GCE部署Apache站点遭疑似防火墙拦截：OneSignal通知引发问题

Hey there, let's break this down for you — this is almost certainly Google Cloud's security protections kicking in due to rate limits. GCE comes with basic DDoS protection enabled by default, and if you're using Cloud Armor, custom security policies might also be flagging your high-volume OneSignal requests as potential HTTP flood attacks. When you cross that 1000 requests/minute threshold, the system temporarily blocks inbound connections on ports 80/443 before auto-recovering after a few minutes.

Here's how to diagnose and fix this:

1. First, confirm what's causing the block #

Start by pinpointing which security layer is triggering the intercept:

• Check Cloud Logging (formerly Stackdriver) for firewall or security policy logs, searching for keywords like blocked, rate limit exceeded, or security policy. Use this gcloud command to quickly pull relevant logs:

  gcloud logging read "resource.type=gce_instance AND logName=projects/[你的项目ID]/logs/compute.googleapis.com%2Ffirewall" --limit=100 --order=desc
  

  Replace [你的项目ID] with your actual project ID — the logs will show if Cloud Armor or GCE's built-in DDoS protection is behind the blocks.

2. Adjust Cloud Armor security policies (if you're using it) #

If your instance is linked to a Cloud Armor policy, tweak the rate-limiting rules:

• Head to the Cloud Armor page in the Google Cloud Console, find your associated security policy;
• Raise the request-per-minute threshold to match your business needs (e.g., 2000+ requests/minute);
• For a more precise fix: only relax limits for OneSignal's trusted IPs. Grab the official list of OneSignal service IPs, create an allow rule for these addresses, and set a higher rate limit specifically for this rule. This keeps your overall security tight while accommodating legitimate traffic.

3. Optimize Apache's concurrent connection settings #

Apache's default config might not handle high request volumes well, leading to connection backlogs that worsen false positives:

• Edit Apache's main config file (usually /etc/apache2/apache2.conf or /etc/httpd/httpd.conf) and adjust these parameters:
  • MaxRequestWorkers: Set based on your server's CPU cores (e.g., 200-400 for a 4-core machine);
  • KeepAliveTimeout: Shorten idle connection timeouts to 5 seconds to free up resources;
  • MaxKeepAliveRequests: Limit each connection to 100 requests to prevent long-lived idle connections;
• Restart Apache to apply changes: sudo systemctl restart apache2

4. Use a load balancer to spread traffic #

If a single GCE instance can't handle the load, deploy Google Cloud's HTTP(S) Load Balancer:

• Add multiple GCE instances to a backend service, so the load balancer distributes OneSignal's requests across machines. This drops the request volume per instance below the triggering threshold;
• Load balancers also include more robust DDoS protection and traffic management, making them better suited for high-concurrency scenarios.

5. Reach out to Google Cloud Support for deep troubleshooting #

If none of the above fixes work, or you're unsure which rule is causing the block, submit a support ticket:

• Include your project ID, instance details, request volume metrics, and relevant Cloud Logging snippets;
• Google's engineers can verify if this is a false positive and help adjust protection policies to fit your use case.

内容的提问来源于stack exchange，提问作者Dragos