HTTP Rate Limit Middleware Client Identification and Replica Scaling

Answer to the Core Questions

1. Distributed state support
Traefik’s rate‑limit middleware can operate in a distributed mode when you are running v2.5 or newer. In this mode you configure an external Redis or Memcached store; all replicas share the same token bucket, so the global limit is enforced across the cluster.

2. Client identification behind a proxy
By default the sourceCriterion uses the request’s source IP. If an upstream proxy rewrites that IP, Traefik will see the proxy’s IP unless you enable the forwardedHeaders middleware and trust the proxy’s X‑Forwarded‑For or X‑Real‑IP headers. When properly configured, the rate limit key will be the original client IP, not the proxy’s.

Confirming Your Current Setup

1. Check Traefik version:

   traefik --version

2. Inspect the dynamic configuration for a rateLimit block. If it contains a redis or memcached subsection, distributed mode is already enabled.
3. Verify that the router uses a forwardedHeaders middleware with a trustedIPs list that includes your load balancer’s IP range.

Enabling Distributed Rate‑Limit (If Needed)

1. Create a Redis or Memcached instance reachable by all Traefik replicas.
2. Add a rateLimit middleware with a distributed configuration, e.g.:

   http:
     middlewares:
       rl-global:
         rateLimit:
           average: 100
           burst: 200
           redis:
             address: "redis://redis:6379"
             key: "traefik:rateLimit"
   

3. Apply the middleware to the routers that need global limits.

Configuring Forwarded Headers for Accurate Client IPs

1. Define a forwardedHeaders middleware:

   http:
     middlewares:
       fh-proxy:
         forwardedHeaders:
           trustedIPs:
             - "10.0.0.0/24"
   

2. Attach it before the rate‑limit middleware in the chain.
3. Ensure the upstream proxy sends X‑Forwarded‑For or X‑Real‑IP headers with the original client IP.

What to Check If Results Don’t Match Expectations

• Is the Traefik version ≥ 2.5?
• Is the external store (Redis/Memcached) reachable and healthy?
• Are the trustedIPs correctly covering the load balancer?
• Do you see the same token bucket counter in the Redis/Memcached metrics across replicas?

Next Diagnostic Step

If you are unsure about the Traefik version, run traefik --version and share the output. This will determine whether distributed mode is available and guide the configuration steps accordingly.