Anti-DDoS Proxy allows you to configure a DDoS mitigation policy to protect non-website services against Layer 4 DDoS attacks. The policy includes the following features: false source, empty connection, rate limit for source, and speed limit for destination. You can configure a DDoS mitigation policy for a specific port forwarding rule when you create port forwarding rules for an Anti-DDoS Proxy instance and associate a non-website service with the instance. You can also configure a DDoS mitigation policy for multiple port forwarding rules at a time. This topic describes how to add a DDoS mitigation policy.
Introduction
For non-website services, a DDoS mitigation policy is configured based on IP addresses and ports. To mitigate connection-oriented DDoS attacks, you can configure the request rate, packet length, and other parameters based on your business requirements. A DDoS mitigation policy only applies to ports.
Anti-DDoS Proxy allows you to configure the following features in a DDoS mitigation policy for non-website services:
False Source: Verifies and filters DDoS attacks initiated from forged IP addresses.
Advanced Attack Mitigation: Detects and mitigates DDoS attacks that rapidly send an excessively large number of abnormal packets following a TCP three-way handshake, typically from botnets like Mirai.
NoteAnti-DDoS Pro instances that use IPv4 addresses can configure this feature, while Anti-DDoS Pro instances that use IPv6 addresses cannot.
Packet Feature Filtering: Accurately distinguishes between normal service traffic and attack traffic by analyzing packet payloads to protect against attacks. This feature also allows you to configure access control rules based on application-layer protocols.
NoteOnly Anti-DDoS Proxy (Chinese Mainland) instances of the Enhanced function plan that use IPv4 addresses can configure this feature.
Rate Limit for Source: Limits the data transfer rate of a source IP address based on the IP address and port of an instance if the access requests exceed an upper limit. The data transfer rates of source IP addresses from which access requests do not exceed the upper limits are not limited. The rate limit for source feature supports blacklist settings. You can add an IP address from which access requests exceed an upper limit five times within 60 seconds to a blacklist. You can also specify the blocking period for a blacklist.
Speed Limit for Destination: Limits the data transfer rate of the port used by an instance based on the IP address and port of the instance if the transfer rate exceeds an upper limit. The data transfer rates of other ports are not limited.
Packet Length Limit: Specifies the minimum and maximum lengths of packets that are allowed to pass through. Packets with invalid lengths are discarded.
Prerequisites
A non-website service is added to Anti-DDoS Proxy. For more information, see Manage forwarding rules.
Configure a DDoS mitigation policy for a single port forwarding rule
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): If your instance is an Anti-DDoS Proxy (Chinese Mainland) instance, select Chinese Mainland.
Anti-DDoS Proxy (Outside Chinese Mainland): If your instance is an Anti-DDoS Proxy (Outside Chinese Mainland) instance, select Outside Chinese Mainland.
In the left-side navigation pane, choose .
On the General Policies page, click the Protection for Non-website Services tab, and select the Anti-DDoS Proxy instance you want to manage at the top of the page.
Click the forwarding rule you want to configure from the list on the left to set the protection policy.
False Source: This feature applies only to TCP port forwarding rules.
Parameter
Description
False Source
Activate this option to block requests from forged IP addresses.
When False Source is disabled, Empty Connection and Advanced Attack Mitigation are also disabled.
Empty Connection
Enable this option to block requests that attempt to establish null sessions. False Source must be enabled before you can turn on Empty Connection.
Advanced Attack Mitigation: This feature is applicable only to TCP port forwarding rules. The default protection mode is Normal. False Source must be enabled before you can turn on Advanced Attack Mitigation.
Protection mode
Effect
Scenario
Loose
This mode blocks requests that have obvious attack characteristics. A small number of attacks may be allowed, but the false positive rate is low.
This mode is suitable for services that involve large-scale one-way data transmission, such as live streaming, streaming media, and data downloads, or services that require high bandwidth on origin servers.
Normal (recommended)
In most cases, this mode does not affect your workloads and balances protection effects and low false positive rates. We recommend that you use this mode.
This mode is suitable for most scenarios.
Strict
This mode helps enforce strict attack verification. In some cases, this mode causes false positives.
This mode is suitable for scenarios in which the origin server has limited bandwidth or the protection effect is weak.
Packet Feature Filtering: Configure precise access control rules based on the packet payloads. If a single rule contains multiple matching conditions, all conditions must be satisfied to trigger the corresponding action.
Parameter
Description
Priority
Assign a value between 1 to 100, with a lower value indicating higher priority.
Rule Name
Name your monitoring rule for easy identification.
Match Conditions
Match Conditions: Define the format of the packet payload. Select either String or Hexadecimal.
Match Range: Specify the start and end positions for payload matching. The valid range for both positions is from 0 to 1499 bytes. The start position must not exceed the end position.
Logical Operator: Select either Include or Not Include.
Field Value:
If Match Conditions is set to String, the matching content length must not exceed 1500 bytes and should be within the range specified by the start and end positions.
If Match Conditions is set to Hexadecimal, the content must consist of hexadecimal characters, not exceed 3000 characters, be an even number, and fit within the specified range.
Action
Monitor: Permits the request if it matches the monitor rule.
Block: Rejects the request if it matches the block rule.
Rate Limit for Source
Parameter
Description
New Connections Limit for Source
This parameter specifies the maximum number of new connections per second that can be initiated from a single IP address. Valid values: 1 to 50000. New connections initiated from the IP address after the upper limit is reached are dropped.
Automatic: Anti-DDoS Proxy dynamically calculates the maximum number of new connections per second that can be initiated from a single source IP address.
Manual: You must manually specify the maximum number of new connections per second that can be initiated from a single source IP address.
NoteThe limit on new connections may be slightly different from actual scenarios because scrubbing nodes are deployed in clusters.
Blacklist settings:
If you select the If the number of new connections from a source exceeds the limit five times within 60 seconds, the source IP address is added to the blacklist. check box, all requests from IP addresses in the blacklist are dropped.
To enable the blacklist settings, configure Blacklist Validity Period. Valid values: 1 to 10080. Unit: minutes. Default value: 30. An IP address added to a blacklist is removed from the blacklist when the validity period ends.
Concurrent Connections Limit for Source
This parameter specifies the maximum number of concurrent connections that can be initiated from a single IP address. Valid values: 1 to 50000. Concurrent connections to the port after the upper limit is reached are dropped.
Blacklist settings:
If you select the If the number of concurrent connections from a source exceeds the limit five times within 60 seconds, the source IP address is added to the blacklist. check box, all requests from IP addresses in the blacklist are dropped.
To enable the blacklist settings, configure Blacklist Validity Period. Valid values: 1 to 10080. Unit: minutes. Default value: 30. An IP address added to a blacklist is removed from the blacklist when the validity period ends.
PPS Limit for Source
This parameter specifies the maximum number of packets per second that can be allowed from a single IP address. Valid values: 1 to 100000. Packets initiated from the IP address after the upper limit is reached are dropped.
Blacklist settings:
If you select the If the source PPS exceeds the limit five times within 60 seconds, the source IP address is added to the blacklist. check box, all requests from IP addresses in the blacklist are dropped.
To enable the blacklist settings, configure Blacklist Validity Period. Valid values: 1 to 10080. Unit: minutes. Default value: 30. An IP address added to a blacklist is removed from the blacklist when the validity period ends.
Bandwidth Limit for Source
This parameter specifies the maximum bandwidth of a single IP address. Valid values: 1024 to 268435456. Unit: bytes/s.
Blacklist settings:
If you select the If the bandwidth of connections from a source exceeds the limit five times within 60 seconds, the source IP address is added to the blacklist. check box, all requests from IP addresses in the blacklist are dropped.
To enable the blacklist settings, configure Blacklist Validity Period. Valid values: 1 to 10080. Unit: minutes. Default value: 30. An IP address added to a blacklist is removed from the blacklist when the validity period ends.
Speed Limit for Destination: Default settings differ for TCP and UDP port forwarding rules.
TCP port forwarding rules:
Parameter
Description
New Connections Limit for Destination
This parameter specifies the maximum number of new connections per second that can be established over an Anti-DDoS Proxy port, with valid values from 100 to 100,000. Excess connections will be dropped.
By default, the feature is enabled and the limit is set to 100,000.
This feature cannot be disabled. Any attempts to disable it will reset the value to the default of 100,000.
NoteThe actual limit on new connections may vary slightly because the scrubbing nodes are deployed in clusters.
Concurrent Connections Limit For Destination
This parameter defines the maximum number of concurrent connections that can be established on an Anti-DDoS Proxy port, with valid values from 1,000 to 2,000,000. Excess connections will be dropped.
By default, this feature is enabled and the limit is set to 2,000,000.
This feature cannot be disabled. Any attempts to disable it will reset the value to the default of 2,000,000.
UDP port forwarding rules:
Parameter
Description
New Connections Limit for Destination
This parameter specifies the maximum number of new connections per second that can be established over an Anti-DDoS Proxy port.
By default, this feature is disabled, with valid values from 100 to 50,000.
NoteThe actual limit on new connections may vary slightly due to the clustered deployment of scrubbing nodes.
Concurrent Connections Limit For Destination
This parameter specifies the maximum number of concurrent connections that can be established over an Anti-DDoS Proxy port, with valid values from 1,000 to 200,000.
By default, this feature is enabled and set to 200,000.
This feature cannot be disabled. Any attempts to disable it will reset the value to the default of 200,000.
Packet Length Limit: In the Packet Length Limit section, click Settings. Specify the minimum and maximum lengths of the payload contained in a packet and click OK. Valid values: 0 to 1,500 bytes.
Configure a DDoS mitigation policy for multiple port forwarding rules at a time
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): If your instance is an Anti-DDoS Proxy (Chinese Mainland) instance, select Chinese Mainland.
Anti-DDoS Proxy (Outside Chinese Mainland): If your instance is an Anti-DDoS Proxy (Outside Chinese Mainland) instance, select Outside Chinese Mainland.
In the left-side navigation pane, choose .
On the Port Config page, select the instance that you want to manage and choose below the rule list.
In the Create Mitigation Policy dialog box, follow the required formats to enter the content of a DDoS mitigation policy and click OK.
NoteYou can also export DDoS mitigation policies to a TXT file, modify the content in the TXT file, and then copy and paste the modified content to the required field. The format of a DDoS mitigation policy in the exported file must be the same as the format of the policy that you want to create. For more information, see Export multiple port configurations at a time.
Configure only one DDoS mitigation policy in each row for each port forwarding rule.
When you configure a DDoS mitigation policy, the fields from left to right indicate the following parameters: forwarding port, forwarding protocol (tcp or udp), new connections limit for source, concurrent connections limit for source, new connections limit for destination, concurrent connections limit for destination, minimum packet length, maximum packet length, false source, and empty connection. Separate the fields by space.
The forwarding port must be a port specified in a forwarding rule.
The valid values of the false source and empty connection fields are on and off. The value off specifies that the feature is disabled.