Mitigating DDoS Attacks with NGINX

limit_req_zone $binary_remote_addr zone=one:10m rate=30r/m;
server {
    ...
    location /login.html {
        limit_req zone=one;
    ...
    }
}

limit_conn_zone $binary_remote_addr zone=addr:10m;

server {
    ...
    location /store/ {
        limit_conn addr 10;
        ...
    }
}

server {
    client_body_timeout 5s;
    client_header_timeout 5s;
    ...
}

location / {
    deny 123.123.123.0/28;
    deny 123.123.123.3;
    deny 123.123.123.5;
    deny 123.123.123.7;
    ...
}

location / {
    allow 192.168.1.0/24;
    deny all;
    ...
}

location /foo.php {
    deny all;
}

location / {
    if ($http_user_agent ~* foo|bar) {
        return 403;
    }
    ...
}

upstream website {
    server 192.168.100.1:80 max_conns=200;
    server 192.168.100.2:80 max_conns=200;
    queue 10 timeout=30s;
}