Also, the rate limiting is probably meant to be based upon the client's IP, not the proxy IP. Usually, the proxy adds the client IPs to the request headers and you can use those in Nginx rules.