Connection limiting (limit_conn) in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the effect of this nginx configuration snippet?

Given the following nginx configuration, what will be the output or effect when more than 5 simultaneous connections are made from the same IP address?

Nginx

limit_conn_zone $binary_remote_addr zone=addr:10m;
server {
    location / {
        limit_conn addr 5;
        proxy_pass http://backend;
    }
}

A Requests exceeding 5 simultaneous connections from the same IP will be delayed but eventually processed.

B Requests exceeding 5 simultaneous connections from the same IP will be rejected with a 503 Service Unavailable error.

C Requests exceeding 5 simultaneous connections from the same IP will be queued and processed sequentially.

D Requests exceeding 5 simultaneous connections from the same IP will be redirected to a different server.

💡 Hint

Think about what limit_conn does when the connection limit is reached.

The limit_conn directive limits the number of simultaneous connections per defined key (here, per IP address). When the limit is exceeded, nginx rejects the extra connections with a 503 error by default.

❓ Configuration

intermediate

Choose the correct configuration to limit connections per user session

You want to limit simultaneous connections per user session identified by a cookie named 'SESSIONID' to 3. Which configuration snippet correctly sets this up?

A

limit_conn_zone $remote_addr zone=session:10m;
limit_conn session 3;

B

limit_conn_zone $binary_remote_addr zone=session:10m;
limit_conn session 3;

C

limit_conn_zone $http_cookie zone=session:10m;
limit_conn session 3;

D

limit_conn_zone $cookie_SESSIONID zone=session:10m;
limit_conn session 3;

💡 Hint

Use the variable that extracts the cookie value.

The variable $cookie_SESSIONID extracts the value of the cookie named SESSIONID. Using it as the key in limit_conn_zone limits connections per user session.

❓ Troubleshoot

advanced

Why does the limit_conn directive not seem to work in this config?

You configured nginx with: limit_conn_zone $binary_remote_addr zone=addr:10m; server { limit_conn addr 10; location / { proxy_pass http://backend; } } But connections are not limited as expected. What is the most likely cause?

A The limit_conn_zone directive must be inside the server block, not the http block.

B The proxy_pass directive disables limit_conn functionality.

C The limit_conn directive must be inside the location block, not the server block.

D The zone size 10m is too small to track connections.

💡 Hint

Check where limit_conn is allowed to be used.

The limit_conn directive must be placed inside a location, server, or http block. However, to limit connections per location, it should be inside the location block. Placing it only in the server block limits all connections to the server, but sometimes it may not work as expected if location blocks override it.

🔀 Workflow

advanced

Order the steps to enable connection limiting per IP in nginx

Put these steps in the correct order to enable connection limiting per IP address in nginx.

A 1,2,3,4

B 2,1,3,4

C 2,3,1,4

D 1,3,2,4

💡 Hint

Think about configuration, applying, then testing.

First, define the zone with limit_conn_zone. Then apply limit_conn in the location block. Reload nginx to apply changes. Finally, test the setup.

✅ Best Practice

expert

Which approach best prevents denial-of-service attacks using connection limiting?

You want to protect your nginx server from denial-of-service attacks by limiting connections. Which configuration approach is best practice?

A Use limit_conn_zone with $binary_remote_addr and limit_conn in location blocks, combined with limit_req to limit request rate.

B Use limit_conn_zone with $remote_addr and set limit_conn to 1 globally without request rate limiting.

C Use limit_conn_zone with $http_user_agent and limit_conn to block suspicious user agents only.

D Use limit_conn_zone with $binary_remote_addr and disable keepalive connections to reduce load.

💡 Hint

Think about combining connection and request rate limits for better protection.

Best practice is to limit simultaneous connections per IP using limit_conn_zone and limit_conn, and also limit request rates with limit_req to prevent flooding. This layered approach improves defense against denial-of-service attacks.