Let only your edge network reach the origin

How to do it

An edge network spreads a flood over many sites, where it would fill one server's link. CISA's DDoS guide names a CDN as one way to absorb attack traffic. It helps only while attackers cannot reach the origin past it. Old DNS records, mail headers and certificate logs often reveal the origin's address. Load the provider's address ranges from its published list in code, and refresh them once a week. A tunnel that the origin opens outward, or a client certificate the edge presents, also works. Build the rule on Deny all traffic unless a rule allows it. To leave the edge, change this rule in the same change as DNS, as Use a managed DNS and CDN that exports your zone plans. Per-client limits still belong in the app, as Limit how often anyone can call your APIs says.

Examples

Terraform example

resource "aws_vpc_security_group_ingress_rule" "https_from_edge" {
  for_each          = toset(var.edge_ipv4_ranges)
  security_group_id = aws_security_group.origin.id
  cidr_ipv4         = each.value
  from_port         = 443
  to_port           = 443
  ip_protocol       = "tcp"
}

Shell example

# Run from outside the edge. The first line must fail and the second must print 200.
curl --max-time 5 --resolve shop.example.com:443:203.0.113.10 https://shop.example.com/ && exit 1
curl -s -o /dev/null -w '%{http_code}\n' https://shop.example.com/

How to check

From a machine outside the provider's network, a request to the origin's own address on port 443 is refused or times out. The same page through the public host name answers 200.

Sources

• CISA, Understanding and Responding to DDoS Attacks

Related rules

• INF-30 Deny all traffic unless a rule allows it in Infrastructure and environments
• STK-59 Use a managed DNS and CDN that exports your zone in Software choices
• APS-49 Limit how often anyone can call your APIs in Application security
• INF-86 Put a web application firewall and flood protection in front of public services in Infrastructure and environments