Connection limiting (limit_conn) in Nginx - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does the limit_conn directive do in nginx?

It limits the number of simultaneous connections for a defined key, such as an IP address, to control traffic and prevent overload.

intermediate

How do you define a shared memory zone for connection limiting in nginx?

Use limit_conn_zone $variable zone=name:size; to create a zone that tracks connections by the variable (e.g., $binary_remote_addr).

intermediate

Example: What does this configuration do?

limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 5;

It limits each client IP address to a maximum of 5 simultaneous connections using a 10MB shared memory zone named 'addr'.

beginner

What happens when a client exceeds the connection limit set by limit_conn?

nginx returns a 503 Service Unavailable error to the client, refusing additional connections beyond the limit.

beginner

Why is connection limiting useful in a web server?

It helps protect the server from overload, prevents abuse, and ensures fair resource use among clients.

Which directive creates a shared memory zone for connection limiting in nginx?

A limit_conn_zone

B limit_conn

C limit_rate

D limit_req_zone

The limit_conn_zone directive defines the shared memory zone to track connections.

What variable is commonly used to limit connections per client IP in nginx?

A $binary_remote_addr

B $request_uri

C $host

D $server_name

$binary_remote_addr represents the client IP in a compact form for connection limiting.

If you set limit_conn addr 10;, what does it mean?

A Allow 10 connections total to the server

B Allow 10 connections per IP address

C Allow 10 requests per second

D Allow 10 connections per server block

It limits each key in the zone 'addr' (usually IP) to 10 simultaneous connections.

What response code does nginx send when connection limit is exceeded?

A 404 Not Found

B 500 Internal Server Error

C 503 Service Unavailable

D 429 Too Many Requests

nginx returns 503 Service Unavailable when connection limits are exceeded.

Which of these is NOT a benefit of connection limiting?

A Prevent server overload

B Improve server security

C Ensure fair resource use

D Increase server CPU speed

Connection limiting does not affect CPU speed; it controls traffic to protect resources.

Explain how to configure nginx to limit the number of simultaneous connections per client IP.

Think about tracking IPs and setting max connections.

Describe what happens when a client exceeds the connection limit set by nginx's limit_conn directive.

What does the server do when too many connections come from one client?

Practice

1. What is the main purpose of the limit_conn directive in nginx?

easy

A. To limit the number of simultaneous connections per defined key

B. To limit the size of client requests

C. To limit the bandwidth used by clients

D. To limit the number of worker processes

Solution

1. Step 1: Understand the role of limit_conn and compare options

   The limit_conn directive sets a maximum number of simultaneous connections for a given key, such as an IP address. Options A, B, and D relate to bandwidth, request size, and worker processes, which are not controlled by limit_conn.

2. Final Answer:

   To limit the number of simultaneous connections per defined key -> Option A

3. Quick Check:

   limit_conn limits connections = C [OK]

Hint: limit_conn controls max connections per key, not bandwidth or size [OK]

Common Mistakes:

• Confusing limit_conn with bandwidth limiting
• Thinking it limits request size
• Assuming it controls worker processes

2. Which of the following is the correct syntax to limit connections per IP address using nginx directives?

easy

A. limit_conn_zone $remote_addr zone=addr:5m; limit_conn addr 10;

B. limit_conn_zone $remote_addr zone=addr:10m; limit_conn addr 5;

C. limit_conn_zone $binary_remote_addr zone=addr:10m; limit_conn addr 5;

D. limit_conn_zone $binary_remote_addr zone=addr:5m; limit_conn addr 10;

Solution

1. Step 1: Identify correct variable, zone size, and limit_conn usage

   The recommended variable for IP tracking is $binary_remote_addr and a zone size of 10m is common for storing states. The limit_conn directive uses the zone name (here 'addr') and the max connections (5) correctly in limit_conn_zone $binary_remote_addr zone=addr:10m; limit_conn addr 5;.

2. Final Answer:

   limit_conn_zone $binary_remote_addr zone=addr:10m; limit_conn addr 5; -> Option C

3. Quick Check:

   Correct variable and zone size = D [OK]

Hint: Use $binary_remote_addr and 10m zone for IP connection limits [OK]

Common Mistakes:

• Using $remote_addr instead of $binary_remote_addr
• Setting too small zone size like 5m
• Mixing max connections and zone size values

3. Given this nginx configuration snippet:

limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 2;

What happens when a single IP tries to open 3 simultaneous connections?

medium

A. The third connection is rejected with a 503 error

B. All three connections are accepted without restriction

C. The third connection is queued until one connection closes

D. The server crashes due to too many connections

Solution

1. Step 1: Understand limit_conn behavior and nginx response

   The directive limits simultaneous connections per key to 2, so the third connection exceeds the limit. When the limit is exceeded, nginx rejects the extra connection with HTTP status 503 (Service Unavailable).

2. Final Answer:

   The third connection is rejected with a 503 error -> Option A

3. Quick Check:

   Exceeding limit_conn returns 503 = B [OK]

Hint: Exceeding limit_conn max rejects connection with 503 error [OK]

Common Mistakes:

• Thinking nginx queues extra connections
• Assuming all connections are accepted
• Believing server crashes on limit exceed

4. You wrote this nginx config:

limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 10m;

Why does nginx fail to start?

medium

A. Because zone size must be less than 5m

B. Because limit_conn_zone must be inside server block

C. Because $binary_remote_addr is invalid variable

D. Because the limit_conn directive expects a number, not '10m'

Solution

1. Step 1: Check limit_conn directive argument and validate other parts

   The limit_conn directive expects a numeric value for max connections, not a size like '10m'. The limit_conn_zone syntax is correct and $binary_remote_addr is valid. Zone size 10m is allowed.

2. Final Answer:

   Because the limit_conn directive expects a number, not '10m' -> Option D

3. Quick Check:

   limit_conn needs number, not size string = A [OK]

Hint: limit_conn needs max connections number, not memory size [OK]

Common Mistakes:

• Confusing zone size with max connections
• Placing limit_conn_zone inside wrong block
• Using invalid variables for IP tracking

5. You want to limit connections per user session instead of IP. Which configuration change achieves this using limit_conn directives?

hard

A. Use limit_conn_zone $remote_addr zone=sess:10m; and limit_conn sess 3;

B. Use limit_conn_zone $cookie_sessionid zone=sess:10m; and limit_conn sess 3;

C. Use limit_conn_zone $binary_remote_addr zone=sess:5m; and limit_conn sess 10;

D. Use limit_conn_zone $http_user_agent zone=sess:10m; and limit_conn sess 3;

Solution

1. Step 1: Identify session key variable and configure directives

   To limit connections per user session, use a session identifier like a cookie variable, e.g., $cookie_sessionid. Define a zone with limit_conn_zone $cookie_sessionid zone=sess:10m; and limit connections with limit_conn sess 3;.

2. Final Answer:

   Use limit_conn_zone $cookie_sessionid zone=sess:10m; and limit_conn sess 3; -> Option B

3. Quick Check:

   Use cookie variable for session limits = A [OK]

Hint: Use cookie variable in limit_conn_zone for session-based limits [OK]

Common Mistakes:

• Using IP variables instead of session cookie
• Setting zone size too small for session keys
• Using user agent which is not unique per session