cis-nginx-v300-5-2-4

name	cis-nginx-v300-5-2-4
description	Ensure the number of connections per IP address is limited (Manual)
category	cis-nginx
version	3.0
author	cyberstrike-official
tags	["cis","nginx","web-server","reverse-proxy","request-limits","request-filtering"]
cis_id	5.2.4
cis_benchmark	CIS NGINX Benchmark v3.0.0
tech_stack	["nginx","linux","web-server"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 5.2.4 — Ensure the number of connections per IP address is limited

Profile Applicability

• Level 2 - Webserver
• Level 2 - Proxy
• Level 2 - Loadbalancer

Description

NGINX's ngx_http_limit_conn_module provides a mechanism to limit the number of simultaneous connections from a single client IP address. This is achieved in two steps:

• limit_conn_zone: This directive, typically defined in the http block, creates a shared memory zone to store the state for each client IP address.
• limit_conn: This directive, applied in a server or location block, enforces a specific connection limit using the previously defined zone.

When a client exceeds this limit, NGINX will reject new connections with a 503 Service Temporarily Unavailable error.

Rationale

The primary purpose of connection limiting is to mitigate resource exhaustion and certain types of Denial of Service (DoS) attacks where an attacker opens many connections and holds them open for as long as possible. It is a different tool than rate limiting (limit_req), which is designed to stop rapid-fire requests (like brute-force attacks). By enforcing a reasonable connection limit, the server can prevent a single malicious or misconfigured client from consuming an unfair share of worker connections.

Impact

This is a critical consideration. A single public IP address can represent thousands of individual users behind a large corporate NAT, a university campus, or a Carrier-Grade NAT (CG-NAT) from a mobile provider. Setting the connection limit too low will block legitimate users in these scenarios. The appropriate limit is a delicate balance and depends entirely on the target audience. A public-facing website requires a much higher limit than a restricted admin interface.

Audit Procedure

This is a manual check requiring context.

1. Run the following command to inspect the loaded NGINX configuration for connection limiting rules:

nginx -T 2>/dev/null | grep -E '^\s*(limit_conn_zone|limit_conn)'

2. Manually evaluate the findings:

• Is a limit_conn_zone defined in the http block?
• Is a limit_conn directive applied in the appropriate server or blocks?