---
title: "Connection limit"
url: "/reference/filters/network/connection-limit/"
kind: "reference"
summary: "Network filter that caps the number of concurrently active connections on a filter chain."
---

> Arion site index: [/llms.txt](/llms.txt)

# Connection limit

Network filter that caps the number of concurrently active connections on a filter chain.

| Attachment | Type URL (`@type`) | Per-route override | Build feature |
|---|---|---|---|
| Filter chain (`filters`) | `type.googleapis.com/envoy.extensions.filters.network.connection_limit.v3.ConnectionLimit` | Not applicable | None |

## What it does

The connection limit filter caps how many connections a filter chain serves *at the same time*. The count lives in one process-wide atomic shared by all worker runtimes, so the cap holds exactly no matter how connections are spread across workers. Excess connections are closed at once, or held open for `delay` first — a cheap brake on connection-flood clients. It bounds concurrency; to bound the accept *rate*, use the [listener local rate limit](@/reference/filters/listener/local-rate-limit.md).

## Minimal configuration

From `arion-runtime-connection-limit.yaml`; the fragment sits under `filter_chains[].filters`, before the terminal filter:

```yaml,arion=fragment
- name: connection_limit
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.network.connection_limit.v3.ConnectionLimit
    stat_prefix: cx_limit
    max_connections: 100
    delay: 1s
```

## Fields

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `stat_prefix` | string | Yes | — | Prefix for this filter's statistics. |
| `max_connections` | uint64 | Yes | — | Maximum active connections on this filter chain. |
| `delay` | duration | No | unset | Hold an over-limit connection open this long before closing it. Unset closes immediately. |

The Envoy field `runtime_enabled` is not supported; a configuration that sets it is refused at startup.

## Ordering and interactions

At most one connection limit filter per chain, always before the terminal filter. At runtime it is the first per-chain check on a new connection, ahead of the [rate limit](@/reference/filters/network/rate-limit.md) and [RBAC](@/reference/filters/network/rbac.md) filters. A slot is released the moment its connection closes. Rejections happen at the TCP level, so clients see a reset rather than an HTTP status. Debug logging is available under the `connection_limit` target (`RUST_LOG=connection_limit=debug`).