The document outlines the new features and improvements introduced in NGINX Plus R20, including enhanced monitoring and logging capabilities, rate limiting in dry-run mode, dynamic bandwidth control, and key-value store enhancements. It also highlights the support for multiple DNS resolvers per upstream group, security improvements for HTTP/2, and updates to NGINX's scripting language, njs. Notable features include real-time connection limiting metrics and the ability to dynamically route Layer 7 traffic with prefix matching.

1. NGINX Plus R20
NEW FEATURES AND HIGHLIGHTS
Liam Crilly
Director, Product Management
22-Jan-2020

2. NGINX Overview
UNIFIED APPLICATION DELIVERY AND API MANAGEMENT SOLUTION

3. Internet
Web Server
Serve content from disk
Reverse Proxy
FastCGI, uWSGI, gRPC…
Load Balancer
Caching, SSL termination…
HTTP traffic
- Basic load balancer
- Content Cache
- Web Server
- Reverse Proxy
- SSL termination
- Rate limiting
- Basic authentication
- 7 metrics
NGINX Open Source NGINX Plus
+ Advanced load balancer
+ Health checks
+ Session persistence
+ Least time algos
+ Cache purging
+ HA/Clustering
+ JWT Authentication
+ OpenID Connect SSO
+ NGINX Plus API
+ Key-value store
+ Dynamic modules
+ 90+ metrics
What is NGINX?

4. 4
“... when I started NGINX,
I focused on a very specific
problem – how to handle more
customers per a single server.”
- Igor Sysoev, NGINX creator and founder

5. Introducing NGINX
5
2004
• NGINX
0.1
2007
• “Viable”
e”
2011
• NGINX, Inc.
Inc.
• NGINX 1.0
2013
• NGINX Plus R1
R1
2018
• NGINX Unit 1.0
• Controller 1.0
2019
• Controller 2.0
2.0
(API mgmt.)
• Acquired by
F5 Networks
• NGINX Plus
R20

6. Previously on…
• More flexible monitoring
◦ Finer-grained insight and analysis of metrics
- Location block
- DNS lookup activity
- Cluster state sharing.
◦ Metrics can be exported in Prometheus or JSON format.
◦ Live dashboard is extended to include additional metrics.
• Rate limiting in dry-run mode
◦ Recognize and log the effects of rate limits without
applying it in production
• Dynamic bandwidth control
◦ Set bandwidth limits based on attributes of incoming
requests
• Enhancements to the Key-Value Store
◦ Entries support IP subnets with CIDR annotation for
dynamic whitelisting/blacklisting
Watch On Demand: search “r19 webinar” at nginx.com

7. NGINX Plus R20 Overview
• Real-time monitoring and logging of rate/connection limiting activity
◦ Get real-time data on request/connection limiting with the NGINX Plus API
• Key-Value prefix matching
◦ Dynamically route L7 traffic with prefix matching
• Support for DNS resolver per upstream group
◦ Designate a DNS resolver for each upstream group giving more control to backend service owners
• Extract PROXY Protocol server metadata
◦ New NGINX variables included that capture information of the originating client and TCP proxies
• Security improvements for HTTP/2

8. Rate limit metrics and logging
8
• Each request can either be
passed, delayed, or rejected
• All requests not passed are
logged in the reject.log file
• All requests are logged in the
access.log file
• API endpoint*
/api/6/http/limit_reqs
limit_req_zone $request_uri zone=by_uri:10m rate=1r/s;
log_format kv 'client=$remote_addr uri=$request_uri'
'limit_req=$limit_req_status';
map $limit_req_status $in_excess {
default 1;
PASSED 0;
}
server {
listen 80;
location /by-uri/burst5_nodelay {
limit_req zone=by_uri burst=5 nodelay;
limit_req_dry_run on;
proxy_pass http://my_backend;
}
access_log /var/log/nginx/access.log main;
access_log /var/log/nginx/reject.log kv if=$in_excess;
}
*NGINX Plus

9. Connection Metrics and Logging
9
• Connections can either
get passed or rejected
• API endpoint*
/api/6/http/limit_conns
• Extended with the same
enhancements to rate limiting
in R19
◦ Dry run mode
◦ New $limit_conn_status variable
limit_conn_zone $realip_remote_addr zone=by_ip:2m;
server {
listen 80;
location / {
limit_conn_by_ip 10;
limit_conn_dry_run on;
if ($limit_conn_status = REJECTED_DRY_RUN) {
limit_rate 100;
}
proxy_pass http://my_backend;
}
}
*NGINX Plus

11. Keyval prefix match
11
• type=prefix parameter to
keyval_zone
• Ideal for matching on URI
paths
• Dynamic routing tables
and more
keyval_zone zone=paths:128K type=prefix timeout=2m;
keyval $uri $cache_control_dir zone=paths;
server {
listen 80;
location / {
proxy_pass http://my_backend
add_header Cache-Control $cache_control_dir
}
}
NGINX Plus

13. DNS Resolvers per Upstream
13
• Different DNS servers or
registries are designated to each
upstream group
Note: We are including the
status_zone parameter for
monitoring resolver activity
upstream website {
zone website 64k;
resolver 192.168.56.101 valid=300s status_zone=website;
resolver_timeout 5s;
server www-backend.prod.example.com resolve;
}
upstream mobile {
zone mobile_app 64k;
resolver 192.168.57.55 192.168.57.56 status_zone=consul;
resolver_timeout 10s;
server mobile.prod.example.com resolve;
}
server {
listen 443 ssl;
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
ssl_certificate /etc/ssl/nginx/example.crt;
ssl_certificate_key /etc/ssl/nginx/example.key;
location / {
proxy_pass http://website;
}
}
NGINX Plus

14. Additional Features
• HTTP/2 improvements
• Variables for PROXY Protocol
◦ $proxy_protocol_server_addr – IP address of the proxy server to which
client originally connected to.
◦ $proxy_protocol_server_port – Port of proxy server to which the client
connected to.
• NJS features and improvements added
◦ https://www.nginx.com/blog/introduction-nginscript/
◦ https://www.nginx.com/en/docs/njs/index.html

15. Summary
• Monitoring and logging rate/connection limiting metrics with the NGINX
Plus API
• Dry-run for connection limiting
• Prefix matching for keyval (type=prefix)
• DNS resolver per upstream group
• Variables capturing metadata of the PROXY protocol
• Security improvements with HTTP/2
• Supporting more JavaScript objects with njs