Anti-DDoS Proxy provides mitigation policy settings against Layer 4 DDoS attacks, such as false source detection, empty connection detection, Rate Limit for Source, and Speed Limit for Destination. These settings are used to optimize and adjust the DDoS mitigation policies of non-website services. This topic describes how to add a DDoS mitigation policy.
Feature overview
The DDoS mitigation policies for non-website services provide protection at the “IP address + port” level. For the “IP address + port” combinations of non-website services that are added to Anti-DDoS Proxy instances, these policies limit parameters such as the connection rate and the packet length to mitigate low-volume connection flood attacks. A DDoS mitigation policy takes effect at the port level.
Anti-DDoS Proxy provides the following DDoS mitigation policies for non-website services that are added:
False Source: verifies and filters DDoS attacks launched from forged IP addresses.
Advanced Attack Mitigation: identifies and blocks DDoS attacks in which botnets such as Mirai send a large volume of abnormal packets within a short period after establishing a TCP three-way handshake.
NoteThis configuration is supported for IPv4 Anti-DDoS Proxy IP addresses but not for IPv6 Anti-DDoS Proxy IP addresses.
Session Feature Filtering: accurately identifies and protects normal service features or attack packet features based on the payload features of session packets. You can also configure matching policies based on application-layer protocols.
NoteOnly IPv4 Anti-DDoS Proxy IP addresses of the Enhanced function plan of Anti-DDoS Proxy (Chinese Mainland) support this configuration.
Whitelist: sets a whitelist on a per-port basis. Access requests from IP addresses in the whitelist are directly allowed and are not intercepted.
Rate Limit for Source: collects statistics on the current Anti-DDoS Proxy IP address and port, and rate-limits the source IP addresses whose access frequency exceeds the threshold. Access from source IP addresses whose access rate does not exceed the threshold is not affected. Rate Limit for Source supports blacklist control. For a source IP address that exceeds the limit five times within 60 seconds, you can enable the policy of adding the source IP address to the blacklist and set the validity period of the blacklist.
Speed Limit for Destination: collects statistics on the current Anti-DDoS Proxy IP address and port. When the access frequency per second exceeds the threshold, the port of the current Anti-DDoS Proxy IP address is rate-limited. The other ports are not affected by the rate limit.
Packet Length Limit: sets the minimum and maximum lengths of the payload contained in the packets that are allowed to pass through the Anti-DDoS Proxy IP address port. Packets that are shorter than the minimum length or longer than the maximum length are discarded.
Prerequisites
A non-website service is added to Anti-DDoS Proxy. For more information, see Manage forwarding rules.
Configure a single DDoS mitigation policy
Log on to the General Policies page in the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.
Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.
On the General Policies page, click the Protection for Non-website Services tab, and then select the Anti-DDoS Proxy instance that you want to configure at the top of the page.
In the forwarding rule list on the left, click the forwarding rule that you want to configure, and then configure the mitigation policy.
False Source: applies only to TCP port forwarding rules.
Parameter
Description
False Source
After this feature is enabled, connection requests from forged source IP addresses are automatically filtered.
When you disable False Source, Empty Connection is also disabled.
If you disable False Source, neither Empty Connection nor Advanced Attack Mitigation takes effect.
Empty Connection
After this feature is enabled, empty connection requests are automatically filtered. You must first enable False Source before you can enable Empty Connection.
Advanced Attack Mitigation: applies only to TCP port forwarding rules. After this feature is enabled, the protection level is Normal by default. To enable Advanced Attack Mitigation, you must first enable False Source.
Protection level
Protection effect
Common scenarios
Loose
Blocks requests that have obvious attack characteristics. A small number of attacks may pass through, but the false positive rate is extremely low.
Suitable for services that involve large amounts of one-way data transmission, such as live streaming, streaming media, and downloads, or services whose origin server has large bandwidth.
Normal (recommended)
In most cases, this level does not affect normal services and balances the protection effect against the false positive rate. Select this level for general use.
Suitable for most business scenarios.
Strict
Performs strict verification on malicious attacks but may cause some false positives.
Suitable for scenarios in which the origin server has limited bandwidth or the protection effect is poor.
Session Feature Filtering: sets custom accurate access control rules based on session packets (payload). If a rule contains multiple match conditions, the action is performed only when all conditions are met.
NoteThe intelligent accurate access control rules issued by AI intelligent protection are also displayed here.
Parameter
Description
Rule Name
The custom name of the rule.
Match Conditions
Match Conditions: the format of the session packet (payload). You can select String or Hexadecimal.
Match Range: the start and end positions of the payload to match. Valid values of the start position and the end position: 0 to 1499. Unit: bytes. The start position must be less than or equal to the end position.
Logical Operator: Valid values: Include and Not Include.
Field Value:
Match Conditions is set to String. In this case, the length of the match content cannot exceed 1500, and the length of the match content must be less than or equal to (end position - start position + 1).
Match Conditions is set to Hexadecimal. In this case, the match content must consist of hexadecimal characters, the length cannot exceed 3000, and the length must be an even number. The length of the match content divided by 2 must be less than or equal to (end position - start position + 1).
Action
Monitor: If the request matches the observe rule, the access request is allowed.
Block: If the request matches the block rule, the access request is denied.
Block and Add to Blacklist: If the request matches the block rule, the access request is denied and the source IP address is added to the blacklist. The blacklist duration can be set to 300 to 600 seconds.
Whitelist: You can manually add up to 2000 IP addresses or CIDR blocks to each whitelist.
IPv4 Anti-DDoS Proxy instances support only IP addresses or CIDR blocks in IPv4 format. IPv6 Anti-DDoS Proxy instances support only IP addresses or CIDR blocks in IPv6 format.
IPv4 CIDR blocks support /8 to /32. IPv6 CIDR blocks support /32 to /128.
IPv4 addresses cannot be set to 0.0.0.0 or 255.255.255.255. IPv6 addresses cannot be set to :: or ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff.
Rate Limit for Source:
Parameter description:
Parameter
Description
New Connections Limit for Source
Limits the number of new connections per second from a single source IP address. Valid values: 1 to 50,000. Unit: connections. New connections that exceed the limit are discarded.
Automatic: The system dynamically and automatically calculates the rate limit threshold for new connections per source IP address. You do not need to set the threshold manually.
Manual: You must manually set the rate limit threshold for new connections per source IP address.
NoteBecause the protection devices are deployed in a cluster, the rate limit on new connections has a margin of error.
Concurrent Connections Limit for Source
Limits the number of concurrent connections from a single source IP address. Valid values: 1 to 50,000. Unit: connections. Concurrent connections that exceed the limit are discarded.
PPS Limit for Source
Limits the number of packets forwarded from a single source IP address. Valid values: 1 to 100,000. Unit: packets/s. Data packets that exceed the limit are discarded.
Bandwidth Limit for Source
Limits the source request bandwidth from a single source IP address. Valid values: 1024 to 268,435,456. Unit: bytes/s.
Blacklist policy:
The If the number of new connections from a source exceeds the limit five times within 60 seconds, the source IP address is added to the blacklist. option is supported. If a source IP address is added to the blacklist, all connection requests from the IP address are discarded.
When you enable the blacklist policy, you must set Blacklist Validity Period. Valid values: 1 to 10,080. Unit: minutes. Default value: 30 minutes. After a source IP address is added to the blacklist, the IP address is automatically released when the validity period ends.
Speed Limit for Destination: TCP port forwarding rules and UDP port forwarding rules have different default settings.
TCP port forwarding rules
Parameter
Description
New Connections Limit for Destination
Limits the maximum number of new connections per second on the Anti-DDoS Proxy IP address port. New connections that exceed the limit are discarded. Valid values: 100 to 100,000. Unit: connections.
This feature is enabled by default, and the value is 100,000.
This feature cannot be disabled. If you disable the feature, the value is restored to the default value of 100,000.
NoteBecause the protection devices are deployed in a cluster, the rate limit on new connections has a margin of error.
Concurrent Connections Limit for Destination
Limits the maximum number of concurrent connections on the Anti-DDoS Proxy IP address port. Concurrent connections that exceed the limit are discarded. Valid values: 1000 to 2,000,000. Unit: connections.
This feature is enabled by default, and the value is 2,000,000.
This feature cannot be disabled. If you disable the feature, the value is restored to the default value of 2,000,000.
UDP port forwarding rules
Parameter
Description
New Connections Limit for Destination
Limits the maximum number of new connections per second on the Anti-DDoS Proxy IP address port. New connections that exceed the limit are discarded.
This feature is disabled by default. Valid values: 100 to 50,000. Unit: connections.
NoteBecause the protection devices are deployed in a cluster, the rate limit on new connections has a margin of error.
Concurrent Connections Limit for Destination
Limits the maximum number of concurrent connections on the Anti-DDoS Proxy IP address port. Concurrent connections that exceed the limit are discarded. Valid values: 1000 to 200,000. Unit: connections.
This feature is enabled by default, and the value is 200,000.
This feature cannot be disabled. If you disable the feature, the value is restored to the default value of 200,000.
Packet Length Limit: In the Packet Length Limit section, click Settings, and then set the minimum and maximum lengths of the payload contained in the packets that are allowed to pass through the Anti-DDoS Proxy IP address port. Valid values: 0 to 1500. Unit: bytes. Then, click OK.
Add DDoS mitigation policies in batches
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.
Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.
In the left-side navigation pane, choose .
On the Port Config page, select the Anti-DDoS Proxy instance, and then click below the rule list.
In the Create Mitigation Policy dialog box, enter the mitigation policy content that you want to add in the required format, and then click OK.
NoteYou can also batch export the current DDoS mitigation policies, adjust the policies in the exported TXT file, and then copy and paste the content into the dialog box. The format of the DDoS mitigation policies in the exported file is the same as the format required for adding DDoS mitigation policies in batches. For more information, see Export multiple port configurations at a time.
Each line corresponds to the DDoS mitigation policy of one forwarding rule.
Each DDoS mitigation policy contains the following fields from left to right: forwarding protocol port, forwarding protocol (tcp or udp), new connections limit for source, concurrent connections limit for source, new connections limit for destination, concurrent connections limit for destination, minimum packet length, maximum packet length, false source switch, and empty connection switch. The fields are separated by spaces.
The forwarding protocol port must be a port for which a forwarding rule is configured.
The values of the false source switch and the empty connection switch are on and off. If the value is empty, the switch is turned off (that is, off).