U.S. cloud servers receive hundreds of login requests or interface brush attempts from the same IP per second, which can easily bring down business systems in minutes. Nginx as the traffic inlet, built-in protection mechanism can effectively and accurately cut off abnormal request traffic. Here is a detailed explanation of how Nginx limits IP access frequency in US cloud servers.

The US cloud server Nginxlimit_req module uses the leaky bucket algorithm to control the rate at which requests reach the service layer. The following configuration can limit a single IP address to a maximum of 10 requests per second and 5 requests for burst traffic.

nginx  
http {  
limit_req_zone $binary_remote_addr zone=ip_limit:10m rate=10r/s;  
server {  
location /api/ {  
limit_req zone=ip_limit burst=5 nodelay;  
proxy_pass http://backend;  
}
}
}

zone=ip_limit:10m: 10MB memory is allocated to store IP addresses. About 160,000 IP addresses can be recorded.

rate=10r/s: The limit of 10 requests per second is actually smoothed by milliseconds (that is, 1 request per 100ms).

burst=5: Allows requests to be exceeded by 5 instantly, and the exceeded part is queued instead of rejected outright.

nodelay: The burst request is processed immediately instead of delayed, preventing the client from waiting for a long time.

Malicious crawlers often access specific dynamic interfaces at high frequencies, while normal users mainly trigger static resources (such as images, CSS). Protect core business with differentiated speed limits:

nginx  
map $uri $limit_bucket {  
~^/api/    "dynamic";  
default    "static";  
}
limit_req_zone $binary_remote_addr zone=dynamic_limit:10m rate=5r/s;  
limit_req_zone $binary_remote_addr zone=static_limit:10m rate=50r/s;  
server {  
location /api/ {  
limit_req zone=dynamic_limit burst=3;  
proxy_pass http://backend;  
}
location / {  
limit_req zone=static_limit burst=20;  
root /var/www/html;  
}
}

This policy limits dynamic interfaces to five times per second and static resources to 50 times per second, which does not affect user experience and protects critical services.

Trusted IP addresses such as CDN nodes and internal monitoring systems must be whitelisted to avoid accidental damage.

nginx  
geo $whitelist {  
default 0;  
192.168.1.0/24 1; Intranet IP
203.0.113.50 1; CDN node
}
map $whitelist $limit_key {  
0 $binary_remote_addr;  
1 "";
}
limit_req_zone $limit_key zone=all_limit:10m rate=20r/s;  
server {  
location / {  
limit_req zone=all_limit burst=10;  
... Other configuration
}
}

The IP addresses in the whitelist are not restricted by the rate limiting rule, ensuring the smooth flow of critical services. For persistent IP attacks, dynamic blocking can be achieved using OpenResty's Lua extension:

nginx  
http {  
lua_shared_dict ip_blacklist 10m;  
init_by_lua_block {  
local blacklist = ngx.shared.ip_blacklist  
blacklist:set("192.0.2.100", 1) Initial blacklist
}
server {  
access_by_lua_block {  
local client_ip = ngx.var.remote_addr  
local blacklist = ngx.shared.ip_blacklist  
if blacklist:get(client_ip) then  
ngx.exit(ngx.HTTP_FORBIDDEN)  
end  
}
location /report {  
content_by_lua_block {  
local client_ip = ngx.var.remote_addr  
local blacklist = ngx.shared.ip_blacklist  
blacklist:set(client_ip, 1, 3600) will block it for one hour
ngx.say("IP ", client_ip, "blacklisted ")
}
}
}
}

Blacklist IP addresses are automatically blocked, and malicious IP addresses can be dynamically added by human or external systems through the /report interface.

Combined with the WAF log analysis tool, the attack IP can be automatically identified and the interface can be blocked. Attackers often bypass basic defense through proxy IP pools or slow attacks, and need to combine strategies to deal with:

UserAgent filtering: Intercept the browser identity

nginx  
if ($http_user_agent ~ "wget|curl|python") {  
return 403;  
}

Verification Code Challenge: Return to the verification code page for high-frequency IP addresses

nginx  
error_page 503 @verify;  
location @verify {  
add_header ContentType text/html;  
return 200 '<html> Please complete the verification code <iframe src="/captcha"></iframe></html>';
}

Log Analysis and Dynamic adjustment Use GoAccess to analyze Nginx logs, identify abnormal request patterns, and dynamically adjust speed limit thresholds based on peak business hours such as temporary relaxation of restrictions during promotions.

After the configuration is complete, verify that the rule takes effect.

Manual test, trigger speed limit

for i in {1.. 15}; do curl http://server/api/login;  done  

Observation returns 429 Too Many Requests

Automated pressure measurement (see success rate and number of rejected requests) :

ab n 1000 c 50 http://server/api/login  

Monitoring indicators:

Nginx active connections (ngx_http_active_connections)、Limiting module rejection times (ngx_http_limit_req_status).

In summary, Nginx's refined traffic control can build an adaptive defense line at the code level without relying on expensive security hardware.