Comment on [PSA] Watch for the antiyanks troll and consider adjusting your rate limits

• Sal@mander.xyz ⁨2⁩ ⁨months⁩ ago

  Yes, I see this there. Most of the nginx config is from the ‘default’ nginx config in the Lemmy repo from a few years ago. My understanding is somewhat superficial - I don’t actually know where the variable ‘$proxy_add_x_forwarded_for’ gets populated, for example. I did not know that this contained the client’s IP.

      # backend
      location ~ ^/(api|pictrs|feeds|nodeinfo|.well-known) {
        proxy_pass http://0.0.0.0:8536/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
  
        # Rate limit
        limit_req zone=mander_ratelimit burst=30000 nodelay;
  
        # Add IP forwarding headers
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      }
  
  

  I need to do some reading 😁

  source

  • admiralpatrick@lemmy.world ⁨2⁩ ⁨months⁩ ago

    nginx.org/en/docs/…/ngx_http_proxy_module.html

    $proxy_add_x_forwarded_for is a built-in variable that either adds to the existing X-Forwarded-For header, if present, or adds the XFF header with the value of the built-in $remote_ip variable.

    The former case would be when Nginx is behind another reverse proxy, and the latter case when Nginx is exposed directly to the client.

    Assuming this Nginx is exposed directly to the clients, maybe try changing the bottom section like this to use the $remote_addr value for the XFF header. The commented one is just to make rolling back easier. Nginx will need to be reloaded after making the change, naturally.

         # Add IP forwarding headers
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header Host $host;
          # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-For $remote_addr;
    

    source

    • Sal@mander.xyz ⁨2⁩ ⁨months⁩ ago

      Thanks!

      I was able to crash the instance for a few minutes, but I think I have a better idea of where the problem is. Ths $emote_addr variable seems to work just the same.

      In the rate limit options there is a limit for ‘‘Message’’. Common sense tells me that this means ‘direct message’, but setting this to a low number is quite bad. While testing I eventually set it to ‘1 per minute’ and the instance became unresponsive until I modified the settings in the database manually. If I give a high number to this setting then I can adjust the other settings without problem.

      source

      • admiralpatrick@lemmy.world ⁨2⁩ ⁨months⁩ ago

        “Message” bucket is kind of a general purpose bucket that covers a lot of different endpoints. I had to ask the lemmy devs what they were back when I was adding a config section in Tesseract for the rate limits.

        These may be a little out of date, but I believe they’re still largely correct:

        Image

        source

        • -> View More Comments