All Products
Search
Document Center

Dynamic Content Delivery Network:Configure an IP address blacklist or whitelist

Last Updated:Feb 06, 2024

An IP blacklist or whitelist filters user requests, and blocks or allows requests from specified IP addresses. The IP list feature can protect points of presence (POPs) from IP theft and attacks. This topic describes how to configure an IP blacklist or whitelist.

Description

  • By default, the IP list feature is disabled. The IP blacklist and whitelist are mutually exclusive. You can configure only one of the lists.

  • You can configure up to about 700 IPv6 addresses and 2,000 IPv4 addresses.

  • If an IP address is added to the blacklist, requests from the IP address can reach POPs but are rejected by the POPs, the HTTP 403 status code is returned, and requests from the IP address are recorded in the logs of DCDN.

  • The IP blacklist and whitelist identify IP addresses based on Layer 7 HTTP IP recognition techniques. You are charged for network traffic that is generated when POPs block malicious requests. If clients access POPs over HTTPS, fees are generated for resources that are consumed to process the HTTPS requests on the POPs.

IP address verification modes

When a client connects to a POP, the client IP address and the IP address that is used by the client to connect to the POP are determined based on whether a proxy is used. For example, the client IP address is 10.10.10.10, and the proxy IP address is 192.168.0.1.

  • If no proxy is used when a client connects to a POP, the following rules apply:

    • The value of the X-Forwarded-For (XFF) header in the user request is 10.10.10.10.

    • The client IP address 10.10.10.10 is the IP address that is used by the client to connect to the POP.

  • If a proxy is used when a client connects to a POP, the following rules apply:

    • The value of the XFF header in the user request is 10.10.10.10,192.168.0.1.

    • The client IP address 10.10.10.10 is the first IP address in the XFF header.

    • The IP address that is used by the client to connect to a POP is the IP address of the proxy, which is 192.168.0.1.

    • The client IP address is not the IP address that is used by the client to connect to the POP.

The IP list feature of DCDN supports three IP address verification modes. The following table describes the verification modes.

IP address verification mode

Description

Determine based on the XFF header

This is the default mode. This mode verifies only the client IP address. The client IP address is the first IP address in the XFF header in a client request.

If a proxy is used when a client connects to a POP, the client uses the IP address of the proxy to connect to the POP. In this case, access control in this verification mode may not be accurate.

Determine based on the IP address that is used to connect to the POP

This mode verifies only the IP address that is used by a client to connect to a POP.

Determine based on the XFF header and the IP address that is used to connect to the POP

This mode verifies the following IP addresses:

  • The first IP address in the XFF header, which is the client IP address.

  • The IP address that is used by a client to connect to a POP.

Procedure

  1. Log on to the DCDN console.

  2. In the left-side navigation pane, click Domain Names.

  3. On the Domain Names page, find the domain name whose acceleration region you want to change and click Configure.
  4. In the left-side navigation tree of the domain name, click Access Control.

  5. Click the IP Blacklist or Whitelist tab.

  6. Click IP Blacklist or Whitelist and configure a Blacklist or Whitelist as prompted.

    配置IP黑白名单

    Parameter

    Description

    Type

    The following types of IP lists are supported:

    • Blacklist

      Requests from IP addresses in the blacklist are blocked.

    • Whitelist

      Only requests from IP addresses in the whitelist can access resources on the POPs.

    Rules

    Enter CIDR blocks, such as 192.168.0.0/24, or IP addresses, such as 192.168.0.1. Make sure that the CIDR blocks are not duplicated. IPv4 and IPv6 addresses are supported. Separate IP addresses with carriage return characters.

    • IPv6: You can add up to about 700 IPv6 addresses to the list. The blacklist and whitelist support IPv6 addresses. The letters in IPv6 addresses are not case-sensitive. Examples: FC00:AA3:0:23:3:300:300A:1234 and fc00:0aa3:0000:0023:0003:0300:300a:1234. The notation of an IPv6 address must not be shortened. For example, FC00:0AA3::0023:0003:0300:300A:1234 is invalid. CIDR blocks are supported. Example: FC00:0AA3:0000:0000:0000:0000:0000:0000/48.

    • IPv4: You can add up to about 2,000 IPv4 addresses to the list.

    • The total length of the string that specifies IP addresses cannot exceed 30 KB in size.

    Note

    You cannot use 0.0.0.0/0 to specify all IP addresses.

    • To specify all IPv4 addresses, use the following subnets:

      • 0.0.0.0/1

      • 128.0.0.0/1

    • To specify all IPv6 addresses, use the following subnets:

      • 0000:0000:0000:0000:0000:0000:0000:0000/1

      • 8000:0000:0000:0000:0000:0000:0000:0000/1

    IP Rules

    You can select one of the following rules:

    • Determine based on the XFF header

    • Determine based on the IP address that is used to connect to the POP

    • Determine based on the XFF header and the IP address that is used to connect to the POP

    If the XFF header does not include an IP address, determine based on the IP address that is used to connect to the POP.

  7. Click OK.

Sample configurations

  • Whitelist

    Rules: 192.168.2.0/24

    Expected result: Only IP addresses that range from 192.168.2.1 to 192.168.2.254 can access the resources of the specified domain name.

  • Blacklist

    Rules: 192.168.0.1

    Expected result: The IP address 192.168.0.1 is not allowed to access the resources of the specified domain name.

Related API operations

BatchSetDcdnDomainConfigs: configures an IP address blacklist or whitelist for multiple domain names at a time. The ip_black_list_set parameter specifies an IP address blacklist and the ip_allow_list_set parameter specifies an IP address whitelist.