_from 2405:8100::/32; # Jurus terakhir kalau cloudflare ganti IP ! # https://www.cloudflare.com/ips-v4 #set_real_ip_from 0.0.0.0/0 real_ip_header CF-Connecting-IP; # Conection Limit # http://serverfault.com/questions/177461/how-to-rate-limit-in-nginx-but-including-excluding-certain-ip-addresses # http://gadelkareem.com/2015/01/18/limiting-connections-requests-wordpress-nginx/ geo $whitelist { default 0; # CIDR in the list below are not limited ( 1 ) 127.0.0.1/32 1; } map $whitelist $limit { 0 $binary_remote_addr; 1 ""; } # The directives below limit concurrent connections from a # non-whitelisted IP address to five limit_conn_zone $limit zone=conlimit:30m; limit_conn_zone $limit zone=conlimit_php:30m; limit_conn conlimit 40; limit_conn_log_level warn; # logging level when threshold exceeded limit_conn_status 503; # the error code to return # Limit Req Non - PHP limit_req_zone $limit zone=reqlimit:30m rate=5r/s; limit_req zone=reqlimit burst=10; # Limit Req PHP limit_req_zone $limit zone=reqlimit_php:30m rate=1r/s; limit_req_log_level warn; limit_req_status 503; # Location VirtualHost limit_req zone=reqlimit_php burst=4; limit_conn conlimit_php 10; ```