Traefik proxy | Can this plugin be installed for free?

[dberardo-com]

or does it work only for Enterprise versions of Traefik?

Is installation procedure the same?

[tomMoulard]

Can this plugin be installed for free?

yes

does it work only for Enterprise versions of Traefik?

no

Is installation procedure the same?

yes

[tomMoulard]

For now, the plugin only looks at the request's RemoteAddr, it might be interesting to look at the X-Forwarded-For header like in the rate limit's ip strategy source criterion.

[dberardo-com]

ok, so it seems that exposing traefik via a LoadBalancer with the following option might do the trick: externalTrafficPolicy: Local would you agree?

[tomMoulard]

idk

[dberardo-com]

ok, we might wait for anyone else out there to confirm this theory then

[dberardo-com]

ref: traefik/traefik#9174 (comment)

[dberardo-com]

also related to the setup/config procedure --> is fail2ban considering 5xx responses also as "failures" ? if so, it is possible to restrict to only 4xx return codes, ignoring 5xx ?

[tomMoulard]

Sure, we can add a mechanism to filter only for a given http code range, but I do not see a real use case. Why do you want to filter out 5XX codes when a potential user could use this as a way to DOS your backend server

[tomMoulard]

This could be linked to #40

[dberardo-com]

well for such kind of user i would prefer to use a rate limiting rule. i guess this is also possible with fail2ban, isnt it ? otherwise will use the regular built-in rate limiter from traefik

[tomMoulard]

I don't think that this plugin is ment to be a rate limiter, and I do not see how you would apply a rate limiter using Traefik on 5XX error codes. Traefik's rate limiting is only based on the number of concurrent requests. It is not based on the status code of the request.

[dberardo-com]

well i would apply a rate limiter regardless of the response code, so this should prevent DOS in any case. again, this is only one specific optional behavior that i need to apply on some service that might return 5xx due to some conditions, so will not be the default. thanks for providing the link to the other issue, i will investigate