# Limiting number of connections to upstream servers **URL:** \ **Category:** NGINX\ **Created:** [April 27, 2010, 6:07pm UTC](https://www.ruby-forum.com/t/limiting-number-of-connections-to-upstream-servers/187677 "2010-04-27T18:07:49Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![brama](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/aca169/32.png) [@brama](https://www.ruby-forum.com/u/brama)\ **Post date:** [April 27, 2010, 6:07pm UTC](https://www.ruby-forum.com/t/limiting-number-of-connections-to-upstream-servers/187677/1 "2010-04-27T18:07:49Z")
Hello, Currently we use nginx 0.7 in combination with multiple fastcgi backends that process requests dynamically without caching. We’d like to prevent a DOS attack by limiting the number of connections handled simultaneously for each backend. I’m wondering what the best way is to do this. I’d love to be able to specify the maximum number of open connections for each upstream server individually; that seems to be the most straighforward solution. I couldn’t find anything in the docs that would allow one to do this though. There’s worker\_processes and worker\_connections, but they’re global to the entire nginx server. Since the server also handles static requests (many more than dynamic fcgi requests), there’s little I can do with that. The other solution I can think of, is by having the fcgi backend processes monitor the number of connections they’re handling. That has the drawback that each type of backend process must be able to do this. Also, I imagine it could happen that one backend would refuse to handle a connection, while another backend still had some open slots. Nginx itself could handle that better. How should this best be resolved? Posted at Nginx Forum: > **[Limiting number of connections to upstream servers](https://forum.nginx.org/read.php?2,79962,79962#msg-79962)** > > Hello, Currently we use nginx 0.7 in combination with multiple fastcgi backends that process requests dynamically without caching. We'd like to prevent a DOS attack by limiting the number of connections handled simultaneously for each backend. I'm... ---
**Author:** ![brama](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/aca169/32.png) [@brama](https://www.ruby-forum.com/u/brama)\ **Post date:** [May 2, 2010, 12:13pm UTC](https://www.ruby-forum.com/t/limiting-number-of-connections-to-upstream-servers/187677/2 "2010-05-02T12:13:02Z")
Nothing? Is there anything else I should be looking at to prevent overloading a backend? E.g. splitting off nginx configs into 1 instance for dynamic requests, and 1 for static requests? The dynamic requests nginx would then limit connections by setting worker.max\_connections, and assuming it fairly distributes requests over the multiple (identical) backends? Posted at Nginx Forum: > **[Re: Limiting number of connections to upstream servers](https://forum.nginx.org/read.php?2,79962,81620#msg-81620)** > > Hello, Currently we use nginx 0.7 in combination with multiple fastcgi backends that process requests dynamically without caching. We'd like to prevent a DOS attack by limiting the number of connections handled simultaneously for each backend. I'm... ---
**Author:** ![brama](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/aca169/32.png) [@brama](https://www.ruby-forum.com/u/brama)\ **Post date:** [May 4, 2010, 6:08am UTC](https://www.ruby-forum.com/t/limiting-number-of-connections-to-upstream-servers/187677/3 "2010-05-04T06:08:01Z")
A bit o On Sunday, May 2, 2010, brama [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Nothing? Is there anything else I should be looking at to prevent overloading a backend? > > E.g. splitting off nginx configs into 1 instance for dynamic requests, and 1 for static requests? The dynamic requests nginx would then limit connections by setting worker.max\_connections, and assuming it fairly distributes requests over the multiple (identical) backends? It’s a bit of a hack, but you could have nginx proxy to itself and then to the backend. At the middle layer, you use connection limits. You could probably even use error\_page to have clients random wait and retry if the backend was too busy. – RPM ---
**Author:** ![brama](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/aca169/32.png) [@brama](https://www.ruby-forum.com/u/brama)\ **Post date:** [May 5, 2010, 12:43am UTC](https://www.ruby-forum.com/t/limiting-number-of-connections-to-upstream-servers/187677/4 "2010-05-05T00:43:41Z")
You could direct your traffic to something like HAProxy. It can detect upstream server failures. I am not sure what facilities are available for NGinx. Posted at Nginx Forum: > **[Re: Detecting upstream server failures](https://forum.nginx.org/read.php?2,82436,82661)** > > I'm using the nginx as a reverse proxy server, with the upstream module, successfully doing round-robin load balancing between two backend servers. Is there some way I can determine if one of the back end servers has gone down? Nginx will seamlessly... ---
**Author:** ![brama](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/aca169/32.png) [@brama](https://www.ruby-forum.com/u/brama)\ **Post date:** [May 4, 2010, 3:08pm UTC](https://www.ruby-forum.com/t/limiting-number-of-connections-to-upstream-servers/187677/5 "2010-05-04T15:08:15Z")
I’m using the nginx as a reverse proxy server, with the upstream module, successfully doing round-robin load balancing between two backend servers. Is there some way I can determine if one of the back end servers has gone down? Nginx will seamlessly take it out of pool if it does go down, which is great, but it would be handy to know about it so some alert could be sent to the admin. ---
**Author:** ![brama](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/aca169/32.png) [@brama](https://www.ruby-forum.com/u/brama)\ **Post date:** [May 5, 2010, 4:35am UTC](https://www.ruby-forum.com/t/limiting-number-of-connections-to-upstream-servers/187677/6 "2010-05-05T04:35:27Z")
John M. at 2010-5-4 21:07 wrote: > I’m using the nginx as a reverse proxy server, with the upstream > module, successfully doing round-robin load balancing between two > backend servers. Is there some way I can determine if one of the back > end servers has gone down? Nginx will seamlessly take it out of pool > if it does go down, which is great, but it would be handy to know > about it so some alert could be sent to the admin. See this: > **[GitHub - cep21/healthcheck\_nginx\_upstreams: Health checks upstreams for nginx](https://github.com/cep21/healthcheck_nginx_upstreams)** > > Health checks upstreams for nginx > * * * > > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx) – Weibin Y. ---
**Author:** ![brama](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/aca169/32.png) [@brama](https://www.ruby-forum.com/u/brama)\ **Post date:** [May 6, 2010, 8:27pm UTC](https://www.ruby-forum.com/t/limiting-number-of-connections-to-upstream-servers/187677/7 "2010-05-06T20:27:58Z")
iptables -A INPUT -p tcp -m tcp --dport 111 --tcp-flags FIN,SYN,RST,ACK SYN -m connlimit --connlimit-above 1024 --connlimit-mask 32 -j REJECT –reject-with tcp-reset Posted at Nginx Forum: > **[Re: Limiting number of connections to upstream servers](https://forum.nginx.org/read.php?2,79962,83446)** > > Hello, Currently we use nginx 0.7 in combination with multiple fastcgi backends that process requests dynamically without caching. We'd like to prevent a DOS attack by limiting the number of connections handled simultaneously for each backend. I'm...