What is the difference between $remote_addr and $proxy_add_x_forwarded_for?

$remote_addr is the immediate IP address of the client connected directly to Nginx. If the request traverses Cloudflare or an AWS ALB, $remote_addr will be the load balancer IP. $proxy_add_x_forwarded_for appends the client IP to the existing chain of upstream proxies.

Why should I use $binary_remote_addr instead of $remote_addr in limit_req_zone?

$remote_addr stores IPv4 addresses as variable-length text strings (7 to 15 bytes). $binary_remote_addr stores IPv4 as a fixed 4-byte binary integer, saving over 60% of shared memory space across large IP tracking tables.

Production Nginx Hardening: Buffer Tuning, Rate Limiting, and TLS 1.3 to Defeat Slowloris & HTTP Floods | DreaInno Engineering Notes

Production Nginx Hardening: Buffer Tuning, Rate Limiting, and TLS 1.3 to Defeat Slowloris & HTTP Floods

Default Nginx configs leave APIs vulnerable to buffer overflow and connection starvation. Master client_body_buffer_size, rate limit zones, HSTS preloading, and zero-downtime reload workflows.

Mayuresh Pandit • DreaInno Studio ↗

Principal Systems Architect

10 min read • 2026-10-04

Nginx powers over 30% of the world's top one million web servers. Yet out of the box, standard default Linux package configurations (/etc/nginx/nginx.conf) are tuned for generic file serving, leaving modern REST and GraphQL APIs susceptible to Slowloris connection exhaustion, header buffer overflows, and unthrottled scraping.

The Reverse Proxy Buffer Architecture

When an HTTP client connects to your backend service (Node.js, FastAPI, Go, Django), network speeds vary dramatically. A mobile client on an unstable 3G connection might take 15 seconds to transmit a 500 KB POST request.

If your application server accepts that client connection directly, an execution thread remains blocked for 15 seconds waiting for incoming bytes. Nginx acts as a high-speed memory sponge: it absorbs the slow payload into local RAM, delivers it to your upstream over local loopback in microseconds, and frees the application process immediately.

# Buffer Tuning Directives for API Gateways
client_body_buffer_size 128k;
client_max_body_size 16M;
client_header_buffer_size 1k;
large_client_header_buffers 4 8k;

# Timeouts to defeat Slowloris connection attacks
client_body_timeout 12;
client_header_timeout 12;
keepalive_timeout 65;
send_timeout 10;

Defeating Brute Force with Leaky-Bucket Rate Limiting

Unprotected authentication and payment endpoints invite credential stuffing. Nginx implements the leaky bucket algorithm via the limit_req_zone directive:

# Allocate 10 Megabytes of shared memory for tracking client IP addresses
# 10MB can hold approximately 160,000 distinct IP state records
limit_req_zone $binary_remote_addr zone=api_gateway:10m rate=10r/s;

server {
    listen 443 ssl http2;
    server_name api.clientdevtools.online;

    location /v1/auth/ {
        # Allow brief burst of 5 requests; nodelay immediately processes or rejects with HTTP 429
        limit_req zone=api_gateway burst=5 nodelay;
        limit_req_status 429;
        
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Hardened TLS 1.3 Profile & HSTS Preload

Legacy ciphers (RC4, 3DES, CBC mode ciphers) are vulnerable to BEAST, POODLE, and Sweet32 attacks. A production Nginx configuration must restrict negotiation strictly to TLS 1.2 and TLS 1.3:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;

# Strict-Transport-Security (2 Years with subdomains and preload)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;

Where to Host Production Reverse Proxies

Because an edge reverse proxy terminates SSL handshakes and buffers high-volume TCP traffic, processor single-core frequency and network bandwidth are paramount:

Edge KVM Compute: For dedicated routing infrastructure with guaranteed CPU performance and predictable pricing, deploying on Hostinger KVM VPS (20% extra savings) gives you dedicated IPv4 addresses, root SSH privileges, and NVMe SSD caching partitions.
VPC Multi-Tier Topology: For enterprise compliance setups where Nginx sits in a public DMZ subnet while databases remain isolated on private non-routable 10.x.x.x IPs, DigitalOcean Cloud ($200 in free trial credits) provides elastic Cloud Firewalls and private VPC peering out of the box.

Zero-Downtime Reload Discipline

Never restart Nginx using systemctl restart nginx in production. That tears down active TCP sockets. Instead, validate your configuration syntax before issuing a graceful worker reload:

# Step 1: Validate syntax
sudo nginx -t

# Step 2: Gracefully reload workers (zero dropped connections)
sudo nginx -s reload

Build production-ready configurations matching these exact specifications with our client-side Nginx Config Builder.