Connection limiting (limit_conn) in Nginx - Commands & Configuration

Introduction

Sometimes a web server gets too many users at once, which can slow it down or crash it. Connection limiting helps control how many users connect at the same time to keep the server stable and fast.

When you want to stop one user from opening too many connections and slowing down the server.

When your website is getting a sudden spike of visitors and you want to keep it running smoothly.

When you want to protect your server from simple attacks that open many connections quickly.

When you run multiple websites on one server and want to limit connections per site.

When you want to make sure your server resources are shared fairly among users.

Config File - nginx.conf

nginx.conf

http {
    limit_conn_zone $binary_remote_addr zone=addr:10m;

    server {
        listen 80;
        server_name example.com;

        location / {
            limit_conn addr 5;
            root /var/www/html;
            index index.html;
        }
    }
}

limit_conn_zone defines a shared memory zone named 'addr' to track connections by client IP address.

limit_conn addr 5; limits each IP address to 5 simultaneous connections.

This setup helps prevent any single user from opening too many connections at once.

Commands

Check the nginx configuration file for syntax errors before applying changes.

Terminal

sudo nginx -t

Expected Output

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

Reload nginx to apply the new connection limiting settings without stopping the server.

Terminal

sudo systemctl reload nginx

Expected Output

No output (command runs silently)

Test the server response to confirm nginx is running and serving pages after applying limits.

Terminal

curl -I http://localhost

Expected Output

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 01 Jun 2023 12:00:00 GMT

Content-Type: text/html

Content-Length: 612

Connection: keep-alive

Key Concept

If you remember nothing else from this pattern, remember: limit_conn_zone tracks clients and limit_conn sets how many connections each client can open at once.

Common Mistakes

Not defining limit_conn_zone before using limit_conn.

Nginx needs the zone to track connections; without it, the limit_conn directive will cause errors.

Always define limit_conn_zone with a unique zone name and enough memory before using limit_conn.

Setting the limit_conn value too low, like 1, causing users to get blocked unnecessarily.

Users often open multiple connections for images, scripts, or tabs; too low a limit blocks normal use.

Set a reasonable limit like 5 or more depending on your site's needs.

Forgetting to reload nginx after changing the config.

Changes won't take effect until nginx reloads the configuration.

Run 'sudo systemctl reload nginx' after editing the config.

Summary

Define a shared memory zone with limit_conn_zone to track client connections.

Use limit_conn inside server or location blocks to set max simultaneous connections per client.

Test the configuration syntax with 'nginx -t' and reload nginx to apply changes.

Practice

1. What is the main purpose of the limit_conn directive in nginx?

easy

A. To limit the number of simultaneous connections per defined key

B. To limit the size of client requests

C. To limit the bandwidth used by clients

D. To limit the number of worker processes

Solution

1. Step 1: Understand the role of limit_conn and compare options

   The limit_conn directive sets a maximum number of simultaneous connections for a given key, such as an IP address. Options A, B, and D relate to bandwidth, request size, and worker processes, which are not controlled by limit_conn.

2. Final Answer:

   To limit the number of simultaneous connections per defined key -> Option A

3. Quick Check:

   limit_conn limits connections = C [OK]

Hint: limit_conn controls max connections per key, not bandwidth or size [OK]

Common Mistakes:

• Confusing limit_conn with bandwidth limiting
• Thinking it limits request size
• Assuming it controls worker processes

2. Which of the following is the correct syntax to limit connections per IP address using nginx directives?

easy

A. limit_conn_zone $remote_addr zone=addr:5m; limit_conn addr 10;

B. limit_conn_zone $remote_addr zone=addr:10m; limit_conn addr 5;

C. limit_conn_zone $binary_remote_addr zone=addr:10m; limit_conn addr 5;

D. limit_conn_zone $binary_remote_addr zone=addr:5m; limit_conn addr 10;

Solution

1. Step 1: Identify correct variable, zone size, and limit_conn usage

   The recommended variable for IP tracking is $binary_remote_addr and a zone size of 10m is common for storing states. The limit_conn directive uses the zone name (here 'addr') and the max connections (5) correctly in limit_conn_zone $binary_remote_addr zone=addr:10m; limit_conn addr 5;.

2. Final Answer:

   limit_conn_zone $binary_remote_addr zone=addr:10m; limit_conn addr 5; -> Option C

3. Quick Check:

   Correct variable and zone size = D [OK]

Hint: Use $binary_remote_addr and 10m zone for IP connection limits [OK]

Common Mistakes:

• Using $remote_addr instead of $binary_remote_addr
• Setting too small zone size like 5m
• Mixing max connections and zone size values

3. Given this nginx configuration snippet:

limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 2;

What happens when a single IP tries to open 3 simultaneous connections?

medium

A. The third connection is rejected with a 503 error

B. All three connections are accepted without restriction

C. The third connection is queued until one connection closes

D. The server crashes due to too many connections

Solution

1. Step 1: Understand limit_conn behavior and nginx response

   The directive limits simultaneous connections per key to 2, so the third connection exceeds the limit. When the limit is exceeded, nginx rejects the extra connection with HTTP status 503 (Service Unavailable).

2. Final Answer:

   The third connection is rejected with a 503 error -> Option A

3. Quick Check:

   Exceeding limit_conn returns 503 = B [OK]

Hint: Exceeding limit_conn max rejects connection with 503 error [OK]

Common Mistakes:

• Thinking nginx queues extra connections
• Assuming all connections are accepted
• Believing server crashes on limit exceed

4. You wrote this nginx config:

limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 10m;

Why does nginx fail to start?

medium

A. Because zone size must be less than 5m

B. Because limit_conn_zone must be inside server block

C. Because $binary_remote_addr is invalid variable

D. Because the limit_conn directive expects a number, not '10m'

Solution

1. Step 1: Check limit_conn directive argument and validate other parts

   The limit_conn directive expects a numeric value for max connections, not a size like '10m'. The limit_conn_zone syntax is correct and $binary_remote_addr is valid. Zone size 10m is allowed.

2. Final Answer:

   Because the limit_conn directive expects a number, not '10m' -> Option D

3. Quick Check:

   limit_conn needs number, not size string = A [OK]

Hint: limit_conn needs max connections number, not memory size [OK]

Common Mistakes:

• Confusing zone size with max connections
• Placing limit_conn_zone inside wrong block
• Using invalid variables for IP tracking

5. You want to limit connections per user session instead of IP. Which configuration change achieves this using limit_conn directives?

hard

A. Use limit_conn_zone $remote_addr zone=sess:10m; and limit_conn sess 3;

B. Use limit_conn_zone $cookie_sessionid zone=sess:10m; and limit_conn sess 3;

C. Use limit_conn_zone $binary_remote_addr zone=sess:5m; and limit_conn sess 10;

D. Use limit_conn_zone $http_user_agent zone=sess:10m; and limit_conn sess 3;

Solution

1. Step 1: Identify session key variable and configure directives

   To limit connections per user session, use a session identifier like a cookie variable, e.g., $cookie_sessionid. Define a zone with limit_conn_zone $cookie_sessionid zone=sess:10m; and limit connections with limit_conn sess 3;.

2. Final Answer:

   Use limit_conn_zone $cookie_sessionid zone=sess:10m; and limit_conn sess 3; -> Option B

3. Quick Check:

   Use cookie variable for session limits = A [OK]

Hint: Use cookie variable in limit_conn_zone for session-based limits [OK]

Common Mistakes:

• Using IP variables instead of session cookie
• Setting zone size too small for session keys
• Using user agent which is not unique per session