Rate Limiting & Traffic Shaping Generator Online

What is this tool?

The API Rate Limiting Generator configures strict traffic control mechanisms for NGINX and HAProxy to protect your backend APIs from abuse, DDoS attacks, and brute-force login attempts.

Rate limiting is your first line of defense against malicious actors. By defining memory zones that track client IP addresses, you can restrict how many requests a single user can make per second. This tool helps you fine-tune these zones, configure burst tolerances, and implement distinct limits for different URL paths (like aggressive limits on /login and relaxed limits on /api/data).

How to Use This Tool

1. Define Shared Memory Zones: A zone is a block of RAM used by the load balancer to keep track of client request rates. You define the size (e.g., 10MB) and the average allowed rate (e.g., 5 requests per second).

2. Configure Burst & Nodelay: The 'burst' parameter defines how many requests a user can make above the average rate in a short spike before getting blocked. 'Nodelay' processes those burst requests instantly rather than artificially slowing them down.

3. Apply to Paths: You can create multiple rate limit zones and apply them selectively. For example, you can limit global traffic to 50 req/s, but restrict /api/login to just 2 req/s to prevent password guessing.

4. Handle Rejections: When a user exceeds the limit, the server drops the request and returns an HTTP 429 (Too Many Requests) or HTTP 503 status code.

Best Practices

Always use the `nodelay` flag in NGINX. Without it, NGINX will artificially 'delay' burst requests by holding them in a queue, which ties up server worker connections and increases latency.
Do not apply global rate limits to static assets (images, CSS, JS). Browsers request dozens of static files simultaneously; applying strict rate limits will cause your webpage to load partially or break completely.
Use a specific zone just for authentication endpoints (e.g., `/auth/login`, `/password/reset`). These should have extremely strict limits (like 1r/s) because a human cannot type passwords faster than that.
If your load balancer sits behind a CDN like Cloudflare, ensure you rate limit based on the `X-Forwarded-For` header or Cloudflare's `CF-Connecting-IP`, not the direct `$binary_remote_addr`.

Common Mistakes

Making the shared memory zone too small. In NGINX, a 1MB zone can track about 16,000 IP addresses. If your site gets massive traffic and the zone fills up, NGINX will start dropping the oldest IP tracking data, rendering the limit ineffective.
Confusing Rate Limiting with Connection Limiting. Rate Limiting (`limit_req`) controls HTTP requests per second. Connection Limiting (`limit_conn`) controls the number of simultaneous TCP connections from a single IP.
Setting the burst too low. APIs often make 'bursty' requests on page load. A limit of 2r/s with a burst of 0 means if a user clicks two links within the same second, the second one fails.

Security Notes

Return HTTP 429 (Too Many Requests) instead of the NGINX default HTTP 503 (Service Unavailable). This correctly informs API clients that they are being throttled and should back off.
Use rate limiting in combination with GeoIP blocking if you notice brute-force attacks originating entirely from countries you don't serve.
Log all rate-limited requests by ensuring `limit_req_log_level error;` is set. Monitor these logs in Grafana/ELK to adjust your limits if legitimate users are being blocked.

Production Tips

For globally distributed architectures with multiple NGINX nodes, local memory zones will not sync. In highly scaled environments, you must implement distributed rate limiting at the application layer (using Redis) or use an API Gateway like Kong.
Use HAProxy's `stick-table` feature for advanced, multi-dimensional rate limiting (e.g., limiting based on an API Key header rather than just the IP address).
Temporarily run rate limits in 'dry-run' mode (if supported by your enterprise software) or analyze your access logs before enforcing strict limits in production to establish a baseline.

Frequently Asked Questions

What does 'burst=20 nodelay' actually do?

It allows a client to exceed the average rate limit by up to 20 requests instantly ('nodelay'). However, they cannot exceed the average rate over a longer period. It absorbs sudden spikes while strictly enforcing the long-term average.

How do I return a custom JSON error instead of an HTML 429 page?

In NGINX, you can use the `error_page 429 /custom_429.json;` directive, and then define a location block for `/custom_429.json` that returns a `default_type application/json;` with your custom JSON string.

Does rate limiting protect against DDoS attacks?

It protects against Layer 7 (Application) volumetric attacks and brute force. However, it will not protect you against Layer 3/4 (Network) DDoS attacks, which will saturate your bandwidth before NGINX even sees the traffic.

How We Keep Your Configs Safe & Valid

Built-in Error Checking

Every file is checked against official rules. We catch missing fields and bad syntax. YAML indentation errors are flagged right away. Kubernetes, Terraform, and Docker specs are all covered. API versions and labels are verified too. You get valid output every time you generate.

100% Private & Local

All tools run in your browser only. Your API keys never leave your machine. We do not use any tracking scripts. No data is sent to any server. Passwords and secrets stay on your device. Crypto operations use the Web Crypto API. Your privacy is fully protected at all times.

Secure Settings by Default

Configs use safe defaults out of the box. Containers run as non-root users. Root filesystems are set to read-only. Dangerous Linux capabilities are dropped. Network policies limit pod-to-pod traffic. TLS 1.3 is enabled for web servers. Security headers are added where needed.

Ready for CI/CD & Git

Output files are ready for your Git repo. Use them with ArgoCD, Flux, or GitHub Actions. Files use clear formatting and comments. Code review is easy for your team. Indentation and key order are consistent. Test in staging before going to production. Every file is clean and well-structured.

Infrastructure as Code

Store configs in Git alongside your code. Terraform modules include typed variables. Backend configs support remote state locking. Outputs work across multiple modules. Ansible playbooks use clear task steps. Chef and Puppet configs are also supported. Every file works with version control tools.

Monitoring & Tracing

Set up Prometheus with auto-discovery rules. Create Grafana dashboards with template variables. Add alerting rules with severity labels. Use OpenTelemetry for trace collection. Forward logs to Loki or Elasticsearch. Connect to Jaeger or Tempo for tracing. Monitor metrics, logs, and traces together.

Container & Docker Safety

Dockerfiles use multi-stage builds for small images. Base images are pinned to exact versions. Dev files are excluded from final images. Health checks are added for orchestrator use. Containers switch to non-root users. Docker Compose uses named volumes and networks. Resource limits are set in deploy configs.

Multiple Output Formats

Export as YAML, JSON, HCL, or TOML. Kubernetes uses YAML with proper separators. Terraform uses HCL with correct escaping. JSON output has consistent indentation. Copy to clipboard with one click. Preview output with syntax highlighting. Line numbers help you review quickly.

Rate Limiting & Traffic Shaping Generator

Rate Limit Settings

Core Settings

Request Rate Limiting