+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: DDoS protection on NGINX (/showthread.php?tid=6140260)
DDoS protection on NGINX - HitMyHide - Feb 16, 2021
limit_conn
In the http section, the limit_conn_zone shared memory zone is set:
Cod:
limit_conn_zone $binary_remote_addr zone=addr:10m;.
Further, already in the server or location, the number of allowable simultaneous connections from one ip-address is described:
using limit_conn:
Cod:
location /download/ { # file folder
limit_conn addr 1; # we allow no more than one connection from one IP address
}
You can set several limit_conn settings in one config.
Cod:
limit_conn_zone $binary_remote_addr zone=perip:10m;
limit_conn_zone $server_name zone=perserver:10m;
server {
...
limit_conn perip 10; // set a restriction for IP
limit_conn perserver 100; // set limits for the entire virtual host
}
limit_req
We set the shared memory zone and the maximum number of requests per second in the http section.
Cod:
limit_req_zone $binary_remote_addr zone=one:10m rate=2r/s; # limit 2 requests per second
We set a restriction for certain sections and scripts on the site:
Cod:
server {
...
# search section limitation
location /search/ {
limit_req zone=one burst=5; # burst
indicates the maximum excess of the limit, so if 5 requests came from the address in 1 second, then the next second the request will not be processed, if no bursts are provided then the nodelay parameter is set instead of burst=5
}