A
A
Anatoly2017-11-03 06:37:47
Nginx
Anatoly, 2017-11-03 06:37:47

Is there any point in limiting the number of requests to the Nginx server?

I read an article about the limit on the number of requests and connections to the Nginx server, but I can’t understand what is the real benefit of this implementation? I would like to know if someone in production has it really set up and working?
If the meaning of this application, if I have only one server (https), i.e. no back-end and front-end servers. It was not in vain that I pointed out that https is working on the site, i.e. the incoming request is processed anyway, and whether it is rejected or not is not important, since the processor resources are consumed in the same amount, although there will be less load on the network.
Code example, just to make it clear what I'm talking about:

http {
   limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
   limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=5r/s;
   server {
    		limit_conn conn_limit_per_ip 10;
    		limit_req zone=req_limit_per_ip burst=10 nodelay;
   }
}

I have landing pages, there are almost no left-wing visitors, i.e. they come mainly to those who are interested and who want to buy goods. Many come from Yandex advertising: Direct + YAN.
I think, from whom to defend? Will a competitor come in and poke F5? )) I'll show him 503, and he'll be glad that he's a hacker ))
I repeat once again that with a shaper and without a shaper, the processor is loaded in the same way, for example, in this scenario:
siege -b -r 50 -c 200 -v https://mysite.ru

Answer the question

In order to leave comments, you need to log in

2 answer(s)
S
Someone White, 2017-11-03
@Tolly

Example:
a large host uses nginx as a proxy and has over 1000 backends behind it. To avoid overspending resources on one or two sites, you can use this technology. Naturally, this feature does not save from ddos ​​and channel clogging, and those who studied the materiel understand this. But you can protect yourself from dos and syn-flood and leave the hosting alive and the site working.
You can use different policies for different locations, thereby avoiding overloading the application database by limiting the number of requests / s, and using less stringent rules for statics. If the server consists only of static content, then there is no point in this technology, rather harm.

A
Andrey Stepanov, 2017-11-03
@leoykt

yes, there are a lot of applications, which is enough for a whole article. Let's say you have a distributed network and the number of backends can handle a strictly defined number of requests. Well, or stupidly as a method of protection against DDoS.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question