How to prevent DDoS attacks in nginx

Defending against DDOS is a systematic project. There are many types of attacks, the cost of defense is high and there are many bottlenecks. Defense is passive and helpless. The characteristic of DDOS is that it is distributed and targets bandwidth and service attacks, that is, Layer 4 traffic attacks and Layer 7 application attacks. The corresponding defense bottleneck at Layer 4 is bandwidth, and at Layer 7 is the throughput of the architecture. For layer seven application attacks, we can still make some configurations to defend against them.

For exampleThe front end is Nginx, which mainly uses nginx’s http_limit_conn and http_limit_req modules for defense. ngx_http_limit_conn_module can limit the number of connections of a single IP, and ngx_http_limit_req_module can limit the number of requests per second of a single IP. By limiting the number of connections and requests, CC attacks can be relatively effectively defended.

The following is the configuration method:

Limit the number of requests per second
ngx_http_limit_req_module module limits the unit time through the leaky bucket principle Once the number of requests per unit time exceeds the limit, a 503 error will be returned. Configuration needs to be set in two places:

Define trigger conditions in the http section of nginx.conf. There can be multiple conditions
Define the actions to be performed by nginx when the trigger conditions are met in location
For example:

http { limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s; //触发条件，所有访问ip 限制每秒10个请求 ... server { ... location ~ \.php$ { limit_req zone=one burst=5 nodelay; //执行的动作,通过zone名字对应 } } }

Parameter description:

$binary_remote_addr 二进制远程地址 zone=one:10m 定义zone名字叫one，并为这个zone分配10M内存，用来存储会话（二进制远程地址），1m内存可以保存16000会话 rate=10r/s; 限制频率为每秒10个请求 burst=5 允许超过频率限制的请求数不多于5个，假设1、2、3、4秒请求为每秒9个，那么第5秒内请求15个是允许的，反之，如果第一秒内请求15个，会将5个请求放到第二秒，第二秒内超过10的请求直接503，类似多秒内平均速率限制。 nodelay 超过的请求不被延迟处理，设置后15个请求在1秒内处理。

Limit the number of IP connections
The configuration method and parameters of ngx_http_limit_conn_module are the same as The http_limit_req module is very similar, with fewer parameters and much simpler

http { limit_conn_zone $binary_remote_addr zone=addr:10m; //触发条件 ... server { ... location /download/ { limit_conn addr 1; // 限制同一时间内1个连接，超出的连接返回503 } } }

For more Nginx related technical articles, please visit theNginx Usage Tutorialcolumn to learn!

The above is the detailed content of How to prevent DDoS attacks in nginx. For more information, please follow other related articles on the PHP Chinese website!