Edge Security Acceleration:Configure an IP blacklist/whitelist

Usage notes

• This feature is disabled by default. The IP address blacklist and whitelist are mutually exclusive. You can configure only one of them at a time. To switch from one type to another, you must first delete the existing list before creating a new one of the opposite type.

• After you configure an IP address blacklist, requests from blacklisted IP addresses can still reach DCDN POPs. However, the POPs will reject these requests and return an HTTP 403 status code. DCDN logs will record these requests, but this does not mean the IP blacklist is ineffective.

• Because the IP address blacklist/whitelist feature uses Layer 7 HTTP IP recognition technology, a small amount of traffic fees are generated when malicious requests are blocked by DCDN nodes. If a client uses the HTTPS protocol for access, HTTPS request fees are also generated because blocking malicious IP addresses also consumes the processing resources of DCDN nodes.

• Some Internet Service Providers (ISPs) in specific regions may assign private IP addresses to clients. DCDN POPs might receive requests from a user's private IP address.

  Note

  The three private IP address ranges are:

  • Class A private IP addresses: 10.0.0.0 to 10.255.255.255, subnet mask: 10.0.0.0/8

  • Class B private IP addresses: 172.16.0.0 to 172.31.255.255, subnet mask: 172.16.0.0/12

  • Class C private IP addresses: 192.168.0.0 to 192.168.255.255, subnet mask: 192.168.0.0/16

Procedure

1. Log on to the DCDN console.

2. In the left-side navigation pane, click Domain Names.

3. On the Domain Names page, find the target domain name and click Configure.

4. In the left-side navigation tree of the domain name, click Access Control.

5. Click the IP Blacklist or Whitelist tab.

6. On the IP Blacklist or Whitelist tab, click Modify, then configure an IP Blacklist or Whitelist on the Rules page.

   Note

   If you have already configured an IP blacklist or whitelist and want to switch to the other type, you must first delete the existing list. For example, if you have an existing IP whitelist and you click Modify to change the type to Blacklist, an error message similar to the following is displayed: "You have an existing IP whitelist. To switch to an IP blacklist, delete the existing IP whitelist." Delete the current list first, and then create a new list of the desired type by clicking Modify again.

   

   Parameter	Description
   Type	The following list types are supported: Blacklist IP addresses in the blacklist cannot access any resources under the accelerated domain name. Whitelist Only IP addresses in the whitelist can access resources under the accelerated domain name. All other IP addresses are blocked.
   Rules	Format requirements You can enter individual IP addresses or IP address ranges in CIDR notation. Separate multiple entries with line breaks. IPv4 addresses and CIDR blocks are supported: IPv4 address example: 192.168.0.1. IPv4 CIDR block example: 192.168.0.0/24. The wildcard address 0.0.0.0/0 is not supported. To specify all IPv4 addresses, use the following two subnets: 0.0.0.0/1 128.0.0.0/1 IPv6 addresses and CIDR blocks are supported: IPv6 address example: FC00:AA3:0:23:3:300:300A:1234. IPv6 CIDR block example: FC00:0AA3:0000:0000:0000:0000:0000:0000/48. Letters in IPv6 addresses are not case-sensitive. For example, FC00:AA3:0:23:3:300:300A:1234 and fc00:0aa3:0000:0023:0003:0300:300a:1234 are equivalent. The compressed format :: is not supported. For example, FC00:0AA3::0023:0003:0300:300A:1234 is invalid. The wildcard address 0000:0000:0000:0000:0000:0000:0000:0000/0 is not supported. To specify all IPv6 addresses, use the following two subnets: 0000:0000:0000:0000:0000:0000:0000:0000/1 8000:0000:0000:0000:0000:0000:0000:0000/1 Rule length limit The rule field is limited to 30 KB. Based on the average string length of IP addresses and CIDR blocks, you can enter approximately 700 IPv6 entries or 2,000 IPv4 entries. To block a larger number of IP addresses, use Edge Security Accelerator (ESA), which supports massive IP blocking and region-based blocking. For more information, see CDN, DCDN, and ESA: Feature comparison and IP access rules.
   IP rules	You can select one of the following three rules: Use the X-Forwarded-For header for verification (Default rule) This rule is recommended when all clients access your service through trusted proxies that correctly set the X-Forwarded-For header. Use the real connection IP for verification This rule is recommended when clients connect directly to DCDN without intermediate proxies, or when you want to control access based on the IP address of a proxy server. Use both the X-Forwarded-For header and the real connection IP for verification This rule is recommended for mixed network environments where some users connect directly and others use proxies. If the X-Forwarded-For header does not contain an IP address, the real connection IP is used instead.

7. Click OK to save the configuration.

FAQ

• IP address blacklists and whitelists have a limit on the number of entries. Does an IP address range count as one entry or multiple?

• Why can an IP address on the blacklist still access resources?

• How do I obtain the real client IP address?

• I need to add DCDN to the access whitelist on my origin server. Can I get a list of DCDN POP IP addresses?

API reference

BatchSetDcdnDomainConfigs: Use the BatchSetDcdnDomainConfigs operation to configure multiple domain names in a single call. Use the ip_black_list_set and ip_allow_list_set parameters to specify the IP address blacklist and whitelist, respectively.