Limit the number of connections.

First of all, using the limit_conn_zone directive in the http section you should define key, name and set of parameters of shared memory zone for storing key value states:

        limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;

Next, use the limit_conn directive in the context of location to specify the name of the shared memory zone and the maximum allowed number of connections for one key value:

        location /download/ {
           limit_conn conn_limit_per_ip 5;
        }

Limit the number of requests per time unit.

Use limit_req_zone directive in http section to define key, name and set of shared memory zone parameters for storing key value states:

        limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=5r/s;

After that, using the limit_req directive in the location context, you should specify the name of the shared memory zone and the maximum size of the request burst:

        location /download/ {
           limit_req zone=req_limit_per_ip burst=10;
        }

Limit the rate at which the response is sent to the client.

In the limit_rate directive in the location section you can set the speed of response transmission to the client (in bytes per second) per one request (it means that if the client uses two connections the speed will be twice the limit):

        location /download/ {
           limit_rate 50k;
        }

It is also possible to use the directive limit_rate_after, which specifies the amount of data after which the limit of the response rate to the client will take effect:

        location /download/ {
           limit_rate_after 1m;
           { limit_rate 50k;
        }
Updated Sept. 11, 2018