Backend Development
PHP Tutorial
PHP nginx limits the number of IP requests and the number of concurrency
PHP nginx limits the number of IP requests and the number of concurrency
How to set a limit on the number of visits to a certain IP within a certain period of time is a headache, especially when facing malicious DDoS attacks. Among them, CC attack (Challenge Collapsar) is a type of DDOS (Distributed Denial of Service) and a common website attack method. The attacker continuously sends a large number of data packets to the victim host through a proxy server or broiler, causing the opponent's server to Resources are exhausted until the machine crashes. CC attacks generally use a limited number of IPs to frequently send data to the server to achieve the purpose of the attack. nginx can limit the number of IP accesses in the same time period through the configuration of HttpLimitReqModul and HttpLimitZoneModule to prevent CC attacks. HttpLimitReqModul is a module used to limit the number of connections per unit time. Use the limit_req_zone and limit_req instructions together to achieve the limit. Once the number of concurrent connections exceeds the specified number, a 503 error will be returned. HttpLimitConnModul is used to limit the number of concurrent connections for a single IP. The difference between the two modules using the limit_zone and limit_conn instructions is that the former limits the number of connections within a period of time, and the latter limits the number of connections at the same time.
HttpLimitReqModul limits the number of instances accessed by the same IP within a certain period of time
<span>http<span>{<span> <span>...<span>
<span>#定义一个名为allips的limit_req_zone用来存储session，大小是10M内存，<span> <span>#以$binary_remote_addr 为key,限制平均每秒的请求为20个，<span> <span>#1M能存储16000个状态，rete的值必须为整数，<span> <span>#如果限制两秒钟一个请求，可以设置成30r/m<span>
limit_req_zone $binary_remote_addr zone<span>=<span>allips<span>:<span>10m<span> rate<span>=<span>20r<span>/<span>s<span>;<span> <span>...<span> server<span>{<span> <span>...<span> location <span>{<span> <span>...<span>
<span>#限制每ip每秒不超过20个请求，漏桶数burst为5<span> <span>#brust的意思就是，如果第1秒、2,3,4秒请求为19个，<span> <span>#第5秒的请求为25个是被允许的。<span> <span>#但是如果你第1秒就25个请求，第2秒超过20的请求返回503错误。<span> <span>#nodelay，如果不设置该选项，严格使用平均速率限制请求数，<span> <span>#第1秒25个请求时，5个请求放到第2秒执行，<span> <span>#设置nodelay，25个请求将在第1秒执行。<span>
limit_req zone<span>=<span>allips burst<span>=<span>5<span> nodelay<span>;<span> <span>...<span> <span>}<span> <span>...<span> <span>}<span> <span>...<span><span>}</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span>HttpLimitZoneModule limits the number of concurrent connections
limit_zone can only be defined in the http scope, limit_conn can be defined in the http server location scope
<span>http<span>{<span> <span>...<span>
<span>#定义一个名为one的limit_zone,大小10M内存来存储session，<span> <span>#以$binary_remote_addr 为key<span> <span>#nginx 1.18以后用limit_conn_zone替换了limit_conn<span> <span>#且只能放在http作用域<span> limit_conn_zone one $binary_remote_addr <span>10m<span>;<span>
<span>...<span> server<span>{<span> <span>...<span> location <span>{<span> <span>...<span> limit_conn one <span>20<span>;<span> <span>#连接数限制<span>
<span>#带宽限制,对单个连接限数，如果一个ip两个连接，就是500x2k<span> limit_rate <span>500k<span>;<span>
<span>...<span> <span>}<span> <span>...<span> <span>}<span> <span>...<span><span>}</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span>nginx whitelist settings
The above configuration will restrict all IPs. Sometimes we don’t want to restrict search engine spiders or test IPs ourselves.
For specific whitelisted IPs, we can use the geo command to achieve this .
1.
<span>http<span>{<span> geo $limited<span>{<span> <span>default<span> <span>1<span>;<span> <span>#google <span> <span>64.233<span>.<span>160.0<span>/<span>19<span> <span>0<span>;<span> <span>65.52<span>.<span>0.0<span>/<span>14<span> <span>0<span>;<span> <span>66.102<span>.<span>0.0<span>/<span>20<span> <span>0<span>;<span> <span>66.249<span>.<span>64.0<span>/<span>19<span> <span>0<span>;<span> <span>72.14<span>.<span>192.0<span>/<span>18<span> <span>0<span>;<span> <span>74.125<span>.<span>0.0<span>/<span>16<span> <span>0<span>;<span> <span>209.85<span>.<span>128.0<span>/<span>17<span> <span>0<span>;<span> <span>216.239<span>.<span>32.0<span>/<span>19<span> <span>0<span>;<span> <span>#M$<span> <span>64.4<span>.<span>0.0<span>/<span>18<span> <span>0<span>;<span> <span>157.60<span>.<span>0.0<span>/<span>16<span> <span>0<span>;<span> <span>157.54<span>.<span>0.0<span>/<span>15<span> <span>0<span>;<span> <span>157.56<span>.<span>0.0<span>/<span>14<span> <span>0<span>;<span> <span>207.46<span>.<span>0.0<span>/<span>16<span> <span>0<span>;<span> <span>207.68<span>.<span>192.0<span>/<span>20<span> <span>0<span>;<span> <span>207.68<span>.<span>128.0<span>/<span>18<span> <span>0<span>;<span> <span>#yahoo<span> <span>8.12<span>.<span>144.0<span>/<span>24<span> <span>0<span>;<span> <span>66.196<span>.<span>64.0<span>/<span>18<span> <span>0<span>;<span> <span>66.228<span>.<span>160.0<span>/<span>19<span> <span>0<span>;<span> <span>67.195<span>.<span>0.0<span>/<span>16<span> <span>0<span>;<span> <span>74.6<span>.<span>0.0<span>/<span>16<span> <span>0<span>;<span> <span>68.142<span>.<span>192.0<span>/<span>18<span> <span>0<span>;<span> <span>72.30<span>.<span>0.0<span>/<span>16<span> <span>0<span>;<span> <span>209.191<span>.<span>64.0<span>/<span>18<span> <span>0<span>;<span> <span>#My IPs<span> <span>127.0<span>.<span>0.1<span>/<span>32<span> <span>0<span>;<span> <span>123.456<span>.<span>0.0<span>/<span>28<span> <span>0<span>;<span> <span>#example for your server CIDR<span> <span>}</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span>geo directive defines a whitelist $limited variable, the default value is 1, if the client IP is within the above range, the value of $limited is 0
2. Use the map directive to map the search engine client The ip is an empty string. If it is not a search engine, the real ip will be displayed. In this way, the search engine ip cannot be stored in the limit_req_zone memory session, so the search engine’s ip access will not be restricted.
map $limited $limit {
1 $binary_remote_addr ;
0 "";
}
3. Set limit_req_zone and limit_req
limit_req_zone $limit z rate=10r/m;
limit_req z burst=5;
Finally we use ab to suppress php-fpm, for the above The effect of the method is actually tested
Example 1: The restriction only allows one IP to access the configuration 60 times in one minute, which is an average of 1 time per second
First we prepare a php script and place it in the root directory $document_root
test. php
nginx configuration added limit_req_zone and limit_req
<span>http<span>{<span> <span>...<span> limit_req_zone $binary_remote_addr zone<span>=<span>allips<span>:<span>10m<span> rate<span>=<span>60r<span>/<span>m<span>;<span> <span>...<span> server<span>{<span> <span>...<span> location <span>{<span> <span>...<span> limit_req zone<span>=<span>allips<span>;<span> <span>...<span> <span>}<span> <span>...<span> <span>}<span> <span>...<span><span>}</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span>ab -n 5 -c 1 http://www.weizhang.org/test.php
118.144.94.193 - - [22/Dec/2012: 06:27:06 +0000] "GET /test.php HTTP/1.0" 200 11000 "-" "ApacheBench/2.3"
118.144.94.193 - - [22/Dec/2012:06:27:06 +0000] " GET /test.php HTTP/1.0" 503 537 "-" "ApacheBench/2.3"
118.144.94.193 - - [22/Dec/2012:06:27:07 +0000] "GET /test.php HTTP/1.0" 503 537 "-" "ApacheBench/2.3"
118.144.94.193 - - [22/Dec/2012:06:27:07 +0000] "GET /test.php HTTP/1.0" 503 537 "-" "ApacheBench/2.3 "
118.144.94.193 - - [22/Dec/2012:06:27:07 +0000] "GET /test.php HTTP/1.0" 503 537 "-" "ApacheBench/2.3"
It is ok if brust and nodelay are not set Seeing that this configuration only allows 1 access per second, excessive requests return a 503 error
<span>http<span>{<span> <span>...<span> limit_req_zone $binary_remote_addr zone<span>=<span>allips<span>:<span>10m<span> rate<span>=<span>60r<span>/<span>m<span>;<span> <span>...<span> server<span>{<span> <span>...<span> location <span>{<span> <span>...<span> limit_req zone<span>=<span>allips burst<span>=<span>1<span> nodelay<span>;<span> <span>...<span> <span>}<span> <span>...<span> <span>}<span> <span>...<span><span>}</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span>ab -n 5 -c 1 http://www.weizhang.org/test.php
118.144.94.193 - - [22 /Dec/2012:07:01:00 +0000] "GET /test.php HTTP/1.0" 200 11000 "-" "ApacheBench/2.3"
118.144.94.193 - - [22/Dec/2012:07:01: 00 +0000] "GET /test.php HTTP/1.0" 200 11000 "-" "ApacheBench/2.3"
118.144.94.193 - - [22/Dec/2012:07:01:01 +0000] "GET /test. php HTTP/1.0" 503 537 "-" "ApacheBench/2.3"
118.144.94.193 - - [22/Dec/2012:07:01:01 +0000] "GET /test.php HTTP/1.0" 503 537 "- " "ApacheBench/2.3"
118.144.94.193 - - [22/Dec/2012:07:01:01 +0000] "GET /test.php HTTP/1.0" 503 537 "-" "ApacheBench/2.3"
Settings After brust=1 and nodelay, two requests are allowed to be processed in the first second.
The above introduces how PHP nginx limits the number of IP requests and the number of concurrency, including the content. I hope it will be helpful to friends who are interested in PHP tutorials.
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
AI Hentai Generator
Generate AI Hentai for free.
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
Solution: Your organization requires you to change your PIN
Oct 04, 2023 pm 05:45 PM
The message "Your organization has asked you to change your PIN" will appear on the login screen. This happens when the PIN expiration limit is reached on a computer using organization-based account settings, where they have control over personal devices. However, if you set up Windows using a personal account, the error message should ideally not appear. Although this is not always the case. Most users who encounter errors report using their personal accounts. Why does my organization ask me to change my PIN on Windows 11? It's possible that your account is associated with an organization, and your primary approach should be to verify this. Contacting your domain administrator can help! Additionally, misconfigured local policy settings or incorrect registry keys can cause errors. Right now
How to adjust window border settings on Windows 11: Change color and size
Sep 22, 2023 am 11:37 AM
Windows 11 brings fresh and elegant design to the forefront; the modern interface allows you to personalize and change the finest details, such as window borders. In this guide, we'll discuss step-by-step instructions to help you create an environment that reflects your style in the Windows operating system. How to change window border settings? Press + to open the Settings app. WindowsI go to Personalization and click Color Settings. Color Change Window Borders Settings Window 11" Width="643" Height="500" > Find the Show accent color on title bar and window borders option, and toggle the switch next to it. To display accent colors on the Start menu and taskbar To display the theme color on the Start menu and taskbar, turn on Show theme on the Start menu and taskbar
Display scaling guide on Windows 11
Sep 19, 2023 pm 06:45 PM
We all have different preferences when it comes to display scaling on Windows 11. Some people like big icons, some like small icons. However, we all agree that having the right scaling is important. Poor font scaling or over-scaling of images can be a real productivity killer when working, so you need to know how to customize it to get the most out of your system's capabilities. Advantages of Custom Zoom: This is a useful feature for people who have difficulty reading text on the screen. It helps you see more on the screen at one time. You can create custom extension profiles that apply only to certain monitors and applications. Can help improve the performance of low-end hardware. It gives you more control over what's on your screen. How to use Windows 11
10 Ways to Adjust Brightness on Windows 11
Dec 18, 2023 pm 02:21 PM
Screen brightness is an integral part of using modern computing devices, especially when you look at the screen for long periods of time. It helps you reduce eye strain, improve legibility, and view content easily and efficiently. However, depending on your settings, it can sometimes be difficult to manage brightness, especially on Windows 11 with the new UI changes. If you're having trouble adjusting brightness, here are all the ways to manage brightness on Windows 11. How to Change Brightness on Windows 11 [10 Ways Explained] Single monitor users can use the following methods to adjust brightness on Windows 11. This includes desktop systems using a single monitor as well as laptops. let's start. Method 1: Use the Action Center The Action Center is accessible
How to turn off private browsing authentication for iPhone in Safari?
Nov 29, 2023 pm 11:21 PM
In iOS 17, Apple introduced several new privacy and security features to its mobile operating system, one of which is the ability to require two-step authentication for private browsing tabs in Safari. Here's how it works and how to turn it off. On an iPhone or iPad running iOS 17 or iPadOS 17, Apple's browser now requires Face ID/Touch ID authentication or a passcode if you have any Private Browsing tab open in Safari and then exit the session or app to access them again. In other words, if someone gets their hands on your iPhone or iPad while it's unlocked, they still won't be able to view your privacy without knowing your passcode
What does http status code 520 mean?
Oct 13, 2023 pm 03:11 PM
HTTP status code 520 means that the server encountered an unknown error while processing the request and cannot provide more specific information. Used to indicate that an unknown error occurred when the server was processing the request, which may be caused by server configuration problems, network problems, or other unknown reasons. This is usually caused by server configuration issues, network issues, server overload, or coding errors. If you encounter a status code 520 error, it is best to contact the website administrator or technical support team for more information and assistance.
Win10/11 digital activation script MAS version 2.2 re-supports digital activation
Oct 16, 2023 am 08:13 AM
The famous activation script MAS2.2 version supports digital activation again. The method originated from @asdcorp and the team. The MAS author calls it HWID2. Download gatherosstate.exe (not original, modified) from https://github.com/massgravel/Microsoft-Activation-Scripts, run it with parameters, and generate GenuineTicket.xml. First take a look at the original method: gatherosstate.exePfn=xxxxxxx;DownlevelGenuineState=1 and then compare with the latest method: gatheros
![How to Hide and Unhide Folders on Windows 11 [3 Ways]](https://img.php.cn/upload/article/000/887/227/169542942766265.jpg?x-oss-process=image/resize,m_fill,h_207,w_330)
How to Hide and Unhide Folders on Windows 11 [3 Ways]
Sep 23, 2023 am 08:37 AM
Hiding folders is a great way to keep your desktop organized. Maybe you want to keep your personal files or some client details away from prying eyes. Whatever it is, the ability to put them away and unhide them when necessary is a big saver. In short, these hidden files will not show up in the main menu, but they will still be accessible. It's very simple and shouldn't take you too much time. How to hide a folder in Windows 11? 1. Use File Explorer and hit the + key to open File Explorer. WindowsE Find the folder you want to hide, right-click it and select Properties. Navigate to the General tab, check the Hide box, click Apply, and then click OK. In the next dialog box, check Apply changes to this folder, sub-folder
