In the documentation for the ngx_http_limit_req_module it says
A client IP address serves as a key. Note that instead of $remote_addr, the $binary_remote_addr variable is used here, that allows decreasing the state size down to 64 bytes. One megabyte zone can keep about 16 thousand 64-byte states. If the zone storage is exhausted, the server will return the 503 (Service Temporarily Unavailable) error to all further requests.
Unfortunately it fails to say how big it will be if you don't use the binary version of the ip address. I need to use $http_x_forwarded_for as the key, how big will each state be in this case?
This is an educated guess, not 100% knowledge.
An IP address takes 4 bytes in binary form, since it is a 32-bit integer.
In text form, an IP address takes 15 bytes (xxx.xxx.xxx.xxx), and the string needs end delimiter, the null character.
Therefore my best guess is that the IP address takes 16 bytes instead of 4 bytes. In this context, it would mean that each state would take 72 bytes instead of 64 bytes.
However, depending on internal implementation, it could take even more.