Improve DDoS attack defense at the network and transport layers - Anti-DDoS

IP-specific mitigation policies filter malicious traffic during network-layer or transport-layer DDoS attacks without disrupting legitimate operations. Rules include AI-based intelligent protection, blacklists and whitelists, geo-blocking, port blocking, and packet fingerprint filtering. This topic describes how to create, modify, and manage IP-specific mitigation policies.

Limitations

Standard cloud assets support only IP-specific mitigation policies. Enhanced cloud assets support both IP-specific and port-specific mitigation policies. When both are configured, IP-specific policies take precedence.
A public IP address can be bound to only one IP-specific mitigation policy.
Custom mitigation policies are specific means by which Anti-DDoS Native intercepts traffic. Traffic intercepted by a custom mitigation policy is still counted toward attack traffic statistics.

Before you begin

To protect standard cloud assets: regardless of the Anti-DDoS Native edition (1.0, 2.0, or post-paid), add public IP addresses to the protected objects first.
To protect enhanced cloud assets: Anti-DDoS Native automatically adds purchased enhanced cloud assets to protected objects. No manual action is required.

Create an IP-specific mitigation policy

Step 1: Create basic information

Go to the Mitigation Settings page of the Traffic Security console.
Click Create Policy. In the dialog box that appears, enter a Policy Name, and then click OK.
After the policy is created, click OK in the The policy is created. dialog box to go to the Create Rule page.

Note
You can also find the newly created policy on the policy list page and click Modify Mitigation Policy to go to the rule configuration panel.

Step 2: Configure mitigation rules

On the Create Rule page, configure the following mitigation rules.

Rule effectiveness notes

Priority of rule effectiveness:
- Standard cloud assets: ICMP protocol blocking > Whitelist > Blacklist > Geo-blocking > Port blocking > Packet fingerprint filtering.
- Enhanced cloud assets: ICMP protocol blocking > Whitelist > Blacklist > Geo-blocking > Port blocking > Packet fingerprint filtering > Reflection attack filtering > Source rate limiting.
Rule effectiveness duration: All rules take effect permanently except the blacklist, which requires a duration setting.
Rule effectiveness timing: Note that some rules take effect only during attacks.
- Takes effect during attacks: The rule activates only when Anti-DDoS Native detects attack traffic and initiates traffic scrubbing. It does not take effect in a non-attack state.
- Always in effect: The rule remains in effect regardless of the attack state.

Mitigation rule overview

Rule	Standard cloud assets	Enhanced cloud assets	Description
Intelligent Protection	Unsupported	Supported	The intelligent big data analysis engine automatically learns the baseline of business traffic and adaptively protects against DDoS attacks.
ICMP Blocking	Supported Takes effect during attacks	Supported Always in effect	Discards ICMP traffic during scrubbing to filter ICMP attacks and reduce server probing risk.
Blacklist and Whitelist	Supported Takes effect during attacks	Supported Always in effect	Configures filtering or allow rules based on source IP addresses. You can add up to 2,000 IP addresses to each blacklist and whitelist.
Location Blacklist	Supported Takes effect during attacks	Supported Always in effect	Blocks access requests based on geographic regions. You can block by region or country.
Port Blocking	Supported Takes effect during attacks	Supported Always in effect	Configures source or destination port filtering rules for UDP or TCP protocols. Supports up to 8 rules.
Source Rate Limiting	Unsupported	Supported Always in effect	Rate-limits source IP addresses whose access frequency exceeds the threshold. Supports four dimensions: PPS, BPS, SYN PPS, and PS.
Reflection Attack Filtering	Unsupported	Supported Always in effect	Applies only to UDP protocol traffic. Discards traffic from specified UDP reflection source ports. Supports default and custom rule types.
Byte-Match Filter	Supported Takes effect during attacks	Supported Always in effect	Matches packet features at specified locations and configures filtering, allowing, or rate limiting rules based on the match results.
Anti-DDoS Proxy Back-to-Origin Whitelisting	Unsupported	Supported	Adds the back-to-origin IP addresses of Anti-DDoS Proxy to the access control whitelist to prevent accidental blocking of business traffic.

Intelligent Protection

The intelligent big data analysis engine learns the baseline of business traffic and adaptively protects against network-layer and transport-layer DDoS attacks.

Applicable scenario: Always in effect for both standard and enhanced cloud assets.
Protection effect: Based on historical traffic data and expert experience algorithms, the protection levels are:

Important
After you create a policy template, this feature is enabled by default at the Normal. Optimal protection requires approximately 3 days of business traffic training.
- Loose: Blocks IPs with obvious attack patterns. Some attacks may pass through, but false positives are low.
- Normal: Blocks both obvious and suspected malicious IPs. Balances protection and false positives.
- Strict: Maximum defense, but higher false positive rate.
Configuration method:
1. On the rule configuration panel, find the Intelligent Protection section.
2. In the Level section, select a protection level: Loose, Normal, or Strict.

ICMP Blocking

Discards ICMP traffic during scrubbing to filter ICMP attacks and reduce server probing risk.

Applicable scenario: Takes effect during attacks for standard cloud assets. Always in effect for enhanced cloud assets.
Protection effect:
- When ICMP blocking is enabled, ping commands receive no responses.
  
  Warning
  Disable ICMP blocking before running network diagnostics. Otherwise, ping will not work.
- ICMP blocking also applies to whitelisted IPs. ICMP traffic from whitelisted IPs is discarded.
Configuration method:
1. On the rule configuration panel, find the ICMP Blocking section.
2. In the Status section, turn on or off the switch. Enable this rule if your business does not use ICMP.

Blacklist and Whitelist

Applicable scenario: Takes effect during attacks for standard cloud assets. Always in effect for enhanced cloud assets.
Protection effect: Configures rules to directly discard or allow traffic from specified source IPs.

Important
If the traffic allowed by the whitelist is too large, the allowed traffic may still hit the default destination IP rate limiting policy of Anti-DDoS Native due to cloud asset specifications and cloud platform guarantees.
Configuration method:
1. On the rule configuration panel, find the Blacklist and Whitelist section and click Settings.
2. Select Blacklist or Whitelist, and complete the configuration as follows.
  Blacklist
  1. Set the timeout period (Blacklist only): You must set a timeout period when adding a blacklist. The setting applies to all IPs in the blacklist.
    
    On the Blacklist tab, click Validity Period Setting.
    
    In the Validity Period Setting section of the dialog box, set the timeout period based on your business needs. You can select Custom (5 to 43,200 minutes), Permanent, 30 minutes, or other time periods.
  2. Add IP addresses:
    
    Click Add. The Blacklist Configuration configuration dialog box appears.
    
    In the configuration dialog box, enter the blacklist IP addresses. Separate multiple addresses with spaces or line breaks.
    
    Note
    You can manually add up to 2,000 IP addresses to the blacklist.
  Whitelist
  1. Click Add. The Whitelist Configuration configuration dialog box appears.
  2. In the configuration dialog box, enter the whitelist IP addresses. Separate multiple addresses with spaces or line breaks.
    
    Note
    You can manually add up to 2,000 IP addresses to the whitelist.

Location Blacklist

Blocks access requests based on geographic regions.

Applicable scenario: Takes effect during attacks for standard cloud assets. Always in effect for enhanced cloud assets.
Protection effect: Traffic from blocked regions to the destination IP is discarded. Block by region or country.
Configuration method:
1. On the rule configuration panel, find the Location Blacklist section.
2. In the region selection list, select the regions or countries to block, and then click OK.
  
  Note
  Block all regions without legitimate business traffic.

Port Blocking

Configures source or destination port filtering rules for UDP or TCP protocols.

Applicable scenario: Takes effect during attacks for standard cloud assets. Always in effect for enhanced cloud assets.
Protection effect: Discards traffic from specified protocol ports. Use this to filter UDP reflection attacks.
Configuration suggestions:
- If your assets use only TCP traffic, block all UDP source ports.
  
  Note
  Adjust the policy if you add UDP services later.
- If your assets use UDP traffic, block common UDP reflection source ports: 1–52, 54–161, 389, 1900, and 11211.
Configuration method:
1. On the rule configuration panel, click Settings in the Port Blocking section.
2. On the Configure Source Port Blocking page, click Add Port.
3. In the Add Port dialog box, complete the configuration as follows and click OK to save the rule.
  
  Note
  Supports up to 8 rules.
  - Protocol: Select the protocol type: TCP or UDP.
  - Source Port Range, Destination Port Range: Set the source port range and destination port range.
  - Action: Only Discard is supported.

Source Rate Limiting

Rate-limits source IP addresses whose access frequency exceeds the threshold.

Applicable scenario: Supported only by enhanced cloud assets. Always in effect.
Protection effect: Source IPs that exceed the threshold are blacklisted, and all their traffic is discarded.
Configuration method:
1. On the rule configuration panel, click Settings in the Source Rate Limiting section.
2. On the Configure Source Rate Limiting panel, turn on the rate limiting dimension switch (Source PPS, Source Bandwidth, PPS of Source SYN Packets, or Bandwidth of Source SYN Packets), and enter the rate limit threshold.
3. (Optional) Enable the auto-add-to-blacklist feature: Select If a source IP address triggers rate limiting five times within 60 seconds, the IP address is added to the blacklist.. IPs that exceed the rate limit 5 times within 60 seconds are added to the blacklist.

Byte-Match Filter

Applicable scenario: Takes effect during attacks for standard cloud assets. Always in effect for enhanced cloud assets.
Protection effect: Forged attack packets typically share feature fields such as specific strings or identical content. Match content at specified packet locations to filter, allow, or rate-limit traffic.
Configuration method:
1. On the rule configuration panel, click Settings in the Byte-Match Filter section.
2. On the Configure Byte-Match Filter panel, click Add Feature.
3. On the Add Byte-Match Filter Rule page, complete the configuration as follows and click OK.
  - Protocol: TCP or UDP.
  - Source Port Range: Source port range. Valid values: 0 to 65535.
  - Destination Port Range: Destination port range. Valid values: 0 to 65535.
  - Packet Length Range: The length range of the IP packet. Valid values: 1 to 1500. Unit: bytes.
  - Offset: The offset of the data body (payload) after the UDP or TCP header. Valid values: 0 to 1500. Unit: bytes.
    
    When the offset is 0, matching starts from the first byte of the data body.
  - Payload: The content of the data body (payload) to match. Enter a hexadecimal string with a length of 1 to 15 bytes. You do not need to include the "0x" prefix for hexadecimal values. For example, to match 0xad, enter only "ad".
  - Action: The action to perform on traffic after a feature match. Valid values: Pass, Discard, Limit Bandwidth of Source IP Address, and Limit Bandwidth of Session. If you select Limit Bandwidth of Source IP Address or Limit Bandwidth of Session, you must also set a rate limit value.
    
    Note
    Limit Bandwidth of Session refers to all cookies carried in each request.

Anti-DDoS Proxy Back-to-Origin Address Whitelisting

Adds Anti-DDoS Proxy back-to-origin IP addresses to the access control whitelist. Supported only by enhanced cloud assets. When protecting enhanced cloud assets, traffic is forwarded back to the origin through the Anti-DDoS Proxy scrubbing center. Enable this to prevent accidental blocking of legitimate business traffic.

Configuration method:

On the rule configuration panel, find the Add Back-to-origin CIDR Blocks of Anti-DDoS Proxy to Whitelist section.
Turn on or off the switch. Strongly recommended for enhanced cloud assets.

Step 3: Select protected objects

After configuring the mitigation rules, click Next to go to the protected objects selection page.

In the Objects to Select section of the Protected Assets page, select the protected objects (public IP addresses) to which you want to apply this policy.
Click Add. After the mitigation policy is created, click Back. On the Mitigation Settings page, you can view the newly created policy.

Note

A public IP address can be bound to only one IP-specific mitigation policy. If an IP is already bound to another policy, the original policy no longer applies to that IP after you bind a new one.

Modify an IP-specific mitigation policy

On the Mitigation Settings page, locate the target policy and click Modify Mitigation Policy in the Actions column.
In the Modify Mitigation Policy panel that slides out from the right, modify mitigation rules based on your business needs. Each rule follows the same configuration described in the "Create an IP-specific mitigation policy" section.
After making modifications, click OK at the bottom of the panel to save your changes.

Warning

Modified policies take effect immediately for all associated protected objects. Proceed with caution.

Manage protected objects

On the Mitigation Settings page, locate the target policy and click Add Object for Protection in the Actions column.
On the View Applicable Object page, perform the following operations:
- Add Object for Protection:
  
  Note
  A public IP address can be bound to only one IP-specific mitigation policy. If an IP is already bound to another policy, the original policy no longer applies to that IP after you bind a new one.
  1. Click Add Object for Protection above the list.
  2. In the Objects to Select section of the Protected Assets page, select the protected objects (public IP addresses) to which you want to apply this policy.
  3. Click Add at the bottom.
- Delete: Click Delete in the Actions column for the target IP.
- Delete: Select multiple target IPs and click Delete below the list.
After saving the changes, return to the policy list page and verify that the Add Object for Protection column for the target policy displays the updated number of protected objects.

Delete an IP-specific mitigation policy

On the Mitigation Settings page, locate the target policy and click Delete in the Actions column.
In the confirmation dialog box that appears, confirm the policy name and click Delete.

Important

You cannot delete a policy associated with protected objects. Remove all associated protected objects first.

Configuration examples

Configure IP-specific mitigation policies for standard cloud assets under large-volume network-layer or transport-layer attacks based on your traffic characteristics.

Configuration item	Description
ICMP Blocking	Block ICMP traffic if your business does not use ICMP.
Blacklist and Whitelist	During attacks, add suspicious source IPs to the blacklist from the Attack Analysis page (up to 2,000 IPs). View attack event analysis.
Location Blacklist	Block all regions without business traffic. For example, if your business serves only mainland China, block all other regions.
Port Blocking	Block all UDP ports if your business does not use UDP.
Byte-Match Filter	Analyze attack traffic and configure fingerprint filtering based on attack features.