nginx prohibits high-frequency ip access

Sometimes we will use the number of IP visits within a certain period of time to determine whether the user has malicious access to achieve the purpose of preventing brushing. Let’s use the nginx module to limit it.

 nginx module limits ip

    #nginx.conf
    http{
    ...
     
    limit_req_zone $binary_remote_addr zone=limits:10m rate=50r/s;
    limit_conn_zone $binary_remote_addr zone=conn_zone:10m;
     
    server {
        limit_req zone=limits burst=50;
        
        limit_conn conn_zone 1;
        limit_rate 50k;
    }
    ...
     
    }

limit_req_zone: Limit the number of requests per unit time

limit_req_conn: Limit the number of connections (concurrency) at the same time

If the limit is exceeded, a 503 error will be returned directly.

 limit_req_zone module

    limit_req_zone $binary_remote_addr zone=five:10m rate=50r/s;

$binary_remote_addr: Indicates restriction through the remote_addr flag. The purpose of "binary_" is to abbreviate the memory usage and limit the same client IP address. 

zone=limits:10m: Indicates that a memory area with a size of 10M and a name of limits is generated to store access frequency information. 

rate=1r/s: Indicates the access frequency allowed for clients with the same identification. The limit here is 1 time per second, and it can also be 30r/m, for example.

    limit_req zone=limits burst=50;

zone=limits: Which configuration zone is used for restrictions, corresponding to the name in limit_req_zone above. 

burst=50: The burst configuration means to set a buffer with a size of 50. When a large number of requests (burst) come, requests that exceed the access frequency limit can be placed in this buffer first. 

 limit_conn_zone module

  As the name suggests, this is to limit the connection IP after reading the request header.

    limit_conn_zone $binary_remote_addr zone=conn_zone:10m;

zone=addr:10m; means generating a memory area with a size of 10M and a name of conn_zone to store access frequency information.

    limit_conn conn_zone 1;

 limit_conn conn_zone 1; indicates that each IP can only initiate one concurrent connection.

    limit_rate 50k;

 limit_rate 50k; means limiting the speed of each connection to 50k. Note that this is the connection speed limit, not the IP speed limit. If an IP allows two concurrent connections, then the IP is limited to limit_rate×2.