Nginx rate limiting: zones, burst, 429

• limit_req_zone $binary_remote_addr zone=api:10m rate=60r/m — the pool
• limit_req zone=api burst=20 nodelay — inside a location
• limit_req_status 429 — otherwise it's 503 by default
• limit_conn — concurrent connections (not requests)
• Logs: log_format with $limit_req_status for a fail2ban filter

# /etc/nginx/conf.d/rate-limits.conf
limit_req_zone  zone=api:10m rate=60r/m;
limit_req_zone  zone=login:10m rate=5r/m;
limit_req_status 429;

server {
  location /api/ {
    limit_req zone=api burst=20 nodelay;
    proxy_pass http://backend;
  }
  location /login {
    limit_req zone=login burst=3 nodelay;
    proxy_pass http://backend;
  }
}

# fail2ban filter (jail.d/nginx-rate.conf)
[Definition]
failregex = limiting requests, excess.*client: <HOST>

• Setup fail2ban
• Token Bucket