Global Accelerator:Use GA with DDoS protection to accelerate and secure global services

Scenario

A company's website runs on two ECS servers (ECS01, ECS02) in the US (Silicon Valley) region, serving users worldwide over a custom domain on HTTP port 80. The site faces two problems:

• Cross-border network instability: latency, jitter, and packet loss on public internet routes.

• Frequent high-volume DDoS attacks causing unstable service responses.

Deploying GA with Anti-DDoS Origin addresses both: GA routes traffic through the private acceleration network to reduce latency, and Anti-DDoS Origin adds GA instances as protected objects to guard accelerated IPs and endpoint public IPs against DDoS attacks.

Normal traffic path: Client requests connect to the nearest GA acceleration area, then route through the private network to the origin server in US (Silicon Valley) — no latency penalty.

Under attack: When traffic exceeds the Anti-DDoS Origin scrubbing threshold, traffic scrubbing is triggered automatically. Scrubbed traffic continues to be accelerated through GA to the origin server.

Limitations

Anti-DDoS Origin is available for direct purchase only in the Chinese mainland. To purchase an instance outside the Chinese mainland, contact your account manager. For details, see Contact us.

Prerequisites

Before you begin, make sure that you have:

• Services deployed on ECS01 and ECS02 in the US (Silicon Valley) region (this example uses Alibaba Cloud Linux 3 with an Nginx HTTP 80 service)

• A DNS A record pointing your custom domain name to the public IPs of both backend servers

• (Optional) An SSL certificate bound to your custom domain if you plan to serve HTTPS traffic on port 443

• An Anti-DDoS Origin instance purchased

Example: deploy a test service on ECS01

yum install -y nginx
systemctl start nginx.service
cd /usr/share/nginx/html/
echo "Hello World ! This is ECS01, service running on port 80." > index.html

Step 1: Configure Global Accelerator

This example uses a pay-as-you-go standard GA instance.

1. On the Standard Instance > Instances page of the GA console, click Create Standard Pay-as-you-go Instance.

2. In the Basic Instance Configuration step, configure the basic information and click Next.

   

3. In the Configure Acceleration Area step, add an acceleration area and allocate bandwidth, then click Next. Set Acceleration Region to China (Hong Kong) and ISP Line Type to BGP (Multi-ISP). Adjust other parameters as needed. For details, see Add and manage acceleration areas.

   Important

   - If any acceleration area is in the Chinese mainland, apply for an ICP number for the domain name before providing services. - Set maximum bandwidth based on your traffic volume. A value that is too low causes throttling and packet loss.

   

4. In the Configure listeners step, configure the forwarding protocol and port, then click Next. Set Routing Type to Intelligent Routing, Protocol to HTTP, and Port to 80. For details, see Add and manage smart routing listeners.

   To serve external traffic over HTTPS 443, select HTTPS for Protocol and 443 for Port, associate the listener with your certificate, and configure a port mapping (443→80) in the endpoint group. This lets users access the HTTP website securely over HTTPS.

   

5. On the Configure Endpoint Group page, set the region to US (Silicon Valley), add ECS01 and ECS02 as backend services, and enable Health Check. Read and select the Cross-border Data Transfer Compliance Commitment, then click Next. For details on other endpoint group parameters, see Create and manage endpoint groups of intelligent routing listeners.

   

   

6. In the Configuration Review step, confirm the configuration and click Submit.

7. On the Instances page, find the GA instance and copy the CNAME from the CNAME column.

8. On each backend server, allow the vSwitch CIDR block that GA uses to connect over the private network. Add an inbound rule in the ECS security group and make sure the vSwitch has at least 8 available private IP addresses.

Step 2: Configure Anti-DDoS Origin

On the Protected Objects page of the Anti-DDoS Origin console, click Add Protected Object and add the GA instance.

After the GA instance is added:

• The GA Assets tab shows the protected GA instance.

• The IP Assets tab shows the protected public IPs: accelerated IPs and endpoint public IPs.

Step 3: Configure a CNAME record

Map your custom domain name to the GA CNAME so traffic is routed through GA for accelerated access.

If you already have an A record pointing to the backend servers, add a CNAME record for the China (Hong Kong) region first. Once you confirm it works, extend the CNAME to other regions or replace the A record entirely.

1. On the Authoritative DNS Resolution page, find your domain name and click DNS Settings.

   If your domain is not registered with Alibaba Cloud, add it to the Alibaba Cloud DNS console before configuring DNS records.

2. Click Add DNS Record, configure the CNAME record, and click OK. Set Record Type to CNAME, Hostname to www, DNS Request Source to Asia_Hong Kong, and Record Value to the GA CNAME. For details, see Add DNS records.

   

Step 4: Verify the results

Scenario

A multinational game runs on ECS01 and ECS02 in the US (Silicon Valley) region, serving players worldwide through a custom domain. The service faces:

• Cross-border network instability: latency, jitter, and packet loss.

• Large-scale DDoS attacks that cause complete service outages.

Combining GA with Anti-DDoS Pro or Anti-DDoS Premium handles both.

Normal traffic path: GA routes requests through the private acceleration network directly to the origin server — no added latency, no Anti-DDoS overhead.

Under attack: GA uses DNS resolution to reroute traffic to Anti-DDoS scrubbing centers. After scrubbing, traffic returns to GA via the secure CNAME (secure accelerated IP address) and is forwarded to the origin server, keeping the game server accessible.

Limitations

• Connecting GA to Anti-DDoS Pro and Anti-DDoS Premium is not enabled by default. Contact your business manager to activate the feature.

• To purchase the Premium Edition of Anti-DDoS Pro and Anti-DDoS Premium (Chinese mainland), or the Sec-MCA 1.0 / Sec-MCA 1.0 (Basic Edition) editions (outside the Chinese mainland), contact your business manager.

• Only pay-as-you-go standard GA instances support this integration. Subscription-based standard GA instances and basic GA instances are not supported.

Prerequisites

Before you begin, make sure that you have:

• Services deployed on ECS01 and ECS02 in the US (Silicon Valley) region (this example uses Alibaba Cloud Linux 3 with an Nginx HTTP 80 service)

• A DNS A record pointing your custom domain name to the public IPs of both backend servers

• (Optional) An SSL certificate bound to your custom domain if you plan to serve HTTPS traffic on port 443

• An Anti-DDoS Pro or Anti-DDoS Premium instance purchased

This example uses an Anti-DDoS Pro or Anti-DDoS Premium (Outside Chinese Mainland) instance with the Mitigation Plan and Standard Function for clients in Hong Kong (China).

Example: deploy a test service on ECS01

yum install -y nginx
systemctl start nginx.service
cd /usr/share/nginx/html/
echo "Hello World ! This is ECS01, service running on port 80." > index.html

Step 1: Configure Global Accelerator

1. On the Standard Instance > Instances page of the GA console, click Create Standard Pay-as-you-go Instance.

2. In the Basic Instance Configuration step, configure the basic information and click Next.

   

3. In the Configure Acceleration Area step, add an acceleration area and allocate bandwidth, then click Next. Set Acceleration Region to China (Hong Kong) and ISP Line Type to BGP (Multi-ISP). Adjust other parameters as needed. For details, see Add and manage acceleration areas.

   Important

   - If any acceleration area is in the Chinese mainland, apply for an ICP number for the domain name before providing services. - Set maximum bandwidth based on your traffic volume. A value that is too low causes throttling and packet loss.

   

4. In the Configure listeners step, configure the forwarding protocol and port, then click Next. Set Routing Type to Intelligent Routing, Protocol to HTTP, and Port to 80. For details, see Add and manage smart routing listeners.

   To serve external traffic over HTTPS 443, select HTTPS for Protocol and 443 for Port, associate the listener with your certificate, and configure a port mapping (443→80) in the endpoint group. This lets users access the HTTP website securely over HTTPS.

   

5. On the Configure an endpoint group page, set the region to US (Silicon Valley), add ECS01 and ECS02 as backend services, and enable Health Check. Read and select the Compliance Commitments Regarding Cross-border Data Transfers, then click Next. For details on other endpoint group parameters, see Create and manage endpoint groups of intelligent routing listeners.

   

   

6. In the Configuration Review step, confirm the configuration and click Submit.

7. On the Instances page, find the GA instance and copy the CNAME from the CNAME column.

8. On each backend server, allow the vSwitch CIDR block that GA uses to connect over the private network. Add an inbound rule in the ECS security group and make sure the vSwitch has at least 8 available private IP addresses.

Step 2: Connect the GA instance to Anti-DDoS Pro or Anti-DDoS Premium

1. On the Standard Instance > Instances page in the GA console, find the GA instance and click  > Associate with Anti-DDoS Pro/Premium in the Actions column.

2. In the Associate with Anti-DDoS Pro/Premium dialog box, select the Anti-DDoS Pro or Anti-DDoS Premium instance and click OK. Because the GA acceleration area is Hong Kong (China) in this example, select an Anti-DDoS Pro or Anti-DDoS Premium (Outside Chinese Mainland) instance. If the acceleration area includes the Chinese mainland, also select an Anti-DDoS Premium or Anti-DDoS Pro (Chinese Mainland) instance and complete the Website Config in Step 3.

3. To the right of the instance ID, hover over the Anti-DDoS Pro/Premium icon. In the Anti-DDoS Proxy tooltip, copy the Secure GA CNAME.

   After connecting GA to Anti-DDoS Pro and Anti-DDoS Premium, each acceleration area gets four accelerated IP addresses. Two are secure accelerated IP addresses mapped to the GA secure CNAME. During an attack, scrubbed traffic from Anti-DDoS Pro/Premium enters the acceleration network through the GA secure CNAME.

   

Step 3: Add a website to Anti-DDoS Pro or Anti-DDoS Premium

1. On the Website Config page of the Anti-DDoS Pro Proxy (Outside Chinese Mainland) console, click Add Website.

2. In the Add Website panel, complete the Website Config wizard and click Next. Configure the following: Read and select the Compliance Commitments Regarding Cross-border Data Transfer. For details on other parameters, see Add websites.

   Warning

   For Server Address, enter the GA secure CNAME — not the GA CNAME. Using the regular GA CNAME creates a traffic loop.

   Parameter	Value
   Instance	Your Anti-DDoS Pro or Anti-DDoS Premium instance
   Websites	Your custom domain name
   Server Address	Select Origin Domain Name and enter the GA secure CNAME from Step 2
   Protocol Type and Server Port	Must match the GA listener protocol and port (HTTP, 80)

   

   

3. In the Forwarding Settings wizard, keep the default configuration and click Next.

4. On the Finish page, click Complete and Return to Domain Name List.

5. On the origin server, add the back-to-origin IP addresses of Anti-DDoS Pro or Anti-DDoS Premium to the whitelist of your security software and security groups to prevent back-to-origin traffic from being blocked.

Step 4: Configure a CNAME record

Map your custom domain name to the GA CNAME so traffic is routed through GA for accelerated access.

If you already have an A record pointing to the backend servers, add a CNAME record for the China (Hong Kong) region first. Once you confirm it works, extend the CNAME to other regions or replace the A record entirely.

1. On the Authoritative DNS Resolution page, find your domain name and click DNS Settings.

   If your domain is not registered with Alibaba Cloud, add it to the Alibaba Cloud DNS console before configuring DNS records.

2. Click Add DNS Record, configure the CNAME record, and click OK. Set Record Type to CNAME, Hostname to www, DNS Request Source to Asia_Hong Kong, and Record Value to the GA CNAME. For details, see Add DNS records.

   

Step 5: Verify the results