How to Configure Nginx Rate Limiting on Ubuntu 24.04 LTS to Prevent DDoS & Brute-Force Attacks

 When running a web application on an Ubuntu 24.04 LTS server, your web server is constantly exposed to automated vulnerability scanners, brute-force login attempts, and application-layer Denial-of-Service (DoS) attacks.

While network-level firewalls like UFW protect your ports, they cannot inspect HTTP traffic behavior. To protect your login endpoints, API routes, and general web traffic from being flooded by malicious bots, you must configure Nginx Rate Limiting.

In this step-by-step guide, we will explore how to set up and fine-tune rate limiting in Nginx on Ubuntu 24.04 LTS to keep your server fast and secure.

What is Nginx Rate Limiting?

Nginx rate limiting uses the ngx_http_limit_req_module module. It works on the "leaky bucket" algorithm, which restricts the amount of requests a user can process in a given amount of time.

If a client exceeds the defined threshold (e.g., trying to load a login page 20 times per second), Nginx will delay the excess requests or block them entirely with a 509 Service Temporarily Unavailable or custom error code.

Prerequisites

Before configuring Nginx rate limits, ensure you have:

An Ubuntu 24.04 LTS server with Nginx installed and running.

Root or sudo privileges.

(Recommended) Your system firewall already secured by following our guide on How to Set Up UFW Firewall on Ubuntu 24.04 LTS.

Step 1: Define the Rate Limit Zone in Nginx Config

First, open the main Nginx configuration file (nginx.conf) using your preferred text editor:sudo nano /etc/nginx/nginx.conf

Inside the http { ... } block, define your rate-limiting zone using the limit_req_zone directive.

Add the following lines:http {

    # Define a memory zone of 10MB named "ip_ratelimit" allowing 10 requests per second per IP

    limit_req_zone $binary_remote_addr zone=ip_ratelimit:10m rate=10r/s;

    # Other existing configurations.

..

}

$binary_remote_addr: Tracks requests based on the client's IP address.

zone=ip_ratelimit:10m: Allocates 10 megabytes of RAM to store IP states (roughly 160,000 IP addresses).

rate=10r/s: Limits clients to a maximum of 10 requests per second. (You can change this to rate=60r/m for requests per minute).

Save and close the file (Ctrl+O, Enter, then Ctrl+X).

Step 2: Apply the Rate Limit to Specific Server Blocks

Now, apply the defined rate limit zone to your website or application's server block configuration (usually located in /etc/nginx/sites-available/default).

Open your site configuration file:sudo nano /etc/nginx/sites-available/default

Inside your server { ... } block, apply the rule using limit_req:server {

    listen 80;

    server_name yourdomain.com;

    root /var/www/html;

    index index.html index.htm;

    location / {

        # Apply the rate limit zone with a burst allowance of 20 extra requests

        limit_req zone=ip_ratelimit burst=20 nodelay;

        

        try_files $uri $uri/ =4

04;

    }

}

What do these parameters mean?

burst=20: Allows a client to burst past the 10r/s limit for up to 20 extra requests temporarily instead of immediately throwing an error.

nodelay: Tells Nginx not to delay excess requests during a burst, but rather process or reject them immediately if they exceed the burst threshold.

Step 3: Apply Strict Rate Limiting to Login Pages (Brute-Force Defense)

Login pages (/login or /wp-login.php) are prime targets for automated brute-force attacks. You can create a separate, stricter rate limit zone specifically for sensitive URLs.

First, add a secondary strict zone in /etc/nginx/nginx.conf:http {

    # General limit

    limit_req_zone $binary_remote_addr zone=ip_ratelimit:10m rate=10r/s;

    

    # Strict login limit (only 1 request per second allowed)

    limit_req_zone $binary_remote_addr zone=login_ratelimit:10m rate=1r

/s;

}

Next, apply it inside your site block for your login route:server {

    # ... existing settings ...

    location = /login {

        limit_req zone=login_ratelimit burst=5 nodelay;

        try_files $uri $uri/ =404;

 

   }

This prevents bots from spamming your login credentials while leaving normal browsing smooth.

Step 4: Test and Reload Nginx

Before applying changes live, always check your Nginx configuration for syntax errors:

}

sudo nginx -t

If the test returns syntax is ok and test is successful, reload Nginx to apply the changes:sudo systemctl reload nginx

Conclusion

By configuring Nginx rate limiting on Ubuntu 24.04 LTS, you successfully add an application-layer defense against DoS attacks, web scrapers, and brute-force attempts.

Combine this setup with comprehensive server hardening to maximize your infrastructure security:

How to Set Up UFW Firewall on Ubuntu 24.04 LTShttps://mobilestuff2026.blogspot.com/2026/10/how-to-set-up-ufw-firewall-on-ubuntu.html

How to Secure SSH with Fail2ban on Ubuntu 24.04 LTShttps://mobilestuff2026.blogspot.com/2026/10/how-to-configure-fail2ban-to-protect.html

How to Configure Fail2ban to Protect Nginx Server on Ubuntu 24.04 LTShttps://mobilestuff2026.blogspot.com/2026/10/how-to-configure-nginx-rate-limiting-on.html

How to Secure Docker Contaihttps://mobilestuff2026.blogspot.com/2026/10/how-to-secure-docker-containers-on.htmlners on Ubuntu 24.04 LTS