All Products
Search

This Product

    Anti-DDoS:Onboard non-website services with a CNAME record

    Document Center

    Anti-DDoS:Onboard non-website services with a CNAME record

    Last Updated:Jun 20, 2026

    To protect a non-website service (Layer 4) with Anti-DDoS Proxy, you can add forwarding rules to point your service to an Anti-DDoS Proxy IP. However, to use a domain name for your service and enable automatic traffic failover across multiple Anti-DDoS Proxy IPs, we recommend onboarding the service by adding a domain and using a cname record.

    Background information

    Assume that you want to protect a gaming service with Anti-DDoS Proxy. You want users to obtain an Anti-DDoS Proxy IP by resolving the domain name of the game server (demo.aliyundoc.com). The service uses TCP ports 1234 and 5678, and the origin IP is 1.1.XX.XX.

    Procedure

    1. Add a website in Website Config to obtain a CNAME address.

      1. Log on to the Anti-DDoS Proxy console.

      2. In the top navigation bar, select the region of your instance.

        • Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.

        • Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.

      3. In the left-side navigation pane, choose Onboarding > Website Config.

      4. On the Website Config page, click Add Website. Configure the website parameters and then click Add.

        The following describes the parameters to configure:

        • Function Plan and Instance: Select the Anti-DDoS Proxy instances to associate with the domain name. In this example, two instances with the Enhanced function plan are used.

        • Websites: Enter the domain name of your service. In this example, enter demo.aliyundoc.com.

        • Protocol Type and Server Port: Keep the default settings.

        • Server Address: Select Origin IP Address and enter the IP address based on your scenario.

          • If a website service runs on the domain, you must specify the correct protocol type and origin IP.

          • Otherwise, you can enter any origin IP because Anti-DDoS Proxy does not use this configuration for traffic forwarding. Instead, it forwards traffic based on the forwarding rules you add in Step 2.

        For more information, see Add a website configuration.

      After you add the website, Anti-DDoS Proxy assigns a CNAME address to the domain name.

    2. Add forwarding rules.

      1. In the left-side navigation pane, choose Onboarding > Port Config.

      2. On the Port Config page, select an Anti-DDoS Proxy IP and click Create Rule.

        Note

        The Anti-DDoS Proxy IP is one of the IPs you associated with the domain in Step 1.

      3. In the Create Rule dialog box, configure the parameters based on your business requirements and click OK.

        The following describes the parameters to configure:

        • Forwarding Protocol: In this example, select TCP.

        • Redirection Port: In this example, enter 1234.

        • Origin Server Port: In this example, enter 1234.

        • Origin IP Address: Enter the actual origin IP. In this example, the IP is 1.1.XX.XX.

        For more information, see Configure port forwarding rules.

      4. Repeat the preceding two steps to add another forwarding rule for the current Anti-DDoS Proxy IP. Set both the forwarding port and origin server port to 5678. After the rules are created, the configured rules appear in the forwarding rule list. The Back-to-origin Mode is set to Round-robin, Session Persistence and Health Check are disabled by default, and the DDoS Protection Policy is enabled by default.

      5. Repeat the preceding three steps to configure the same forwarding rules for your other Anti-DDoS Proxy IPs.

    3. At your DNS provider for the domain (demo.aliyundoc.com), modify the DNS settings to add a cname record pointing to the CNAME address obtained in Step 1. In the record's settings, set the host record to game, select CNAME as the record type, and enter the CNAME address from Anti-DDoS Proxy as the record value (for example, xxx.aliyunddos0001.com).