nginx limit_req and limit_conn not working to prevent DoS attack

[Phani Sreenivasa Prasad]

Hi All,

I am using nginx in our products. When I run goldeneye DoS attack script
against nginx, it is not able to defend against the attack and normal users
getting impacted.  

python goldeneye.py http://<ipaddress> -w 5 -s 10000 -m random -d

we are using below nginx limit_req options but didnt help. The nginx
documentation says that, these options are used to limit the request rating
limit per key. below is some sample configuration that we tried. The problem
is, when we use these nginx options, it still keeps nginx  busy responding
with 503 or some other error code for all those requests beyond the rate
limit . Hence any genuine user when trying to access webserver during the
attack time, not getting chance to access our server and timing out or
getting 500 error.

http {
    limit_req_zone $binary_remote_addr zone=one:10m rate=5r/s;

    ...

    server {

        limit_req zone=one ;
        ...

        location /sampleurl/ {
            
        }

(Note: also tried limit_conn options and behavior is same).



Why should nginx respond back with any error code rather it should drop
connections !! otherwise it can't protect itself against any DoS attack.
please share the thoughts.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,275796,275796#msg-275796