Recently i’ve searched a way to do rate-limiting in HAProxy based on multiple client identifiers.
The standard example you can find in the docs or in many tutorials is to track on “src” (source ip). Track on “src” is fine in most cases, but can be a problem if users are behind NAT/mobile gateways where many clients share the same ip address.
Therefore, i would like to combine (concatenate) Source IP + User-Agent or X-Forwarded-For + User-Agent and track on this new “identifier”.
There isn’t a builtin method or sample fetch at the moment in HAProxy which combine multiple variables (besides something as base32+src).
I need to track in a frontend because the client should be rate-limited globally (in all backends).
The following is an example if you need to track on the concatenated header in a frontend (currently, a header which is set by “http-request” is available to ACL’s in the same frontend, but not to the tracking/stick-table functionality. Therefore a “workaround” is needed (HAProxy 1.5)).
frontend http_in bind 0.0.0.0:80 http-request set-header X-Concat %[req.fhdr(User-Agent)]_%[src] default_backend forwarder backend forwarder server localhost 127.0.0.1:4444 send-proxy frontend http_in_local bind 127.0.0.1:4444 accept-proxy stick-table type string len 180 size 32m expire 5m store http_req_rate(10s) tcp-request inspect-delay 5s tcp-request content track-sc0 req.fhdr(X-Concat) if HTTP default_backend webnodes backend webnodes server apache01 192.168.100.50:80 check inter 2s rise 2 fall 2 maxconn 20 weight 50
Checking stick-table entries:
# echo "show table http_in_local" | socat stdio /run/haproxy/admin.sock
In HAProxy 1.6, you don’t need the workaround any more:
frontend http_01 . . . http-request track-sc0 req.fhdr(X-Concat)
HAProxy is very powerful and flexible, you can combine any possible sample fetches and use these for tracking. See HAProxy docs for all available fetches.