Nginx 限制ip并发数及请求速度

1. 限制单IP并发访问数量

nginx中ngx_http_limit_conn_module模块用于限制连接数量，特别是来自单个IP地址的连接数量。并非所有的连接都被计数。只有当服务器处理了请求并且已经读取了整个请求头时，连接才被计数。

http {
    limit_conn_zone $binary_remote_addr zone=addr:10m;
    ...
    server {
        ...
        location / {
            limit_conn addr 10;
            ...
        }
}

$binary_remote_addr对于IPv4地址，变量的大小始终为4个字节，对于IPv6地址则为16个字节。存储状态在32位平台上始终占用32或64个字节，在64位平台上占用64个字节。一个兆字节的区域可以保持大约32000个32字节的状态或大约16000个64字节的状态。如果区域存储耗尽，服务器会将错误返回 给所有其他请求。10M可存储160000个状态

2. 限制单IP访问速度

nginx中ngx_http_limit_req_module模块用于限制每一个请求的处理速率，特别是从一个单一的IP地址的请求的处理速率。

http {
    limit_req_zone $binary_remote_addr zone=one:10m rate=30r/s;
    ...
    server {
        ...
        location / {
            limit_req zone=one burst=50;
            ...
        }
}

3. 测试

我们可以用ab工具测试一下。

yum -y install httpd-tools

并发测试

并发数50，总共执行次数100

ab -c 50 -n 100 http://127.0.0.1:6688/

无限制时

> ab  -c 50 -n 100 http://127.0.0.1:6688/
This is ApacheBench, Version 2.3 <$Revision: 1430300 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/

Benchmarking 127.0.0.1 (be patient).....done


Server Software:        nginx
Server Hostname:        127.0.0.1
Server Port:            6688

Document Path:          /
Document Length:        612 bytes

Concurrency Level:      50
Time taken for tests:   0.007 seconds
Complete requests:      100
Failed requests:        0
Write errors:           0
Total transferred:      83800 bytes
HTML transferred:       61200 bytes
Requests per second:    14828.00 [#/sec] (mean)
Time per request:       3.372 [ms] (mean)
Time per request:       0.067 [ms] (mean, across all concurrent requests)
Transfer rate:          12134.63 [Kbytes/sec] received

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:        0    1   0.3      1       2
Processing:     0    1   0.7      2       2
Waiting:        0    1   0.5      1       2
Total:          1    2   0.5      2       3

限制配置

http {
    ...
    limit_conn_zone $binary_remote_addr zone=addr:10m;
    limit_req_zone $binary_remote_addr zone=one:10m rate=30r/s;
    server {
        limit_conn addr 10;
        limit_req zone=one burst=50;
        ...
    }
}

限制后

> ab  -c 50 -n 100 http://121.40.237.209:6688/
This is ApacheBench, Version 2.3 <$Revision: 1430300 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/

Benchmarking 121.40.237.209 (be patient).....done


Server Software:        nginx
Server Hostname:        121.40.237.209
Server Port:            6688

Document Path:          /
Document Length:        612 bytes

Concurrency Level:      50
Time taken for tests:   3.309 seconds
Complete requests:      100
Failed requests:        0
Write errors:           0
Total transferred:      83800 bytes
HTML transferred:       61200 bytes
Requests per second:    30.22 [#/sec] (mean)
Time per request:       1654.476 [ms] (mean)
Time per request:       33.090 [ms] (mean, across all concurrent requests)
Transfer rate:          24.73 [Kbytes/sec] received

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:        4    5   0.3      5       5
Processing:     5 1237 547.1   1660    1664
Waiting:        5 1237 547.1   1660    1664
Total:         10 1241 547.2   1665    1668

可以看出100个请求在3.3秒完成符合30r/s

参考文章
http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html
http://nginx.org/en/docs/http/ngx_http_limit_req_module.html