如何使用 Iptables 设置对 API 的访问速率限制？
如何使用 Iptables 设置对 API 的访问速率限制。尝试使用端口 80 设置限制，但我不想完全设置网络访问限制。有没有办法指定子域而不是端口。示例：将速率限制设置为 api.example.com 而不是 example.com？
如果无法按子域设置速率限制，那么在不冒阻止合法 Web 用户的风险的情况下，建议对端口 80 的访问速率限制是多少？每秒一个连接就足够了吗？
How can you set rate limit access to API using Iptables. Tried to set limit using port 80, but I don't want to set limit to the web access entirely. Is there a way to specified a subdomain rather than port. Example: set rate limit to api.example.com not example.com?
If there is no way to set rate limit by subdomain, what is the suggested rate limit access to port 80 without risking blocking a legitimate web user? One connection per second would be enough?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
顾名思义，iptables 使用 IP 地址。因此，如果您的
api.example.com解析为与www.example.com不同的 IP 地址，那么您可以根据这些 IP 地址进行过滤。如果它们都解析为相同的 IP 地址，则您无法单独过滤它们。对于合法用户来说每秒一个连接仍然很低。当您下载页面时，不要忘记您还必须下载所有 .js、.css、.jpg 等文件，它们都来自同一个域。使用
Keep-Alive可以减少连接请求的数量，但您仍然会收到来自同一用户的至少两个（可能最多六个）同时请求（取决于他们的浏览器和配置）。如果这对您确实很重要，那么您应该为两个单独的子域设置唯一的 IP 地址并对其进行过滤。我个人认为在apache级别进行过滤比较合适。
As the name suggests, iptables works with IP addresses. So if your
api.example.comresolved to a different IP address thanwww.example.comthen you could filter based on those IP addresses. If they both resolve to the same IP address, then you can't filter them separately.One connection per second for legitimate users is still pretty low. When you download a page, don't forget that you also have to download all the .js, .css, .jpg, etc files and they'll all come from the same domain. With
Keep-Alivethat can reduce the number of connection requests, but you'll still have at least two, possibly up to six simultaneous request from the same user (depending on their browser and configuration).If this really is important to you, then you should set up unique IP addresses for your two separate subdomains and filter on that. Personally, I think filtering at the apache level is more appropriate.