Rate-limit the addresses in a list
Create a network list and a firewall rule that holds each client in it to a request rate, in Azion Console, the Azion CLI, or the API.
You can hold the clients in a network list to a request rate from Azion Console, the Azion CLI, or the API. The rule sets no limit on any client outside the list. One firewall rule pairs the Network criterion, which reads the list, with the Set Rate Limit behavior. Use it when a set of addresses may keep using your application, but only at a pace the application can serve. To refuse those addresses instead of slowing them, refer to Block requests by IP, ASN, or country.
Prerequisites
Console
- A workload bound to a firewall. The rate-limit rule goes on that firewall.
- Network Shield on for that firewall, because the Network criterion comes from it. It starts on in every firewall and stays on until someone turns it off.
- An account that can sign in to Azion Console.
Create the list of addresses to limit
The addresses to limit go in a list of the ip_cidr type, shown as IP/CIDR in Azion Console. Its items are addresses and ranges, such as 203.0.113.0/24 and 198.51.100.7. The rule stores the ID of the list rather than its items. An address you add to the list or remove from it therefore changes which clients are limited, and the rule needs no edit. For every field and type a list accepts, refer to Network list fields and List types.
Console
To create the list in Azion Console:
Access Azion Console > Edge Libraries > Network Lists.
In the General section, enter a Name. For example: Rate-limited addresses.
In the Network List Settings section, select IP/CIDR. When the form opens, ASN is the selected type.
In the List field, enter each address or range on its own line. For example: 203.0.113.0/24 and 198.51.100.7.
Select Save.
Azion Console confirms with the message Your network list has been created. The list Rate-limited addresses then appears in Network Lists.
Create the rule that rate-limits the list
The rule joins the Network criterion, with its matches operator, to the Set Rate Limit behavior. Only a client in the list makes that criterion true, so only those clients are limited. A request from any other client leaves the criterion false: the rule runs nothing, and the firewall goes on to its next rule. The behavior in this guide allows each client IP address an average of 10 requests per second, with a burst of 10. Set Rate Limit is a behavior of Firewall itself, and Network Shield adds only the criterion. For what each field of the behavior counts, refer to Set Rate Limit.
Console
To create the rule that rate-limits the list in Azion Console:
Access Azion Console > Secure > Firewalls, and select the firewall.
Azion Console opens the Create Rule drawer.
In the General section, enter a Name. For example: Rate-limit listed addresses.
In the Criteria section, select the Network variable and the matches operator.
A variable that reads Network - required Network Shield means that Network Shield is off on this firewall. Turn it on in Main Settings > Modules and save the firewall, and the variable becomes selectable.
In the Select a Network dropdown, select the list of addresses to limit. For example: Rate-limited addresses.
In the Behaviors section, select Set Rate Limit. Rate Limit Type starts at Req/s and Limit By at Client IP address. Keep both values.
In Average Rate Limit, enter 10.
In Maximum Burst Size, enter 10.
Select Save.
Azion Console confirms with the message Rule successfully created. In the Rules Engine tab, the Status column of the rule reads Active.
Confirm that the rate limit applies to listed clients
A rule you add can take from 6 minutes 29 seconds to 9 minutes 18 seconds to reach traffic across Azion’s distributed infrastructure. Until it does, the rule limits no client. Send the requests again until they answer as expected.
Set Rate Limit does not refuse a request over the rate at once. For example, take a rule with a rate of one request per second and a burst of 1. Requests that match it one after another are each held about one second, then served. Only concurrent requests beyond the burst receive 429. A check that sends one request at a time can therefore get no 429 at all. For how the burst queues requests, refer to Rate limits.
A refused request from a listed client receives HTTP 429 and Azion’s default error page, headed Too Many Requests. No rate-limit header comes back, so the client gets no signal of when to retry. The response looks like this:
The rule limits whichever clients the list holds when a request arrives. A change to the items of the list reaches traffic in 46 seconds to about 100 seconds, sooner than a rule you add. Until it settles, answers can switch between the old items and the updated ones. Repeat a request until the answers agree.