Nginx的请求限制_请求连接数限制配置原理

1、http_limit_req_module详解

http_limit_req_module：限制http请求频率

官网解释：

The ngx_http_limit_req_module module (0.7.21) is used to limit the request processing rate per a defined key, in particular, the processing rate of requests coming from a single IP address. The limitation is done using the “leaky bucket” method.

2、limit_req语法

（1）limit_req语法

Syntax:	`limit_req zone=name [burst=number] [nodelay \| delay=number];`
Default:	—
Context:	`http`, `server`, `location`

语法解释：

limit_req zone=name [burst=number] [nodelay | delay=number];

zone 表示存储在共享内存中的key

[burst=number] 表示突发请求数（最大请求数）

[nodelay | delay=number] 其中nodelay表示请求没有延迟，超出的请求丢失；delay=number表示可以延迟处理请求的数量

Sets the shared memory zone and the maximum burst size of requests. If the requests rate exceeds the rate configured for a zone, their processing is delayed such that requests are processed at a defined rate. Excessive requests are delayed until their number exceeds the maximum burst size in which case the request is terminated with an error. By default, the maximum burst size is equal to zero. For example, the directives

#使用$binary_remote_addr替换$remote_addr（客户端地址），节省内存空间

limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

server {

    location /search/ {

        limit_req zone=one burst=5;

allow not more than 1 request per second at an average, with bursts not exceeding 5 requests.

If delaying of excessive requests while requests are being limited is not desired, the parameter nodelayshould be used:

limit_req zone=one burst=5 nodelay;

The delay parameter (1.15.7) specifies a limit at which excessive requests become delayed. Default value is zero, i.e. all excessive requests are delayed.

There could be several limit_req directives. For example, the following configuration will limit the processing rate of requests coming from a single IP address and, at the same time, the request processing rate by the virtual server:

limit_req_zone $binary_remote_addr zone=perip:10m rate=1r/s;

limit_req_zone $server_name zone=perserver:10m rate=10r/s;

server {

...

    limit_req zone=perip burst=5 nodelay;

    limit_req zone=perserver burst=10;

（2）limit_req_log_level语法

These directives are inherited from the previous level if and only if there are no limit_req directives on the current level.

Syntax:	limit_req_log_level info \| notice \| warn \| error;
Default:	limit_req_log_level error;
Context:	http,server,location

This directive appeared in version 0.8.18.

语法解释：

limit_req_log_level error;表示为服务器因速率超过或延迟请求处理而拒绝处理请求的情况设置所需的日志记录级别。

Sets the desired logging level for cases when the server refuses to process requests due to rate exceeding, or delays request processing. Logging level for delays is one point less than for refusals; for example, if “limit_req_log_level notice” is specified, delays are logged with the info level.

（3）limit_req_status语法

Syntax:	limit_req_status code;
Default:	limit_req_status 503;
Context:	http,server,location

This directive appeared in version 1.3.15.

语法解释：

limit_req_status code;表示拒绝请求的响应码

Sets the status code to return in response to rejected requests.

（4）limit_req_zone语法

Syntax:	limit_req_zone key zone=name:size rate=rate [sync];
Default:	—
Context:	http

语法解释：

limit_req_zone key zone=name:size rate=rate [sync];

key 表示存储在共享内存中的key

zone=name:size 表示共享内存名称和大小

rate=rate [sync] 表示请求数率，例如：10r/s每秒请求10次

Sets parameters for a shared memory zone that will keep states for various keys. In particular, the state stores the current number of excessive requests. The key can contain text, variables, and their combination. Requests with an empty key value are not accounted.

Prior to version 1.7.6, a key could contain exactly one variable.

Usage example:

limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

Here, the states are kept in a 10 megabyte zone “one”, and an average request processing rate for this zone cannot exceed 1 request per second.

A client IP address serves as a key. Note that instead of $remote_addr, the $binary_remote_addr variable is used here. The $binary_remote_addr variable’s size is always 4 bytes for IPv4 addresses or 16 bytes for IPv6 addresses. The stored state always occupies 64 bytes on 32-bit platforms and 128 bytes on 64-bit platforms. One megabyte zone can keep about 16 thousand 64-byte states or about 8 thousand 128-byte states.

If the zone storage is exhausted, the least recently used state is removed. Even if after that a new state cannot be created, the request is terminated with an error.

The rate is specified in requests per second (r/s). If a rate of less than one request per second is desired, it is specified in request per minute (r/m). For example, half-request per second is 30r/m.

The sync parameter (1.15.3) enables synchronization of the shared memory zone.

The sync parameter is available as part of our commercial subscription.