Anti-DDoS Proxy allows you to configure a DDoS mitigation policy to protect non-website services against Layer 4 DDoS attacks. The policy includes the following features: false source, empty connection, rate limit for source, and speed limit for destination. You can configure a DDoS mitigation policy for a specific port forwarding rule when you create port forwarding rules for an Anti-DDoS Proxy instance and associate a non-website service with the instance. You can also configure a DDoS mitigation policy for multiple port forwarding rules at a time. This topic describes how to configure a DDoS mitigation policy.
Prerequisites
A port forwarding rule for a non-website service is configured on the Port Config page. For more information, see Configure port forwarding rules.
Feature description
For non-website services, a DDoS mitigation policy is configured based on IP addresses and ports. To mitigate connection-oriented DDoS attacks, you can configure the request rate, packet length, and other parameters based on your business requirements. A DDoS mitigation policy only applies to ports.
Anti-DDoS Proxy allows you to configure the following features in a DDoS mitigation policy for non-website services:
False source: verifies and filters DDoS attacks initiated from forged IP addresses.
Speed limit for destination: limits the data transfer rate of the port used by an instance based on the IP address and port of the instance if the transfer rate exceeds an upper limit. The data transfer rates of other ports are not limited.
Packet length limit: specifies the minimum and maximum lengths of packets that are allowed to pass through. Packets with invalid lengths are dropped.
Rate limit for source: limits the data transfer rate of a source IP address based on the IP address and port of an instance if the access requests exceed an upper limit. The data transfer rates of source IP addresses from which access requests do not exceed the upper limits are not limited. The rate limit for source feature supports blacklist settings. You can add an IP address from which access requests exceed an upper limit five times within 60 seconds to a blacklist. You can also specify the blocking period for a blacklist.
Advanced attack mitigation: identifies and mitigates DDoS attacks in which an excessively large number of abnormal packets are sent within a short period of time. The abnormal packets are sent after the TCP three-way handshake process is complete by using botnets such as the Mirai botnet.
Configure a DDoS mitigation policy for a single port forwarding rule
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): If your instance is an Anti-DDoS Proxy (Chinese Mainland) instance, select Chinese Mainland.
Anti-DDoS Proxy (Outside Chinese Mainland): If your instance is an Anti-DDoS Proxy (Outside Chinese Mainland), select Outside Chinese Mainland.
In the left-side navigation pane, choose .
On the General Policies page, click the Protection for Non-website Services tab and select the instance that you want to manage from the Select Instance drop-down list.
Select the forwarding rule for which you want to create a policy from the list on the left side.
Configure the features in the False Source, Speed Limit for Destination, Packet Length Limit, and Rate Limit for Source sections.
False Source: In the False Source section, turn on or off False Source or Empty Connection.
Parameter
Description
False Source
Turn on this switch to block requests from forged IP addresses. After you turn on the switch, Anti-DDoS Proxy automatically filters requests initiated from forged IP addresses.
NoteThis feature applies only to TCP rules.
Empty Connection
Turn on this switch to block requests that attempt to establish null sessions. After you turn on the switch, Anti-DDoS Proxy automatically filters requests that attempt to establish null sessions.
NoteThis policy applies only to TCP rules. To enable this feature, you must first turn on False Source.
Advanced Attack Mitigation: In the Advanced Attack Mitigation section, turn on or off Status. You can also select a protection mode. We recommend that you select the Normal mode.
NoteThis feature applies only to TCP rules.
To enable the advanced attack mitigation feature, you must first turn on False Source.
Protection mode
Effect
Scenario
Loose
This mode blocks requests that have obvious attack characteristics. A small number of attacks may be allowed, but the false positive rate is low.
This mode is suitable for services that involve large-scale one-way data transmission, such as live streaming, streaming media, and data downloads, or services that require high bandwidth on origin servers.
Normal (recommended)
In most cases, this mode does not affect your workloads and balances protection effects and low false positive rates. We recommend that you use this mode.
This mode is suitable for most scenarios.
Strict
This mode helps enforce strict attack verification. In some cases, this mode causes false positives.
This mode is suitable for scenarios in which the origin server has limited bandwidth or the protection effect is weak.
Rate Limit for Source: In the Rate Limit for Source section, click Settings, configure the parameters, and then click OK.
Parameter
Description
New Connections Limit for Source
This parameter specifies the maximum number of new connections per second that can be initiated from a single IP address. Valid values: 1 to 50000. New connections initiated from the IP address after the upper limit is reached are dropped.
Automatic: Anti-DDoS Proxy dynamically calculates the maximum number of new connections per second that can be initiated from a single source IP address.
Manual: You must manually specify the maximum number of new connections per second that can be initiated from a single source IP address.
NoteThe limit on new connections may be slightly different from actual scenarios because scrubbing nodes are deployed in clusters.
Blacklist settings:
If you select the If the number of new connections from a source exceeds the limit five times within 60 seconds, the source IP address is added to the blacklist. check box, all requests from IP addresses in the blacklist are dropped.
To enable the blacklist settings, configure Blacklist Validity Period. Valid values: 1 to 10080. Unit: minutes. Default value: 30. An IP address added to a blacklist is removed from the blacklist when the validity period ends.
Concurrent Connections Limit for Source
This parameter specifies the maximum number of concurrent connections that can be initiated from a single IP address. Valid values: 1 to 50000. Concurrent connections to the port after the upper limit is reached are dropped.
Blacklist settings:
If you select the If the number of concurrent connections from a source exceeds the limit five times within 60 seconds, the source IP address is added to the blacklist. check box, all requests from IP addresses in the blacklist are dropped.
To enable the blacklist settings, configure Blacklist Validity Period. Valid values: 1 to 10080. Unit: minutes. Default value: 30. An IP address added to a blacklist is removed from the blacklist when the validity period ends.
PPS Limit for Source
This parameter specifies the maximum number of packets per second that can be allowed from a single IP address. Valid values: 1 to 100000. Packets initiated from the IP address after the upper limit is reached are dropped.
Blacklist settings:
If you select the If the source PPS exceeds the limit five times within 60 seconds, the source IP address is added to the blacklist. check box, all requests from IP addresses in the blacklist are dropped.
To enable the blacklist settings, configure Blacklist Validity Period. Valid values: 1 to 10080. Unit: minutes. Default value: 30. An IP address added to a blacklist is removed from the blacklist when the validity period ends.
Bandwidth Limit for Source
This parameter specifies the maximum bandwidth of a single IP address. Valid values: 1024 to 268435456. Unit: bytes/s.
Blacklist settings:
If you select the If the bandwidth of connections from a source exceeds the limit five times within 60 seconds, the source IP address is added to the blacklist. check box, all requests from IP addresses in the blacklist are dropped.
To enable the blacklist settings, configure Blacklist Validity Period. Valid values: 1 to 10080. Unit: minutes. Default value: 30. An IP address added to a blacklist is removed from the blacklist when the validity period ends.
Speed Limit for Destination: In the Speed Limit for Destination section, click Settings. In the Change Settings dialog box, configure the required parameters and click OK.
Parameter
Description
New Connections Limit for Destination
This parameter specifies the maximum number of new connections per second that can be established over an Anti-DDoS Proxy port. Valid values: 100 to 100000. Requests initiated from the IP address after the upper limit is reached are dropped.
NoteThe limit on new connections may be slightly different from actual scenarios because scrubbing nodes are deployed in clusters.
Concurrent Connections Limit for Destination
This parameter specifies the maximum number of concurrent connections that can be established on an Anti-DDoS Proxy port. Valid values: 1000 to 1000000. Requests sent to the port after the upper limit is reached are dropped.
Packet Length Limit: In the Packet Length Limit section, click Settings. In the Settings dialog box, specify the minimum and maximum lengths of the payload contained in a packet and click OK. Valid values: 0 to 6000. Unit: bytes.
Configure a DDoS mitigation policy for multiple port forwarding rules at a time
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): If your instance is an Anti-DDoS Proxy (Chinese Mainland) instance, select Chinese Mainland.
Anti-DDoS Proxy (Outside Chinese Mainland): If your instance is an Anti-DDoS Proxy (Outside Chinese Mainland), select Outside Chinese Mainland.
In the left-side navigation pane, choose .
On the Port Config page, select the instance that you want to manage and choose below the rule list.
In the Create Mitigation Policy dialog box, follow the required formats to enter the content of a DDoS mitigation policy and click OK.
NoteYou can also export DDoS mitigation policies to a TXT file, modify the content in the TXT file, and then copy and paste the modified content to the required field. The format of a DDoS mitigation policy in the exported file must be the same as the format of the policy that you want to create. For more information, see Export multiple port configurations at a time.
Configure only one DDoS mitigation policy in each row for each port forwarding rule.
When you configure a DDoS mitigation policy, the fields from left to right indicate the following parameters: forwarding port, forwarding protocol (tcp or udp), new connections limit for source, concurrent connections limit for source, new connections limit for destination, concurrent connections limit for destination, minimum packet length, maximum packet length, false source, and empty connection. Separate the fields by space.
The forwarding port must be a port specified in a forwarding rule.
The valid values of the false source and empty connection fields are on and off. The value off specifies that the feature is disabled.