Global Accelerator:Add and manage forwarding rules

Rule types

Every listener has two types of forwarding rules:

• Default forwarding rule: Created automatically when you create a listener and linked to the default endpoint group. Each listener has exactly one default rule. Its priority cannot be changed, and it cannot be modified or deleted.

• Custom forwarding rules: Rules you create after the listener is set up. A listener can have multiple custom rules, and you can adjust their priorities.

Rule components

Each forwarding rule consists of forwarding conditions and forwarding actions. The actions are applied only when a request matches all conditions in the rule.

The available condition types and action types depend on the listener protocol:

Condition logic

Understanding how conditions combine is essential for designing effective rules.

Within a single rule, all conditions must match (AND logic). A request is forwarded only when it satisfies every condition in the rule.

Within a single condition, multiple values use OR logic. For example, a Host condition with two domain names matches if the request hostname equals either one.

The following table summarizes how each condition type behaves when used multiple times in the same rule:

How requests are matched

1. Requests are evaluated against custom forwarding rules in descending order of priority. A lower rule number means higher priority.

   • If the request matches a custom rule — that is, it satisfies all conditions — the corresponding actions are applied immediately.

   • If the request does not match, it is checked against the next rule in priority order.

2. If the request does not match any custom rule, the default forwarding rule applies. The request is forwarded to the default endpoint group.

If the listener has multiple default endpoint groups, the default rule distributes traffic based on the endpoint group traffic distribution settings. For details, see Distribute traffic across endpoint groups in different scenarios.

Host

Matches the hostname in the request. Supports exact-match domain names, wildcard domain names, and regular expressions. See Configure domain names in forwarding conditions for format rules.

• Only one Host condition per rule.

• Multiple domain names within the condition use OR logic.

Example: *.example.com

Path

Matches the URL path in the request. Supports exact-match paths, wildcard paths, and regular expressions. See Configure paths in forwarding conditions for format rules.

• Multiple Path conditions per rule use OR logic.

• Multiple paths within a single condition use OR logic.

Example: If the URL is www.example.com/test/test1?x=1&y=2, set the path to /test/*.

HTTP Header

Matches a specific HTTP header key-value pair. Enter the header name in Key is and the value in Value is.

• Multiple HTTP Header conditions per rule use AND logic. Keys must be unique across conditions.

• Multiple values within a single condition use OR logic. HTTP header values within a single condition must be unique.

Example: Key user-agent, value *Mozilla/4.0*

HTTP Request Method

Matches the HTTP request method. Valid values: HEAD, GET, POST, OPTIONS, PUT, PATCH, DELETE.

• Only one HTTP Request Method condition per rule.

• Multiple methods within the condition use OR logic.

Cookie

Matches cookie key-value pairs.

• Multiple Cookie conditions per rule use AND logic.

• Multiple key-value pairs within a single condition use OR logic.

Example: key:value

Source IP

Matches client IP addresses or CIDR blocks.

• Only one Source IP condition per rule.

• Multiple entries within the condition use OR logic.

Example IP address: 1.1.XX.XX/32. Example CIDR block: 2.2.XX.XX/24

Query String

Matches URL query string key-value pairs.

• Multiple Query String conditions per rule use AND logic.

• Multiple key-value pairs within a single condition use OR logic.

Example: If the URL is www.example.com/test/test1?x=1&y=2, set the parameters to x:1 or y:2.

Forward to

Forwards matched requests to the specified endpoint group.

Endpoint group selection depends on your billing method:

Redirect to

Redirects matched requests to a different URL. Specify the Protocol, Status Code, Host, Port, Path, and Query string. The Protocol, Host, Port, Path, and Query parameters cannot all be empty or use their default values at the same time.

For advanced Path configuration rules, see Advanced path configurations for rewrites and redirects.

Mirror traffic to

Sends a copy of matched request traffic to the specified endpoint group, while the original request continues to the Forward to destination.

Constraints:

• Traffic mirroring is being rolled out in phases. Contact your account manager to enable it.

• Only pay-as-you-go GA instances support this action.

• Must be combined with a Forward to action. Place Mirror traffic to before Forward to.

• The endpoint groups for Mirror traffic to and Forward to cannot be the same.

• Only one endpoint group (default or virtual) can be selected for traffic mirroring.

Return fixed response

Returns a static HTTP response to the client. Specify the Response Status Code, Response Body Type, and Response Body.

Rewrite

Rewrites the request URL before forwarding. Specify the Host, Path, and Query String for the rewritten URL. Must be combined with and placed before a Forward to action.

For advanced Path configuration rules, see Advanced path configurations for rewrites and redirects.

Insert header

Inserts or overwrites an HTTP header in the request before forwarding. Enter the header name in Key is and the value in Value is.

Constraints:

• Keys must be unique across Insert header actions in the same rule.

• Insert header keys cannot duplicate any Remove header keys in the same rule.

• Only pay-as-you-go instances support inserting System-defined Request IDs into headers.

Must be placed before the Forward to action.

Remove header

Removes an HTTP header from the request before forwarding. Enter the header name to remove.

Constraints:

• Keys must be unique across Remove header actions in the same rule.

• Remove header keys cannot duplicate any Insert header keys in the same rule.

Must be placed before the Forward to action.

Drop (Block Traffic)

Drops the request immediately without forwarding it to any endpoint group.

Forward requests to a specific virtual endpoint group

A web application serves two domains — example.com and example.net — from two separate servers. Both domains are accelerated through GA.

Configure an HTTPS listener with a default endpoint group and bind a default certificate to it. Requests for example.com are forwarded to the default endpoint group. Then add a virtual endpoint group, bind an additional certificate, and create a Host forwarding rule to send example.net traffic to that virtual endpoint group.

The following figure shows the Host forwarding rule configuration for this example.

Redirect HTTP requests to HTTPS

When a website migrates from HTTP to HTTPS, existing bookmarks and links using HTTP stop working. Configure a Redirect forwarding rule to automatically send HTTP requests to the equivalent HTTPS URL. By default, this rule returns an HTTP 301 status code.

In this example, HTTP requests on port 80 are redirected to HTTPS on port 443. The following figure shows the Redirect forwarding rule configuration.

Configure domain-based traffic blocking

A website serves traffic through example.com and uses a Content Delivery Network (CDN) as its backend service in GA. Because CDN services are multi-tenant and share IP addresses, other CDN tenants could resolve different domains to the same accelerated IP address and route traffic through your GA instance — generating unexpected costs and potential security risks.

To prevent this, configure forwarding rules that allow only requests for example.com and drop all others. In this example, requests for example.com are forwarded to the backend endpoint group. Requests for any other domain are dropped with the Drop (Block Traffic) action.