:What do I do if Anti-DDoS Proxy returns 502 errors?

Possible cause 1: Back-to-origin IP addresses are blocked or throttled

The instance scrubs traffic and forwards it to your origin server using back-to-origin IP addresses. If these IP addresses are not in your firewall's whitelist, traffic from the instance is blocked and the website becomes inaccessible.

Add the back-to-origin CIDR blocks of Anti-DDoS Proxy to the whitelist of your origin server firewall or security software. For more information, see Allow back-to-origin IP addresses to access the origin server.

Possible cause 2: Origin server exceptions

If the origin server is unavailable, requests from the instance time out. Common causes:

• The origin server IP address is exposed and under attack.

• Data center failures.

• Web services (Apache, NGINX) on the origin server are down or unresponsive.

• High memory or CPU usage on the origin server.

• Network uplink congestion on the origin server.

Troubleshooting steps:

1. Edit your local hosts file to resolve the domain directly to the origin server IP address, bypassing Anti-DDoS Proxy. Test whether the origin server responds.

   Test result	Description
   Failed to access the origin server IP address	The origin server itself is faulty. Check the following: Check network connectivity: Use Analyze network links using the MTR tool to verify the network path from your device to the origin server IP address. Check port connectivity: Run telnet to verify the service port is open on the origin server.
   Successfully accessed the origin server IP address	Check the Anti-DDoS Proxy instance for configuration errors.

2. Check for sudden traffic spikes on the origin server to determine whether its IP address is exposed to direct DDoS attacks.

   Compare with monitoring data in the Anti-DDoS Proxy console. If the origin server is under volumetric attack but the console shows no anomalies, attackers may be bypassing the instance. The origin server IP address is likely exposed. Change the static public IP address to resolve this.

   Note

   • Normally, clients send requests to the Anti-DDoS Proxy instance, which forwards them to the origin server. The origin server sees all traffic from the instance's back-to-origin IP addresses. The original client IP is passed in the X-Forwarded-For HTTP header.

   • If the origin server IP address is exposed, attackers can bypass the instance and target the origin server directly.

3. Check CPU usage, memory usage, bandwidth, and service process status on the origin server. Resolve any anomalies found.

Possible cause 3: Connection timeout mismatch

If the origin server's idle connection timeout is shorter than the Anti-DDoS Proxy timeout, the origin server closes connections that the instance still considers valid, causing 502 errors on subsequent requests.

Set the origin server's idle connection timeout to a value greater than or equal to the Anti-DDoS Proxy timeout.

Possible cause 4: Network congestion or jitter

Transient network jitter or carrier line failures between the instance and origin server can also cause 502 errors.