# Rate limit errors although IP is whitelisted
**URL:** https://meta.discourse.org/t/rate-limit-errors-although-ip-is-whitelisted/233656
**Category:** Self-hosting
**Created:** [July 22, 2022, 1:39pm UTC](https://meta.discourse.org/t/rate-limit-errors-although-ip-is-whitelisted/233656 "2022-07-22T13:39:48Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@sithmein](https://meta.discourse.org/u/sithmein)
#### Post date: [July 22, 2022, 1:39pm UTC](https://meta.discourse.org/t/rate-limit-errors-although-ip-is-whitelisted/233656/1 "2022-07-22T13:39:48Z")
We are using Discourse in a Docker container. We have rate limits set up with a whitelisted IP. However, we are still getting rate limit errors when making requests from that IP. I’m pretty sure the nginx configuration is correct, here is how it looks:
```plaintext
geo $limit {
default 1;
1.1.1.1 0; # not the real IP
}
map $limit $limit_key {
0 "";
1 $binary_remote_addr;
}
limit_req_zone $limit_key zone=flood:10m rate=12r/s;
limit_req_zone $limit_key zone=bot:10m rate=200r/m;
limit_req_status 429;
limit_conn_zone $limit_key zone=connperip:10m;
limit_conn_status 429;
...
location @discourse {
limit_conn connperip 20;
limit_req zone=flood burst=12 nodelay;
limit_req zone=bot burst=100 nodelay;
...
}
```
nginx is configured to log an error in case a rate limit has been reached and we are indeed seeing some log message - but none from the whitelisted IP. Still we are getting tons of 429 when making requests from the whitelisted IP. The request URLs are user profiles (e.g. `/users/foo.json`). Is there some kind of rate limit in Discourse itself?
---
### Author:  [@MrBuBBLs](https://meta.discourse.org/u/MrBuBBLs)
#### Post date: [September 12, 2022, 9:28am UTC](https://meta.discourse.org/t/rate-limit-errors-although-ip-is-whitelisted/233656/2 "2022-09-12T09:28:38Z")
Hi there, Nginx is indeed managing rate limiting as you stated but Discourse also has it’s own way to manage rate limiting at application level. Sam has an interesting piece on this :
> [@Available settings for global rate limits and throttling](https://meta.discourse.org/t/configure-global-rate-limits-and-throttling/78612):
>
> Discourse ships with 3 different global rate limits that can be configured by site admins. Global per-ip rate limits These limits apply to every unique IP address that hits the Discourse application. (files that are served directly from the filesystem or the CDN are excluded) By default this rate limit is enabled, you may disable it or set it to a reporting mode. DISCOURSE\_MAX\_REQS\_PER\_IP\_MODE : default block, this rate limit applies out of the box. (other options are warn, warn+block, and n…
The only thing I’m wondering is if we can indeed rate limit with exceptions (i.e. whitelist IPs through those rules). I’m still searching for a way to do this… 😅
---
### Author:  [@MrBuBBLs](https://meta.discourse.org/u/MrBuBBLs)
#### Post date: [September 12, 2022, 9:35am UTC](https://meta.discourse.org/t/rate-limit-errors-although-ip-is-whitelisted/233656/3 "2022-09-12T09:35:45Z")
Okay I think I’m onto something :
>
Maybe `DISCOURSE_MAX_REQS_PER_IP_EXCEPTIONS` might be just what we needed 😁
---
### Author:  [@Alex\_Bourge](https://meta.discourse.org/u/Alex_Bourge)
#### Post date: [November 10, 2022, 10:56pm UTC](https://meta.discourse.org/t/rate-limit-errors-although-ip-is-whitelisted/233656/4 "2022-11-10T22:56:14Z")
I, too, am hitting a rate limit of 60 calls to the API per minute which I cannot seem to alleviate. I’ve set all of these:
```plaintext
- DISCOURSE_MAX_REQS_PER_IP_MODE=none
- DISCOURSE_MAX_USER_API_REQS_PER_MINUTE=20000
- DISCOURSE_MAX_USER_API_REQS_PER_DAY=30000
- DISCOURSE_MAX_ADMIN_API_REQS_PER_MINUTE=20000
- DISCOURSE_MAX_REQS_PER_IP_PER_MINUTE=20000
- DISCOURSE_MAX_REQS_PER_IP_PER_10_SECONDS=2000
- DISCOURSE_MAX_ASSET_REQS_PER_IP_PER_10_SECONDS=2000
- DISCOURSE_SKIP_PER_IP_RATE_LIMIT_TRUST_LEVEL=0
- DISCOURSE_MAX_ADMIN_API_REQS_PER_KEY_PER_MINUTE=20000
- DISCOURSE_MESSAGE_BUS_MAX_BACKLOG_SIZE=1000
- DISCOURSE_MAX_REQS_PER_IP_EXCEPTIONS=....
```
I know it’s not nginx because I’m getting the " You’ve performed this action too many times" message, which means the Discourse RateLimiter is handling it.
Did you find a solution?