Limiting Requests in Nginx with the limit_req_dry_run Module

Introduction to the limit_req Module in Nginx

The limit_req module in Nginx provides us with the ability to control the number of incoming requests to the server. This control helps us to mitigate DDoS attacks and other disruptive activities. This module gives us the capability to restrict additional requests when access exceeds certain resources.

Moreover, the limit_req module is widely used to set limitations related to the rate of requests. For example, we can set that each user can only send a limited number of requests within a specific timeframe. This is especially important for systems that require greater traffic control.

Here, we will discuss the limit_req_dry_run technique. This feature allows us to observe the server's behavior during tests before applying restrictions or blocking requests. In other words, by using dry_run, we can see which requests could be restricted without affecting any of the users negatively.

In this article, we will review how to use limit_req_dry_run and provide a practical example to teach you how to integrate this feature. Proper application of this module can enhance the security of your server and better protect users from risks.

Configuration of the limit_req_dry_run Module

http {
    limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
    server {
        location / {
            limit_req zone=one burst=5 dry_run;
        }
    }
}

Line-by-Line Explanation

http {
This block begins the main server configuration settings for Nginx.

limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
This line creates a rate limiting zone based on the user's IP address, allowing a maximum of 1 request per second.

server {
This block starts the server-related configurations.

location / {
This block specifies the settings related to the site root path.

limit_req zone=one burst=5 dry_run;
This line instructs Nginx to allow up to 5 additional requests after the main limit and, in case of an overload, only logs the occurrence without blocking the requests due to using the dry_run mode.

}
This marks the end of the location block.

}
This marks the end of the server block.

}
This marks the end of the http block.