All Products
Search

This Product

    CDN:Region-based blocking

    Document Center

    CDN:Region-based blocking

    Last Updated:Jun 20, 2026

    The region-based blocking feature of Alibaba Cloud CDN lets you allow or deny requests from specific regions based on the client's IP address. This helps mitigate malicious requests. This topic describes how to configure a blacklist or whitelist to use this feature.

    Enable region-based blocking

    1. Log on to the Alibaba Cloud CDN console.

    2. In the left navigation pane, click Domain Names.

    3. On the Domain Names page, find the domain name that you want to manage and click Manage.

    4. In the left navigation pane of the domain name, click Security Settings.

    5. On the Region Blacklist tab, click Create Rule.

    6. In the Blocking Settings dialog box, select Rule Condition, Blocking Type, Rule Condition, and Regions.

      Parameter

      Description

      Rule Condition

      A rule condition allows a rule to be applied only when a request meets specific criteria.

      • Do not use: Disables conditional rules.

      • You can add or edit conditional rules in the Rules engine.

      Blocking Type

      • Blacklist

        Requests from regions on the blacklist cannot access resources on the accelerated domain name.

      • Whitelist

        Only requests from regions on the whitelist can access resources on the accelerated domain name. Requests from all other regions are blocked.

      A blacklist and a whitelist are mutually exclusive.

      Regions

      Select the regions to add to the blacklist or whitelist.

    7. Click OK to complete the configuration.

    Cancel region-based blocking

    To cancel region-based blocking, click Clear. Alibaba Cloud CDN will no longer control access based on the specified regions.

    Configuration example

    Block HTTP requests from Andorra to the /image path.

    1. In the Rules Engine, configure a rule to match HTTP requests for resources in the /image path.

      Set the rule name to rule and the condition to Protocol Type equals http and path contains /image/*. Then, click Submit.

    2. Configure a rule to block HTTP requests from Andorra to the /image path.

      • Rule Condition: Select the rule that you created in Step 1.

      • Blocking Type: Select Blacklist.

      • Regions: Select Andorra.

    3. Result: When a request matches the rule, the server returns a 403 Forbidden error with the message denied by region block.

      403 Forbidden
You don't have permission to access the URL on this server.
denied by region block
Powered by Tengine
CDN Request Id: dcbxxx5555e