The location blacklist feature blocks access traffic from specified regions with one click at Anti-DDoS Proxy traffic scrubbing centers to stop illegitimate requests. This topic describes how to configure a location blacklist.
Overview
Anti-DDoS Proxy supports two types of location blacklist policies: the location blacklist for an Anti-DDoS Proxy instance and the location blacklist for domain names.
Location blacklist for an Anti-DDoS Proxy instance: the feature described in this topic. The blocking policy takes effect on all services that the Anti-DDoS Proxy instance protects.
Location blacklist for domain names: the blocking policy takes effect only on domain names. For more information, see Configure a location blacklist for domain names.
In most cases, configure the location blacklist for an Anti-DDoS Proxy instance for port services, and configure the location blacklist for domain names for website services. If you configure both, the location blacklist for the Anti-DDoS Proxy instance takes precedence.
For example, you configure a location blacklist for an Anti-DDoS Proxy instance to block traffic from regions outside the Chinese mainland. In this case, users in those regions cannot access the domain names that are associated with the instance, regardless of whether the location blacklist for domain names is configured.
Common scenarios
Assume that all legitimate users who access your Anti-DDoS Proxy instance are located in China. You can configure a location blacklist for the instance to block access requests from regions outside the Chinese mainland.
Effective duration
A location blacklist policy remains in effect long-term after you configure it.
Location blacklist versus near-origin traffic diversion
The location blacklist is implemented inside Anti-DDoS Proxy traffic scrubbing centers and drops traffic from specific regions at a location close to the attack target (near-destination traffic blocking). Anti-DDoS Proxy identifies and filters traffic based on the region to which the source IP address belongs. The location blacklist does not reduce the attack traffic that enters the Anti-DDoS Proxy network, and it is suitable for mitigating attacks that consume connection resources.
Compared with the location blacklist, near-origin traffic diversion generally uses the core routers of an Internet Service Provider (ISP) backbone network to drop traffic from specific regions at a location close to the attack source, such as traffic from regions outside the Chinese mainland. For more information, see Configure near-origin traffic diversion.
Currently, only Anti-DDoS Proxy (Chinese Mainland) supports the near-origin traffic diversion feature.
Limits
This feature does not support batch operations. To enable the location blacklist for multiple Anti-DDoS Proxy instances, you must configure each instance separately.
Prerequisites
You have purchased an Anti-DDoS Proxy (Chinese Mainland) instance. For more information, see Purchase an Anti-DDoS Proxy instance.
Procedure
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.
Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.
In the left-side navigation pane, choose .
On the Protection for Infrastructure tab, select the Anti-DDoS Proxy instance that you want to configure from the instance list on the left.
NoteYou can search for the target instance by instance ID or instance description.
Go to the Location Blacklist section and click Settings.
On the Configure Location Blacklist page, select the source locations of the access requests that you want to block, and then click OK.
Go back to the Location Blacklist section and turn on the Status switch of the location blacklist to apply the location blacklist settings to the Anti-DDoS Proxy instance.