{"id":338189,"date":"2021-09-10T14:30:00","date_gmt":"2021-09-10T11:30:00","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/how-to-use-rate-limiting-on-nginx-cloudsavvy-it\/"},"modified":"2021-09-10T14:30:00","modified_gmt":"2021-09-10T11:30:00","slug":"how-to-use-rate-limiting-on-nginx-cloudsavvy-it","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/how-to-use-rate-limiting-on-nginx-cloudsavvy-it\/","title":{"rendered":"#How to Use Rate Limiting on Nginx \u2013 CloudSavvy IT"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6aec6cce73f8f\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6aec6cce73f8f\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-use-rate-limiting-on-nginx-cloudsavvy-it\/#How_to_Enable_Rate_Limiting_in_Nginx\" >How to Enable Rate Limiting in Nginx<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-use-rate-limiting-on-nginx-cloudsavvy-it\/#Two-Stage_Rate_Limiting\" >Two-Stage Rate Limiting<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-use-rate-limiting-on-nginx-cloudsavvy-it\/#Rate_Limiting_Bandwidth\" >Rate Limiting Bandwidth<\/a><\/li><\/ul><\/nav><\/div>\n<p><strong>&#8220;#How to Use Rate Limiting on Nginx \u2013 CloudSavvy IT&#8221;<\/strong><\/p>\n<div id=\"article-content-area\">\n<img loading=\"lazy\" decoding=\"async\" class=\"type:primaryImage imgchk9 alignnone wp-image-1057 size-full\" srcset=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2019\/07\/33ce4fea.png?width=398&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1 400w, https:\/\/www.cloudsavvyit.com\/p\/uploads\/2019\/07\/33ce4fea.png?width=1198&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1 1200w\" sizes=\"auto, 400w, 1200w\" src=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2019\/07\/33ce4fea.png?width=1198&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"Nginx logo\" width=\"700\" height=\"300\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<p>Rate limiting controls how many requests users can make to your site. This is usually put in place to stop abusive bots, limit login attempts, and control API usage, which can prevent your server from slowing down under load.<\/p>\n<p>Rate limiting can\u2019t always save you from massive traffic spikes, so if your server really needs protection it\u2019s good practice to set up a full-site CDN in front, or at least set up HAProxy load balancing to split the load across multiple servers.<\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"How_to_Enable_Rate_Limiting_in_Nginx\"><\/span>How to Enable Rate Limiting in Nginx<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>First, we must define a rate limiting \u201czone.\u201d You can have multiple zones set up, and assign different locations blocks to each zone. For now, let\u2019s create a basic zone by adding the following line to your <code>server<\/code> or <code>http<\/code> context block:<\/p>\n<pre>limit_req_zone $binary_remote_addr zone=foo:10m rate=5r\/s;<\/pre>\n<p>The <code>limit_req_zone<\/code>\u00a0command defines a zone using <code>$binar_remote_addr<\/code>\u00a0as the identifier. This is the IP address of the client, but you could also use something like <code>$server_name<\/code>\u00a0to limit it per server.<\/p>\n<p>The <code>zone<\/code>\u00a0flag names the zone (in this case, \u201cfoo\u201d), and allocates a memory block for the zone. Nginx needs to store IP addresses to check against, so it needs memory for each zone. In this case, <code>10m<\/code>\u00a0allocates 10 megabytes of memory, enough for 160,000 connections per second (which you are likely never going to see on a single server).<\/p>\n<p>The final flag is the rate, which defines the default number of connections each client is allowed. Here it is set to 5 requests per second, with 10 being the maximum, though you can set it slower by formatting it as <code>30r\/m<\/code>\u00a0(for 30 requests per minute).<\/p>\n<p>Once the zone is configured, it\u2019s time to make use of it.<\/p>\n<pre>location {&#13;\n  limit_req zone=foo burst=10 nodelay;&#13;\n&#13;\n  \/\/do webserver stuff&#13;\n}<\/pre>\n<p>The <code>limit_req<\/code>\u00a0directive does the heavy lifting, and assigns a location block to a limiting zone. The <code>burst<\/code>\u00a0parameter gives the client some wiggle room, and allows them to make extra requests so long as they don\u2019t exceed the rate on average.<\/p>\n<p>Under the hood, it adds burst requests to a \u201cqueue\u201d that ticks down every 100ms. This can make your site <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>ear slow, so the <code>nodelay<\/code>\u00a0parameter removes this queue delay. With the current config, if you made 10 requests all at once, the <code>nodelay<\/code>\u00a0parameter would allow all 10 requests, then rate limit the following requests at 5 requests per second. If you made 6 more requests, it would allow 5, and reject the 6th as it\u2019s over the limit. Once the client stops making requests, the queue ticks down at a speed depending on your rate.<\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"Two-Stage_Rate_Limiting\"><\/span>Two-Stage Rate Limiting<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>By manually setting the delay variable, it\u2019s possible to allow a few requests to have no delay while the rest have to wait in the queue. This forms a two-stage rate limit, where you want the initial requests to be very fast, follow-up requests to be slowed a bit, then kick in the rate limit.<\/p>\n<p>This is done by assigning a delay value on the <code>limit_req<\/code>\u00a0directive:<\/p>\n<pre>limit_req zone=ip burst=10 delay=5;<\/pre>\n<p>Here, the first 5 requests will come through instantly. The client is then allowed 5 more requests every 100ms until the burst fills up, after which, they\u2019re limited by the rate variable.<\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"Rate_Limiting_Bandwidth\"><\/span>Rate Limiting Bandwidth<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Limiting requests will block out most malicious attacks, but you might want to limit download speed so that users don\u2019t slow your server down by downloading a lot of files.<\/p>\n<p>You can do this with the <code>limit_rate<\/code> directive, which doesn\u2019t need a limiting zone configured for it.<\/p>\n<pre>limit_rate 100k&#13;\nlimit_rate_after 1m<\/pre>\n<p>This sets the maximum download speed to 100 Kbps after 1 megabyte has been downloaded. However, this is measured per connection, and users can open multiple connections. To solve this, you\u2019ll need to add a connection limiting zone next to the request limiting zone:<\/p>\n<pre>limit_conn_zone $binary_remote_address zone=bar:10m&#13;\nlimit_req_zone $binary_remote_addr zone=foo:10m rate=5r\/s;<\/pre>\n<p>This makes a 10 megabyte zone called \u201cbar\u201d that tracks based on IP address. You can use this alongside a <code>limit_conn<\/code>\u00a0directive to enable connection limiting.<\/p>\n<pre>server {&#13;\n&#13;\n  limit_conn bar 5;&#13;\n&#13;\n  location \/static\/ {&#13;\n\u00a0   limit_conn bar 1;&#13;\n\u00a0   limit_rate 100k;&#13;\n\u00a0   limit_rate_after 1m;&#13;\n  }&#13;\n}<\/pre>\n<p>Because most browsers open up multiple connections when doing normal browsing, we\u2019ll want to set the global connection limit higher, then set the limit to 1 connection for downloading.\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/technology\/\" target=\"_blank\" rel=\"noopener\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.cloudsavvyit.com\/1054\/how-to-use-rate-limiting-on-nginx\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;#How to Use Rate Limiting on Nginx \u2013 CloudSavvy IT&#8221; Rate limiting controls how many requests users can make to your site. This is usually put in place to stop abusive bots, limit login attempts, and control API usage, which can prevent your server from slowing down under load. Rate limiting can\u2019t always save you&#8230;<\/p>\n","protected":false},"author":1,"featured_media":338190,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2019\/07\/33ce4fea.png","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-338189","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/338189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=338189"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/338189\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/338190"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=338189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=338189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=338189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}