Requests coming from certain IP ranges should be assigned a rate limit class, such as:

• 1.2.3.* -> "cgnat" (some ISP using a NAT for all clients)

This will allow us to assign higher limits to ISPs and campuses using a NAT, but could also be used as a mechanism to exempt internal traffic or, temporarily, grant higher limits for Wikimedia events (Wikimania, hackathons).

Long term, we want a better solution for CGNATs, potentially based on edge unique cookies. Assessment of using IP ranges in the REST gateway vs. limiting by unique coooke at the edge:

Advantages:

• Easy and quick to implement
• Removes blocker for rollout
• Flexible tool that can be used in the future to address Wikimedia-Events, etc

Disadvantages:

• Not making use of the edge unique cookie, which would be more targeted
• The allow-list needs to be maintained manually
• The data needed to maintain it has to be extracted from the rate limit counters using redioscan on the command line. Could be exposed over http by redioscope, but that would require security vetting etc.