ratelimit

README

ratelimit

Description

The ratelimit plugin enables response rate limiting to mitigate DNS attacks.

Syntax

ratelimit LIMIT

• LIMIT the amount of responses-per-second allowed from an IP.

ratelimit LIMIT {
    whitelist [IPs...]
}

• whitelist the list of IPs exluded from rate limit.

Metrics

If monitoring is enabled (via the prometheus plugin) then the following metric are exported:

• coredns_ratelimit_dropped_request_total{server} - count per server

Examples

ratelimit 50 {
    whitelist 127.0.0.1 192.168.1.25 10.240.1.1
}

Documentation

Index

• Variables
• type RateLimit
  • func (rl *RateLimit) Name() string
  • func (rl *RateLimit) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error)

Variables

var (
	DropCount = promauto.NewCounterVec(prometheus.CounterOpts{
		Namespace: plugin.Namespace,
		Subsystem: pluginName,
		Name:      "dropped_request_total",
		Help:      "Counter of requests dropped because of ratelimit.",
	}, []string{"server"})
)

Types

type RateLimit

type RateLimit struct {
	Next plugin.Handler
	// contains filtered or unexported fields
}

RateLimit is a plugin that implements response rate limiting using a token bucket algorithm.

func (*RateLimit) Name

func (rl *RateLimit) Name() string

Name implements the plugin.Handler interface.

func (*RateLimit) ServeDNS

func (rl *RateLimit) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error)

ServeDNS implements the plugin.Handler interface.