Rate limiting is an important security feature for any API to prevent unauthorized access from excessive requests. However, implementing rate limiting can be challenging when not done properly as it can limit legitimate users too. Here are some tips on how to fix node.js rate limiting problems:

1. Use a Rate Limiting Middleware: Node.js has several popular libraries for rate limiting such as express-rate-limit and koa-ratelimit. These middlewares will handle the heavy lifting of rate limiting for you, and will automatically ban IP addresses that are making too many requests.

const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100 // limit each IP to 100 requests per windowMs
});

app.use(limiter);

2. Set Timeouts and Limits Correctly: It's important not to set the limits too low or high. If a user is making 5 requests in 60 seconds, they should only be able to make 100 requests in an hour instead of unlimited. Also, it's better to have timeouts for requests that exceed the limit so that the API doesn't become unresponsive.

3. Monitor Your API: Use logging and monitoring tools such as Logstash or New Relic to monitor your API and identify any potential rate limiting issues. This will help you to identify which IP addresses are causing problems and adjust your rate limiting settings accordingly.

4. Consider Using a Reverse Proxy: A reverse proxy can be used to handle rate limiting on the server-side, before requests reach your Node.js app. This will allow you to have more control over your rate limiting configuration without having to modify your Node.js app directly.

5. Use Dynamic Rate Limiting: Instead of setting a static limit for all users, consider implementing dynamic rate limiting that takes into account the user's behavior and their IP address. For example, you can set different limits for users with different accounts or IP addresses.

Remember, rate limiting is just one security feature, and it should be used in conjunction with other security measures such as authentication and authorization.