Dynamic ISP Traffic Shaping & ASN-Based Rate Limiting with Nginx GeoIP2 in Pakistan

High-traffic eCommerce, banking, and public sector web services operating in Pakistan face a dual operational challenge:

1. Volatile Network Performance Across Diverse Domestic ISPs: End users arrive through very different broadband networks—ranging from high-speed enterprise fiber (such as Nayatel and StormFiber) to high-latency cellular 4G/5G connections (Jazz, Zong, Telenor, Ufone) and legacy DSL (PTCL). Applying a single, uniform HTTP rate limit across all clients unfairly throttles mobile users sharing Carrier-Grade NAT (CGNAT) gateway IPs while leaving servers vulnerable to distributed attacks.
2. Subnet-Level Layer 7 DDoS Floods: Coordinated botnets often originate from hijacked international IP ranges or proxy networks, overwhelming edge web application proxies and exhausting backend PHP-FPM or Node.js workers.

To solve both challenges simultaneously, modern Nginx architectures employ Autonomous System Number (ASN) Traffic Shaping via GeoIP2 (ngx_http_geoip2_module). By querying MaxMind’s GeoLite2-ASN database in memory at connection time, Nginx classifies incoming client requests by their upstream internet provider (e.g., AS17557 for PTCL, AS23901 for Nayatel, AS45669 for Jazz) and applies fine-grained bandwidth limits, custom request bursts, and priority fastpaths.

Deploying edge Nginx load balancers on high-bandwidth Dedicated Servers paired with low-latency Dedicated Servers in Pakistan empowers infrastructure teams to throttle malicious botnets while guaranteeing flawless, prioritized access for legitimate domestic Pakistani consumers.

---

1. Architectural Anatomy: Uniform vs ASN-Aware Rate Limiting

Standard Nginx rate limiting typically keys on $binary_remote_addr. In Pakistan, where millions of mobile 4G subscribers share a handful of public CGNAT pool addresses, standard IP rate limits create massive false positives:

Standard Uniform IP Limiting ($binary_remote_addr):
Mobile User 1 ──┐
Mobile User 2 ──┼──► [Jazz / Zong CGNAT Gateway: 103.255.x.x] ──► Nginx (10 req/s limit)
Mobile User 3 ──┘                                                    │
                                                                     ▼
                                                   [503 Service Temporarily Unavailable!]
(False positive: Legitimate customers blocked because they share one IP!)

Dynamic ASN-Aware Traffic Shaping:
Nayatel Fiber (AS23901) ──────► Priority Fastpath (250 req/s, Burst=100, 0s Delay)
PTCL / Jazz / Zong (Local ASNs) ──► CGNAT Smart Pool (Per-Device Cookie Limit + 60 req/s)
Untrusted Foreign / Proxy ASNs  ──► Aggressive Throttle (2 req/s, Challenge CAPTCHA)

---

2. Key Pakistani Telecom Autonomous System Numbers (ASNs)

To configure ASN routing rules, identify the dominant domestic Autonomous System Numbers in Pakistan:

Telecom / ISP Name	Autonomous System Number (ASN)	Network Characteristics
PTCL (Pakistan Telecommunication Co.)	AS17557	National backbone, DSL, corporate broadband
Nayatel (Pvt) Ltd	AS23901	Premium low-latency FTTH (Islamabad, Rawalpindi, Lahore, Faisalabad)
Jazz / VEON (PMCL)	AS45669	Pakistan’s largest mobile 4G/5G cellular network
Zong / CMPak Limited	AS38478	High-density 4G mobile broadband subscriber base
TransWorld Associates (TWA)	AS36107	International submarine cable transit & enterprise leased lines
StormFiber / Cybernet	AS9541	Major nationwide FTTH fiber broadband

---

3. Step 1: Installing and Configuring ngx_http_geoip2_module

Ensure Nginx is compiled with the GeoIP2 dynamic module and download the MaxMind ASN database:

# Verify module availability
nginx -V 2>&1 | grep -o 'ngx_http_geoip2_module'

# Place updated GeoLite2-ASN.mmdb into /etc/nginx/geoip/
mkdir -p /etc/nginx/geoip
# (Download GeoLite2-ASN.mmdb and GeoLite2-Country.mmdb to /etc/nginx/geoip/)

In your main /etc/nginx/nginx.conf, load the module and define ASN variables:

# /etc/nginx/nginx.conf
load_module modules/ngx_http_geoip2_module.so;

http {
    # Initialize GeoIP2 ASN Database
    geoip2 /etc/nginx/geoip/GeoLite2-ASN.mmdb {
        auto_reload 24h;
        $client_asn autonomous_system_number;
        $client_as_org autonomous_system_organization;
    }

    # Map ASN to traffic classification tiers
    map $client_asn $asn_tier {
        default             "external";
        
        # Premium Domestic FTTH (Tier 1 Priority)
        23901               "pk_premium";  # Nayatel
        9541                "pk_premium";  # Cybernet / StormFiber
        36107               "pk_premium";  # TransWorld

        # Major Domestic Telecoms (Tier 2 Standard)
        17557               "pk_telecom";  # PTCL
        45669               "pk_mobile";   # Jazz
        38478               "pk_mobile";   # Zong
        132144              "pk_telecom";  # NextGen Data Center Fabric
    }

    # Define dynamic rate limits based on classification tier
    map $asn_tier $tier_limit_key {
        "pk_premium"        "";            # No rate limiting for trusted fiber
        "pk_telecom"        $binary_remote_addr;
        "pk_mobile"         $binary_remote_addr;
        "external"          $binary_remote_addr;
    }
}

---

4. Step 2: Defining ASN-Aware Rate Zones and Traffic Shaping

In your virtual host configuration (/etc/nginx/conf.d/nextgen.pk.conf), define rate limiting zones that offer generous headroom for domestic subscribers while strictly choking unverified external ASNs:

# Define distinct rate limiting zones
limit_req_zone $binary_remote_addr zone=zone_mobile:20m rate=60r/s;
limit_req_zone $binary_remote_addr zone=zone_external:20m rate=5r/s;

# Dynamic bandwidth limit based on ASN
map $asn_tier $client_rate_limit {
    "pk_premium"        0;          # Unmetered wire speed
    "pk_telecom"        10m;        # 10 Mbps per stream
    "pk_mobile"         5m;         # 5 Mbps per stream (prevents bufferbloat)
    "external"          512k;       # 512 Kbps max for foreign/unverified ASNs
}

server {
    listen 443 ssl http2;
    server_name nextgen.pk;

    # Apply dynamic bandwidth shaping
    limit_rate $client_rate_limit;

    location / {
        # Conditional rate limiting based on mapped ASN tier
        set $apply_limit "";
        if ($asn_tier = "external") {
            set $apply_limit "EXT";
        }
        if ($asn_tier = "pk_mobile") {
            set $apply_limit "MOB";
        }

        # Apply appropriate rate zone
        limit_req zone=zone_external burst=10 nodelay;
        
        proxy_pass http://backend_pool;
        proxy_set_header X-Client-ASN $client_asn;
        proxy_set_header X-Client-Org $client_as_org;
        proxy_set_header Host $host;
    }
}

---

5. Telemetry and Traffic Analysis

Add the ASN and provider organization directly into the Nginx custom access log format to monitor real-time traffic distributions:

log_format asn_combined '$remote_addr - [$time_local] "$request" '
                        '$status $body_bytes_sent '
                        'ASN: AS$client_asn ($client_as_org) '
                        'Tier: $asn_tier ReqTime: $request_time';

access_log /var/log/nginx/access_asn.log asn_combined;

Inspect live traffic in the terminal:

tail -f /var/log/nginx/access_asn.log | grep -E "AS17557|AS23901|AS45669"

Sample output:

39.40.12.18 - [01/Oct/2026:15:10:02 +0500] "GET /api/products HTTP/2.0" 200 4821 ASN: AS17557 (Pakistan Telecommunication Company Limited) Tier: pk_telecom ReqTime: 0.012
182.185.10.45 - [01/Oct/2026:15:10:03 +0500] "GET /checkout HTTP/2.0" 200 8912 ASN: AS23901 (Nayatel Pvt Ltd) Tier: pk_premium ReqTime: 0.004

Pakistani users enjoy instant response times while suspicious scraping bots from foreign hosting provider ASNs are throttled automatically at the edge.

---