title: How to deny ip address automatically by parsing nginx log file
body: <p>I have 4 webservers behind cloudflare and a loadbalancer, nginx is the webserver, php-fpm manages the php pages. I don't know how to block a simple dos attack ... </p>
  
  <p>I'm able to detect this attack by using the http_limit_req module from nginx 
  <a href="http://wiki.nginx.org/HttpLimitReqModule" rel="nofollow">http://wiki.nginx.org/HttpLimitReqModule</a></p>
  
  <p>but this is not blocking the attack at all, yes this can mitigate but webservers are hit and hit again, and php-fpm goes to 80% and in a minute the website is unreachable.</p>
  
  <p>I'm trying to find a way to block this kind of request.</p>
  
  <p>I know how to block certain ip address or certain useragent with nginx but i want to do it automatically. I think that I cannot block the ip with iptables because the request come from the loadbalancer :( but i'm still able to detect the correct ip address with the set_real_ip_from and real_ip_header X-Forwarded-For with nginx.</p>
  
  <p>I have the log file (error.log) filled with the correct ip address as you can see:</p>
  
  <p>2012/03/27 18:34:02 [error] 31234#0: *1283 limiting connections by zone "staging", client: XX.XX.XX.XXX, server: www.xxxxxxx.com, request: "HEAD /it HTTP/1.1", host: "www.xxxxxxx.com"</p>
  
  <p>Someone have an idea and can teach me how to block automatically this ip?</p>