Nginx: limiting the number of connections per IP address

To stop a single address from using up all of your server’s connections — for example an aggressive crawler or a simple attack — limit the number of simultaneous connections per IP address in nginx. The module you need is part of the standard nginx build.

http {
    limit_conn_zone $binary_remote_addr zone=perip:10m;
    limit_conn_status 429;

    server {
        # ...
        limit_conn perip 10;
    }
}

• limit_conn_zone — memory for the counters, set in the http block. 10 MB is enough for more than 100,000 addresses.
• limit_conn perip 10 — no more than 10 simultaneous connections from one address. You can set it in http, server or location.
• limit_conn_status 429 — the response code returned when the limit is exceeded (503 by default).

Check the configuration and apply it without taking the site down:

sudo nginx -t && sudo systemctl reload nginx

Do not set the limit too low: a browser opens several connections to a site at once, and a whole office may share a single address. To limit the rate of requests rather than the number of connections, use the limit_req module.

In older guides you may come across the limit_zone directive. It was removed from nginx in version 1.7.6 and replaced by limit_conn_zone. For more detail, see the nginx documentation.