CDN:Get the origin-fetch IP addresses of CDN nodes

Differences between edge node IP addresses and origin-fetch node IP addresses

CDN node IP addresses fall into two categories, each applicable to different scenarios:

• Origin-fetch node IP (L2): Used for whitelist configuration on the origin server. When you need to allow CDN origin-fetch traffic in the security group of the origin server, SLB access control, or Cloud Firewall, periodically obtain the latest origin-fetch IPs and update the whitelist. Alternatively, refer to the "Alternatives for origin server security protection" section in this topic and use protection methods that do not depend on IP addresses.

• Edge node IP (L1): Used for client-side troubleshooting or specific compliance requirements. Use this type of IP address when you need to confirm the CDN node that users actually access or troubleshoot access issues. If you run the nslookup or dig command to resolve the accelerated domain name, the obtained edge node IP address reflects only the current instantaneous scheduling state. CDN dynamically adjusts node assignment based on network conditions, so it cannot be used as a fixed IP address.

Limitations of the CDN origin-fetch IP query API (DescribeL2VipsByDomain)

When you call the DescribeL2VipsByDomain operation to query CDN origin-fetch IP addresses, note the following limitations:

This operation is mainly used to obtain L2 origin-fetch node IP addresses and applies to scenarios where you need to configure whitelists on the origin server (such as ECS security groups, SLB access control, or Cloud Firewall).

Alternatives for origin server security protection

Because CDN origin-fetch IP addresses change dynamically, we do not recommend relying solely on IP whitelists to protect the origin server. The following alternatives are recommended:

• Identify CDN origin-fetch requests by HTTP header: During origin-fetch requests, CDN passes through the ali-cdn-real-ip HTTP header. The origin server can identify this header to recognize and allow legitimate CDN origin-fetch requests, instead of relying on IP whitelists.

• Configure Referer hotlink protection: Configure a Referer blacklist or whitelist to prevent unauthorized sources from accessing accelerated resources. This method does not depend on IP restrictions and better suits the dynamic IP nature of CDN.

• Configure URL authentication: Use the timestamp-based authentication mechanism to generate encrypted URLs, which effectively prevents site resources from being illegally downloaded or abused. This method also does not depend on fixed IP addresses and is suitable for scenarios with high security requirements.

Configure CDN origin-fetch allow rules in Cloud Firewall or WAF

If security products such as Cloud Firewall or WAF are deployed in front of the origin server, you must configure allow rules so that CDN origin-fetch traffic can reach the origin server normally.

Configure inbound rules:  In Cloud Firewall or WAF, add the origin-fetch IP list obtained by calling DescribeL2VipsByDomain to the inbound allow rules to allow these IP addresses to access the origin server.

Configure outbound rules (if needed):  If an outbound control policy is configured in Cloud Firewall, also allow the response traffic from the origin server to the CDN origin-fetch IP addresses.

Port description:  Without special configuration, CDN origin-fetch requests connect to port 80 (HTTP) and port 443 (HTTPS) of the origin server by default. If a custom origin-fetch port is configured in CDN, make sure that the inbound rule for the corresponding port is also allowed.

The preceding content applies to inbound allowance of CDN origin-fetch traffic (CDN nodes → origin server). If your business environment also needs to call the CDN management APIs (such as cache refresh and configuration queries), note that the CDN API server side does not have fixed IP addresses. If your network environment has strict outbound restrictions, we recommend configuring a proxy server, adding the proxy server IP address to the outbound whitelist, and forwarding API requests through the proxy.

Why do the IP addresses in CDN access logs or origin server logs differ from the user's local IP address?

The request IP addresses in CDN access logs or received by the origin server are CDN origin-fetch node IP addresses, not the real IP addresses of end users. This is normal CDN origin-fetch behavior: when the cache on an edge node (L1) misses, the request is sent to the origin server by a origin-fetch node (L2), so the source IP address seen by the origin server is a CDN origin-fetch node IP address. To obtain the real IP address of a user, use the following methods:

• Parse the X-Forwarded-For header: CDN passes through this header in origin-fetch requests, and it contains the real IP address of the user.

• Parse the ali-cdn-real-ip header: This is an Alibaba Cloud CDN-specific origin-fetch header that directly carries the real IP address of the user. Compared with X-Forwarded-For, it is harder to forge.