nginx为limit限速 通过geo模块设置白名单

为防止黑客对你的服务器地址进行并发攻击，可以配置以下配置，来动态的获取黑客攻击的地址，进行限速和并发，同时对内网测试人员或指定的IP、IP地址段设置白名单 不限速。
原配置：

#配置在http段使其全局生效
http {
......
limit_conn_log_level error;
limit_conn_status 503;
limit_conn_zone $limit  zone=one:10m;
limit_conn  one  50;
limit_req_zone $limit   zone=req_one:100m  rate=20r/s;
limit_req zone=req_one burst=60 nodelay;
}
......
}}

使用ab测试时 默认对所有IP限速

[root@localhost ~]# ab  -n 1110 -c 1110 url
This is ApacheBench, Version 2.3 <$Revision: 655654 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/

Benchmarking xx.xxxx.com (be patient)
Completed 111 requests
Completed 222 requests
Completed 333 requests
Completed 444 requests
Completed 555 requests
Completed 666 requests
Completed 777 requests
Completed 888 requests
Completed 999 requests
Completed 1110 requests
Finished 1110 requests


Server Software:        nginx
Server Hostname:        xx.xxxx.com
Server Port:            80

Document Path:          /webviews/certification.html
Document Length:        1131 bytes

Concurrency Level:      1110
Time taken for tests:   0.212 seconds
Complete requests:      1110
Failed requests:        1046
   (Connect: 0, Receive: 0, Length: 1046, Exceptions: 0)
Write errors:           0
Non-2xx responses:      1046
Total transferred:      491628 bytes
HTML transferred:       287860 bytes
Requests per second:    5224.66 [#/sec] (mean)
Time per request:       212.454 [ms] (mean)
Time per request:       0.191 [ms] (mean, across all concurrent requests)
Transfer rate:          2259.81 [Kbytes/sec] received

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:        0   66   2.7     67      68
Processing:    58   66   6.1     65      85
Waiting:        1   60  10.3     59      85
Total:         68  132   4.8    131     145

Percentage of the requests served within a certain time (ms)
  50%    131
  66%    132
  75%    133
  80%    135
  90%    138
  95%    142
  98%    144
  99%    144
 100%    145 (longest request)

可以看到失败的Failed requests: 1046 进行了限速

添加白名单配置：

geo $whiteiplist {
     default              	 		1;
    172.16.191.0/24        	0;
    192.168.6.0/24        	0;
    10.100.11.185				0；
    }

map $whiteiplist $limit {
    1                   $binary_remote_addr;
    0                   "";
    }

limit_conn_log_level error;
limit_conn_status 503;
limit_conn_zone $limit  zone=one:10m;
limit_conn  one  50;
limit_req_zone $limit   zone=req_one:100m  rate=20r/s;
limit_req zone=req_one burst=60 nodelay;

说明：

1. geo指令定义一个白名单$whiteiplist,默认值为1,所有都受限制。如果客户端IP与白名单列出的IP相匹配，则$whiteiplist值为0也就是不受限制。
2. map指令是将$whiteiplist值为1的，也就是受限制的IP，映射为客户端IP。将$whiteiplist值为0的，也就是白名单IP，映射为空的字符串。
3. limit_conn_zone和limit_req_zone指令对于键为空值的将会被忽略，从而实现对于列出来的IP不做限制。

同样的使用ab测试 白名单是否生效

[root@localhost ~]# ab  -n 1110 -c 1110 url
This is ApacheBench, Version 2.3 <$Revision: 655654 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/

Benchmarking xx.xxxx.com (be patient)
Completed 111 requests
Completed 222 requests
Completed 333 requests
Completed 444 requests
Completed 555 requests
Completed 666 requests
Completed 777 requests
Completed 888 requests
Completed 999 requests
Completed 1110 requests
Finished 1110 requests


Server Software:        nginx
Server Hostname:        xx.xxxxx.com
Server Port:            80

Document Path:          /webviews/certification.html
Document Length:        1131 bytes

Concurrency Level:      1110
Time taken for tests:   0.249 seconds
Complete requests:      1110
Failed requests:        0
Write errors:           0
Total transferred:      1524030 bytes
HTML transferred:       1255410 bytes
Requests per second:    4461.07 [#/sec] (mean)
Time per request:       248.819 [ms] (mean)
Time per request:       0.224 [ms] (mean, across all concurrent requests)
Transfer rate:          5981.50 [Kbytes/sec] received

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:        0   45   6.3     45      56
Processing:    34   90  40.2     89     157
Waiting:        1   90  40.6     89     157
Total:         57  135  34.2    134     192

Percentage of the requests served within a certain time (ms)
  50%    134
  66%    155
  75%    166
  80%    172
  90%    183
  95%    189
  98%    191
  99%    192
 100%    192 (longest request)

测试时失败的Failed requests: 0
设置白名单成功！