Can I limit the number of connections a single IP address can open (Source IP Connection Protection)?

Short answer

Yes. In Bot/DDoS protection, the Source IP Connection Protection block of L7 DDoS Protection counts the new connections that a single source address opens in a time window and applies the Limit Action when the Connection Limit is exceeded. The defaults are 100 connections in a 10-second window and Silent Drop; the block is on by default, but since L7 DDoS Protection starts in Monitor mode, the enforcement is applied only when the protection is set to Active. What is counted is not the number of connections open at that moment but the number of connections opened within the window. If the optional Hard Ceiling (Quarantine) is defined, a source that exceeds the ceiling is taken into the penalty box. The block works on HTTP and L7 TCP vServices; on L7 TCP the action is limited to Silent Drop.

Problem: A Connection Flood from a Single Source

Some clients consume resources not by sending many requests but by opening many connections: a TLS handshake, memory and a session record are spent for each connection. In this situation, vService-wide limits take effect late or also affect legitimate users; to single out a single source and stop only that one, a counter per source address is needed.

Solution

Source IP Connection Protection

• How it works Each source address carries its own counter. Each new connection is counted once; subsequent requests that come over the same connection (keep-alive, HTTP/2) do not increase the counter. When the counter exceeds the Connection Limit within the Time Window, only that source is met with the Limit Action.
• Where it is openedBot/DDoS Management → L7 DDoS Protection card → pencil icon of the Source IP Connection Protection block
• Requirement Bot/DDoS protection being on for the vService; for enforcement, L7 DDoS Protection being in Active mode
• vService type HTTP and L7 TCP (on L7 TCP the action is only Silent Drop)
• Evaluation order The first match wins: if a request has been decided in a block further above, this block does not produce an enforcement for that request (block order)

Step-by-Step Configuration

1

Adım 1 Open the Bot/DDoS Management tab

The Left Monitor Panel is opened, the vService is clicked in the Bot/DDoS Protected vServices tab, and the Bot/DDoS Management tab is opened.

2

Adım 2 Open the edit window of the block

The pencil icon at the top right of the Source IP Connection Protection block in the body of the L7 DDoS Protection card is clicked; the Edit - Source IP Connection Protection window opens (Edit screen).

3

Adım 3 Verify that the block is on

The Source IP Connection Protection switch at the top must be on (default: on). While it is off, the other fields are hidden.

4

Adım 4 Enter the window and the limit

The Time Window is entered as a number and a unit (default 10 seconds; at least 1 second, at most 1 hour). In the Connection Limit field, the number of connections that a single address can open within the window is written as an integer (default 100). The block is triggered when the counter exceeds this value.

5

Adım 5 Select the Limit Action

On an HTTP vService, Silent Drop (default), Block, Tarpit, Redirect, Show Content or Show Captcha is selected; this block has no Quarantine option. The Response Status Code (default 403) is entered for Block and Tarpit, the redirect address and code for Redirect, and the content page and status code for Show Content. On an L7 TCP vService, only Silent Drop is offered.

6

Adım 6 Define the hard ceiling (optional)

If a harder second tier is wanted, Hard Ceiling (Quarantine) is turned on; the field is filled with twice the default limit of the block (200), and the value needed is written manually. The action of the ceiling cannot be selected; it is always Quarantine. While the ceiling is on, the Limit Action works only between the limit and the ceiling; a source that exceeds the ceiling is met with the duration and action on the Quarantine card (default 30 minutes, Silent Drop).

7

Adım 7 Save

The sentence at the bottom of the window is read as it will appear on the card (if traffic from any single IP exceeds <limit> connections in <window>, <action>), and the Edit button is clicked. There is no separate deployment step.

8

Adım 8 Set the protection to Active

In the window opened with the Edit link in the header of the L7 DDoS Protection card, the DDoS Protection field is set to Active and saved with the Edit button. Since this field moves all the L7 DDoS blocks to enforcement together, the limits of the other blocks are also reviewed first. Until the limit is verified, the protection can be left in Monitor mode.

Verification

1Connection load per sourceTR7 side

In the Source IP Statistics section of the vService's Live Stats tab, the Peak Conn/IP (10s) and P95 Conn/IP (10s) cards are checked; the limit is selected according to these values.

ExpectedIn legitimate traffic, the P95 value is clearly below the limit

The cards measure in a fixed ten-second window; if the limit window is different from 10 seconds, the values are read proportionally.

2Event Logs rowTR7 side

In the vService's Event Logs tab, the row of the source that exceeds the limit is opened; DDoS Rule and Trigger (value / limit) are read on the L7 DDoS tab of the preview.

ExpectedDDoS Rule: Source IP Connection Rate · Action: Silently dropped (in Monitor: Would silently drop · Monitor)

When the Hard Ceiling is exceeded, the → Quarantined (DDoS limit) suffix is added to the end of the Action text.

Common Mistakes

• Mistaking the block for a concurrent connection limit. The block counts not the connections open at that moment but the new connections opened within the window. A client that keeps a few long-lived connections open is not caught by the limit; a client that opens many connections at short intervals is caught.
• Configuring the limit and leaving the protection in Monitor. In Monitor mode the counter works and events are written, but no connection is stopped; the Hard Ceiling tier also works only in Active mode.
• Not taking users behind NAT into account. Corporate networks and mobile operators can send many users out from a single address. These sources are exempted with DDoS Whitelist Entries, or the limit is selected accordingly.
• Assuming that search engine bots are exempt on their own. The Trust Verified Bots setting of L7 DDoS Protection is off by default; when it is turned on, verified bots are exempted from the source-based blocks.
• Confusing it with the vService-wide limit. The total connection rate of all clients is limited with Total Connection Protection; that block measures not a single source but the whole vService.

How it is done in the documentation

• Source IP Connection Protection · What Is Source IP Connection Protection?
• Source IP Connection Protection · The Source IP Connection Protection Edit Screen
• L7 DDoS Protection · In Which Order Are the Blocks Evaluated?
• L7 DDoS Protection · The Default Values

Related questions

• Can I take automatic action when the number of requests / connections suddenly increases?
• Can I do rate limiting (X requests per second per IP)?
• What is the difference between the Off, Monitor and Active modes of Bot/DDoS protection; is traffic blocked as soon as I enable it?
• How do I see the clients in quarantine?