Rate-limiting on my orange-clouded web-server

Zepsi_Zola · 2025-10-07T09:46:24.368Z

I have this basic web-server (HTTP) which is nginx reverse-proxied (HTTPS) and then orange-clouded via cloudflare. Everything's fine except for the fact that if I keep requesting data from a page on this web-server I eventually get rate-limited. I'm fairly sure this isn't from my nginx setup and certain it's not from the basic web-server, so now I'm wondering where/how cloudflare is rate-limiting this so that I can relax that rule.

S

SuperHelpflare•10/7/25, 9:46 AM

Support AI

Based on the provided documentation, it appears that Cloudflare's Rate Limiting is automatically identifying and mitigating excessive request rates for specific URLs or for an entire domain.

According to the documentation (https://developers.cloudflare.com/waf/reference/legacy/old-rate-limiting/), "Request rates are calculated locally for individual Cloudflare data centers. Once an individual IPv4 address or IPv6

/64

/64

/64

/64 IP range exceeds a rule threshold, further requests to the origin server are blocked with an

HTTP 429

HTTP 429

HTTP 429

HTTP 429 response status code."

To relax the rate limiting rule, you can try enabling Rate Limiting and adjusting the settings to suit your needs. You can do this by going to the Cloudflare dashboard and navigating to the "Firewall" tab, then clicking on "Tools" and selecting "Rate Limiting" (https://dash.cloudflare.com/?to=/:account/:zone/firewall/tools).

Additionally, you can refer to the documentation on how Cloudflare determines the request rate (https://developers.cloudflare.com/waf/rate-limiting-rules/request-rate/) to help you define the best rate limiting setting for your use case.

Please note that the documentation mentions that Cloudflare is upgrading all rate limiting rules to a new version, so you may want to check the upgrade guide (https://developers.cloudflare.com/waf/reference/legacy/old-rate-limiting/upgrade/) for more information on what changed in the new version.

Sources

This is an AI generated response, it may not be 100% accurate. Please validate the output. You can ask followups by replying to this message or mentioning me.

Original message was deleted

Z

Zepsi_ZolaOP•10/7/25, 9:49 AM

You sure?

Original message was deleted

Z

Zepsi_ZolaOP•10/7/25, 9:50 AM

You dealt with this before? This is my nginx configuration for the reverse-proxy

server {
  server_name stats.domain.com;
 
  location / {
    proxy_pass http://0.0.0.0:12345;
  }
 
  listen 443 ssl; # managed by Certbot
  ssl_certificate /etc/letsencrypt/live/stats.domain.com/fullchain.pem; # managed by Certbot
  ssl_certificate_key /etc/letsencrypt/live/stats.domain.com/privkey.pem; # managed by Certbot
  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
 
  # Cloudflare Real IP Configuration
  include /etc/nginx/cloudflare-ips.conf;
  real_ip_header CF-Connecting-IP;
}
 
server { # PLAN STUFF
  if ($host = stats.domain.com) {
    return 301 https://$host$request_uri;
  } # managed by Certbot
  server_name stats.domain.com;
  listen 80;
  listen [::]:80;
  return 404; # managed by Certbot
}

server {
  server_name stats.domain.com;
 
  location / {
    proxy_pass http://0.0.0.0:12345;
  }
 
  listen 443 ssl; # managed by Certbot
  ssl_certificate /etc/letsencrypt/live/stats.domain.com/fullchain.pem; # managed by Certbot
  ssl_certificate_key /etc/letsencrypt/live/stats.domain.com/privkey.pem; # managed by Certbot
  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
 
  # Cloudflare Real IP Configuration
  include /etc/nginx/cloudflare-ips.conf;
  real_ip_header CF-Connecting-IP;
}
 
server { # PLAN STUFF
  if ($host = stats.domain.com) {
    return 301 https://$host$request_uri;
  } # managed by Certbot
  server_name stats.domain.com;
  listen 80;
  listen [::]:80;
  return 404; # managed by Certbot
}

server {
  server_name stats.domain.com;
 
  location / {
    proxy_pass http://0.0.0.0:12345;
  }
 
  listen 443 ssl; # managed by Certbot
  ssl_certificate /etc/letsencrypt/live/stats.domain.com/fullchain.pem; # managed by Certbot
  ssl_certificate_key /etc/letsencrypt/live/stats.domain.com/privkey.pem; # managed by Certbot
  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
 
  # Cloudflare Real IP Configuration
  include /etc/nginx/cloudflare-ips.conf;
  real_ip_header CF-Connecting-IP;
}
 
server { # PLAN STUFF
  if ($host = stats.domain.com) {
    return 301 https://$host$request_uri;
  } # managed by Certbot
  server_name stats.domain.com;
  listen 80;
  listen [::]:80;
  return 404; # managed by Certbot
}

server {
  server_name stats.domain.com;
 
  location / {
    proxy_pass http://0.0.0.0:12345;
  }
 
  listen 443 ssl; # managed by Certbot
  ssl_certificate /etc/letsencrypt/live/stats.domain.com/fullchain.pem; # managed by Certbot
  ssl_certificate_key /etc/letsencrypt/live/stats.domain.com/privkey.pem; # managed by Certbot
  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
 
  # Cloudflare Real IP Configuration
  include /etc/nginx/cloudflare-ips.conf;
  real_ip_header CF-Connecting-IP;
}
 
server { # PLAN STUFF
  if ($host = stats.domain.com) {
    return 301 https://$host$request_uri;
  } # managed by Certbot
  server_name stats.domain.com;
  listen 80;
  listen [::]:80;
  return 404; # managed by Certbot
}

Original message was deleted

Z

Zepsi_ZolaOP•10/7/25, 10:51 AM

You sure?

Z

Zepsi_ZolaOP•10/7/25, 10:52 AM

It is

Z

Zepsi_ZolaOP•10/7/25, 10:52 AM

But it's still a rate-limit thing

Z

Zepsi_ZolaOP•10/7/25, 10:55 AM

I think it might have since the web-page/web-app was just showing the response from the web-server after I did an endpoint request

Rate-limiting on my orange-clouded web-server

Similar Threads

Similar Threads

Similar Threads