Add the back-to-origin IP addresses of Anti-DDoS Proxy to the allowlist of your origin server's security software to prevent legitimate traffic from being blocked.
Why this is required
Anti-DDoS Proxy works as a reverse proxy in Full NAT mode. After you add your website for protection, all scrubbed traffic is forwarded to your origin server from a limited set of back-to-origin IP addresses. Each address forwards a large volume of requests.
Without an IP address allowlist in placeall, the origin server's security software (firewalls, security groups, or other DDoS mitigation policies) may treat these IP addresses as malicious due to the high request volume. This can cause:
Blocked traffic: The origin server blocks or rate-limits back-to-origin IP addresses, making your website inaccessible.
502 errors: The origin server does not respond to forwarded requests because its firewall blocks the back-to-origin IP addresses.
Add the back-to-origin IP addresses to the allowlist before you change the DNS record to route traffic through Anti-DDoS Proxy. This prevents service interruptions during the switchover.
Procedure
Log on to the Anti-DDoS Proxy Console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland)
Anti-DDoS Proxy (Outside Chinese Mainland)
In the left-side navigation pane, choose .
In the upper-right corner of the Website Config page, click View Back-to-origin CIDR Blocks. In the dialog box that appears, copy the back-to-origin IP addresses of Anti-DDoS Proxy.
Add the back-to-origin IP addresses to the allowlist of the security software on your origin server.