All Products
Search

This Product

    Anti-DDoS:Restore workloads after blackhole filtering is triggered on an Elastic Compute Service (ECS) instance

    Document Center

    Anti-DDoS:Restore workloads after blackhole filtering is triggered on an Elastic Compute Service (ECS) instance

    Last Updated:Oct 22, 2026

    When blackhole filtering is triggered on an Elastic Compute Service (ECS) instance, Alibaba Cloud discards all inbound traffic, which prevents external access to the IP address. Outbound traffic is also blocked, which prevents the server from connecting to external networks (for example, calls to WeChat APIs or third-party APIs may time out). This is expected behavior of blackhole filtering, not an internal server fault. You can first estimate the time when blackhole filtering is automatically deactivated and wait for automatic deactivation. After blackhole filtering is deactivated, the public IP address automatically becomes accessible again, and you do not need to restart the services or the instance. If workloads are urgent, you can also restore workloads quickly by changing the public IP address of the ECS instance or migrating workloads to another ECS instance. This topic describes how to restore workloads after blackhole filtering is triggered on an ECS instance.

    Important

    After you change the public IP address of an ECS instance or replace the server, attackers can still get the new IP address, for example, by pinging the domain name, and launch another attack. To resolve the underlying issue, purchase Anti-DDoS Native or Anti-DDoS Proxy.

    Estimate the time when blackhole filtering is automatically deactivated

    If you have not purchased Anti-DDoS Native or Anti-DDoS Proxy, you can only wait for blackhole filtering to expire and be deactivated automatically. If you have purchased Anti-DDoS Native or Anti-DDoS Proxy, you can manually deactivate blackhole filtering after your workloads are protected, instead of waiting for automatic deactivation. For instructions, see deactivate blackhole filtering (Anti-DDoS Native) and deactivate blackhole filtering (Anti-DDoS Proxy).

    1. View the time when the ECS instance was last attacked.

      Log on to the Traffic Security console. On the Event Center page, find the public IP address of the ECS instance, click Details, and view the time of the last attack.

      Note

      If an asset is subject to multiple DDoS attacks, the blackhole filtering deactivation time is calculated from the time when the most recent DDoS attack ends.

    2. View the current blackhole filtering deactivation time.

      On the Assets page, view the current blackhole filtering deactivation time. This value is the total duration of blackhole filtering. The default duration is 2.5 hours. The actual duration varies with how frequently the asset is attacked and ranges from 30 minutes to 24 hours. In rare cases, it can be longer.

    3. Estimate the time when blackhole filtering is automatically deactivated.

      For example, if the last attack occurred at 12:30 and the current blackhole filtering deactivation time is 150 minutes, blackhole filtering is expected to be deactivated at 15:00.

      Note

      This time is only an estimate. If the public IP address continues to receive DDoS attacks, the time may be extended.

    You can wait for blackhole filtering to expire and be deactivated automatically. If workloads are urgent, use one of the following methods to restore workloads quickly.

    Important

    After you change the public IP address of the ECS instance or replace the server, promptly update DNS resolution settings, database connection settings, and other settings based on your workloads.

    Solution 1: Change the public IP address of an ECS instance

    Important

    If you frequently change the public IP address of an ECS instance after blackhole filtering is triggered, the server remains under attack, and the attack traffic may pose risks to the cloud platform. This may cause the platform to impose restrictions on your Alibaba Cloud account, including, but not limited to, preventing the purchase of new instances.

    Change an elastic IP address (EIP)

    1. (Optional) Apply for a new elastic IP address (EIP).

      For instructions, see Apply for EIPs.

    2. Disassociate the EIP from the ECS instance.

      For instructions, see Disassociate an EIP from a cloud resource.

      Important

      • After a pay-as-you-go EIP is disassociated, you must still pay the EIP configuration fee. Release the EIP if you no longer need it.

      • After a subscription EIP is disassociated, you can unsubscribe from the EIP instance if you no longer need it. For more information, see Rules for unsubscribing from resources.

    3. Associate the new EIP with the ECS instance.

      For instructions, see Associate an EIP with a cloud resource.

    Change a static public IP address

    Within 6 hours after the instance is created

    Within 6 hours after the instance is created, you can directly use the console to Change Public IP Address.

    Prerequisites

    • The instance is in the Stopped (Stopped) state.

      Note

      If the billing method of the instance is pay-as-you-go and the network type is Virtual Private Cloud (VPC), enable standard mode when you stop the instance. If economical mode is enabled, you cannot change the static public IP address. For details, see Economical mode.

    • You can change the static public IP address of an instance no more than three times.

      Note

      If you need to change the public IP address after three changes, see More than 6 hours after the instance is created.

    Example

    1. Log on to the ECS console.

    2. In the left-side navigation pane, choose Instances & Images > Instance.

    3. At the top left of the page, select the resource group and region of the target resource.

    4. Find the instance whose public IP address you want to change. In the Actions column, choose icon1 > Network and Security Group > Change Public IP Address.

    5. In the Change Public IP Address dialog box, confirm that the information is correct and click OK.

      After the change is complete, the dialog box displays the new public IP address.

    More than 6 hours after the instance is created

    More than 6 hours after the instance is created, you cannot directly change the existing static public IP address. You can reassign a static public IP address to the instance as follows:

    1. Convert the static public IP address of the ECS instance, except for a subscription instance that is billed by pay-by-bandwidth, to an EIP. The IP address remains unchanged.

      For instructions, see Convert static public IP to EIP.

      Important

      • If the billing method of the instance is subscription, this operation is not supported within 24 hours before the instance expires.

      • For a subscription instance that is billed by pay-by-bandwidth, first use Change bandwidth billing for a static public IP to change the billing method to Pay-by-traffic, and then perform this operation.

    2. Disassociate the converted EIP.

      For instructions, see Disassociate an EIP from a cloud resource.

      Important

      • After a pay-as-you-go EIP is disassociated, you must still pay the EIP configuration fee. Release the EIP if you no longer need it.

      • After a subscription EIP is disassociated, you can unsubscribe from the EIP instance if you no longer need it. For more information, see Rules for unsubscribing from resources.

    3. Adjust the Internet bandwidth of the ECS instance to more than 1 Mbps to assign a new static public IP address to the instance.

      For instructions, see Modify for subscription instance or Modify for pay-as-you-go instance.

    Solution 2: Use an image to create an ECS instance with the same configuration and replace the server

    1. Create a custom image for the ECS instance on which blackhole filtering is triggered. For instructions, see Create custom image.

      Note

      (Recommended) Create snapshots for ECS instances regularly during O&M. When you need to restore workloads quickly, create a custom image from a snapshot to restore the workloads. For instructions, see Create policy and Create a custom image from a snapshot.

    2. Use the custom image to quickly create an ECS instance with the same configuration. For instructions, see Create from custom image or shared image.

    Solution 3: Replace the server by using Server Migration Center (SMC)

    Server Migration Center (SMC) is a migration platform provided by Alibaba Cloud. (Recommended) Use SMC to migrate the ECS instance on which blackhole filtering is triggered into a custom image, and then create a new ECS instance from the custom image.

    1. Import the ECS instance on which blackhole filtering is triggered as an SMC migration source. For instructions, see Step 1: Import the information of a migration source.

    2. Create a migration task to migrate system configurations and business data into a custom image. For instructions, see Step 2: Create and start a migration task.

    3. Use the custom image to quickly create an ECS instance with the same configuration. For instructions, see Create from custom image or shared image.

    Solution 4: Log on to the ECS instance on which blackhole filtering is triggered and migrate business data

    An ECS instance on which blackhole filtering is triggered cannot be remotely connected to over the Internet. However, you can try to connect by using Workbench, session management, Virtual Network Computing (VNC), or an ECS instance in the same VPC.

    For detailed instructions about how to connect to an ECS instance by using Workbench, session management, or VNC, see Connect to your instance. This topic uses a connection through an ECS instance in the same VPC as an example.

    Usage notes

    The ECS instance must be in the same region, VPC, and security group as the ECS instance on which blackhole filtering is triggered, and the network must be connected. For details about security groups, see Overview.

    Procedure

    1. Log on to the private IP address or public IP address of a healthy ECS instance.

    2. On the healthy ECS instance, use a command or a tool to connect to the private IP address or public IP address of the ECS instance on which blackhole filtering is triggered.

      The following table lists common connection methods.

      Operating system of the ECS instance on which blackhole filtering is triggered

      Operating system of the healthy ECS instance

      Connection method

      References

      Windows

      Windows

      Connect by using Remote Desktop Connection (MSTSC).

      Use RDP client or Windows App

      Linux

      Connect by using the rdesktop tool.

      Linux

      Windows

      Connect by using the PuTTY tool.

      Linux

      Connect by using a Secure Shell (SSH) command.

      ssh root@<static public IP address or EIP>

    3. Transfer files to the healthy ECS instance.

    FAQ

    What do I do if blackhole filtering is triggered on my IP address and I cannot change the public IP address?

    Blackhole filtering that is triggered by a volumetric DDoS attack cannot be deactivated manually. You must wait until the system determines that the attack has stopped and blackhole filtering is automatically deactivated.

    If workloads are urgent but account restrictions or resource conditions prevent you from changing the public IP address, you can only wait for blackhole filtering to be deactivated automatically. You can refer to the "Estimate the time when blackhole filtering is automatically deactivated" section of this topic to estimate the blackhole filtering deactivation time.

    To prevent another blackhole event from affecting your workloads, purchase Anti-DDoS Native (Enterprise) or Anti-DDoS Proxy based on your workload requirements to improve protection capabilities. For details about Anti-DDoS products, see What is Anti-DDoS Native? and What is Anti-DDoS Proxy?.

    References