Behind Bunkerweb WAF: reasonable rate limits?

[ppenguin]

I'm running VW behind a bunkerweb WAF, which has pretty strict default rate limits so I hit 429's very fast when using the web interface (haven't tried apps yet).

What would be reasonable values (e.g. in req/min) that wouldn't trigger limits during normal usage but still be strict against brute force attacks? And should I differentiate between URLs/queries (e.g. API vs FE?)

[BlackDex]

I think that is very different per setup. Just check your limits and adjust where needed. It depends on usage, users amount of clients etc...

Though i think putting a limit on all the api calls is a bit too much. On login is probably just fine

[ppenguin]

bunkerweb's default limit on / is 2r/s, but I could of course just set that for /login (or maybe e.g. 3r/m) and set the default to a high value...

Oh wait, it seems the issue is I get too many redirects (301) on the default route (/). Did I do something wrong? I've set the env DOMAIN="https://vw.mydomain.net" but it behaves the same when unset.

[BlackDex]

You might have a missing or added / at the end of the path or domain in your proxy config.

[ppenguin]

Thanks, I added a / and turned of Cloudfare DNS proxy, that seems to help (at least with Firefox, Chrome seems a bit stubborn, even though it doesn't show cookies). (I know, don't change 2 things at the same time, but I got too impatient 😉 )

EDIT: indeed: the issue was the one reported here: https://developers.cloudflare.com/ssl/troubleshooting/too-many-redirects/ (and the redirects in turn triggered rate limits)