How to setup rate limit on Nginx

Rate limiting is a very important feature that you can use to protect your server from attacks, but also save bandwidth at the same time.

This feature allows you to define a limit of how many requests an IP can make on your server, this is useful in cases where you get a lot of malicious traffic.

For example, let's say you have a download feature on your application, or a form that users are required to submit, if there's no limit set to these functions then your application is vulnerable to dos/ddos, which means a malicious IP can send unlimited amount of requests to these functions which would cause your server to crash.

To prevent this from happening you can set a limit on these functions by using the limit_req directive on Nginx.

1) Open nginx.conf with a text editor

sudo nano /etc/nginx/nginx.conf

2) Set a limit

Before you set a limit, let's see how this config works and what each config means.

limit_req_zone - Is the Nginx directive that allows us to use the rate limiting feature

$binary_remote_addr - Is the IP address of the client

zone - Specifies the zone limit, for example in the config below the zone limit is called limit_per_ip

rate - Allows you to specify rate requests, for example in the config below we set it to a rate of 1 request per second 1r/s

limit_req_zone $binary_remote_addr zone=limit_per_ip:10m rate=1r/s;

Now that you know how the config works, let's add this config to your nginx configuration file. This config should be added to the nginx.conf, on the server block that you want to setup the rate limiting.

This is how the config file should look like.

limit_req_zone $binary_remote_addr zone=limit_per_ip:10m rate=1r/s;

server {

location /login-form {

limit_req_zone limit_per_ip;

}

}

In this example, we have allocated a storage of 10megabytes and a rate limit of 1 request per second to /login-form

3) Save changes

To save changes on Nano text editor, you can do so by pressing CTRL + X, next you need to confirm with Yes by pressing Y, after confirming simply press enter.

And the new config should be ready to be used.

4) Reload Nginx for the changes to take effect

Now you need to reload nginx in order for the new config to take effect, so you don't have to reboot your server or Nginx in this case.

systemctl reload nginx

Conclusion

In this tutorial, you learned how to set up rate limiting on Nginx. We also explained why rate limiting is used, and why it's necessary