Rate Limit NGINX

One of the most useful features of NGINX is rate limiting. It allows limiting the number of HTTP/HTTPS requests a user can make within a given period of time. A request can be as simple as a GET request for a website's home page or a POST request in a login form.

Rate limiting can be used for security purposes, for example, to slow down brute-force attacks to guess passwords. It can help protect against DDoS attacks by limiting the incoming request rate to a value typical for real users and identifying the target URLs.

info In more general terms, it is used to protect upstream application servers from being overwhelmed by too many user requests at the same time.

Configuring the Rate Limit parameter

The location of the file to be configured, to limit the speed of your website, is found at the following path:

/etc/nginx/swpanel/vhosts/tudominio.tld.conf

You must open the file with a file editor and locate the following parameters:

Port 80 (http)

# Rate limit for each domain  
limit_req_zone $binary_remote_addr zone=tudominio.tld_rate:1m rate=150r/s;  
   
...  
    
server {  
listen 80;
	
...
      
limit_req zone=tudominio.tld_rate burst=50 nodelay;  
      
...

The lines you must modify, to apply the desired values, are:

limit_req_zone $binary_remote_addr zone=tudominio.tld_rate:1m rate=DESIREDVALUER/s;

limit_req zone=tudominio.tld_rate burst=DESIREDVALUE nodelay;

info If you are using an SSL certificate for your website, remember to also apply the "Rate Limit" values in the section corresponding to port 443 of the same configuration file.

Port 443 (https)

# Rate limit for each domain  
limit_req_zone $binary_remote_addr zone=tudominio.tld_rate:1m rate=150r/s;  
      
 ...  
	
server {  
listen 443;
	
...
      
limit_req zone=tudominio.tld_rate burst=50 nodelay;  
      
...

Now you only need to run the following command to ensure that the new configuration is correct and it is safe to restart Nginx.

nginx -t

You will see something similar on the screen:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Otherwise, revert the changes made.

Now all that's left is to restart Nginx so that the new configuration is applied.

/etc/init.d/nginx	reload

Or you can also use:

/etc/init.d/nginx restart

success With these changes, you will have the NGINX rate limiting for your website configured for both HTTP and HTTPS.