---
title: "Let only your edge network reach the · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/origin-behind-edge
id: INF-71
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1136
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Let only your edge network reach the origin

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: INF-71
- Level: Recommended
- Chapter: [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns.md)
- Rule: Send public web traffic through a CDN or a DDoS protection service. Let the origin accept web traffic only from that service's published address ranges, or through a tunnel or mutual TLS.
- Check: From a machine outside the provider's network, a request to the origin's own address on port 443 is refused or times out. The same page through the public host name answers 200.
- How: An edge network spreads a flood over many sites, where it would fill one server's link. CISA's DDoS guide names a CDN as one way to absorb attack traffic. It helps only while attackers cannot reach the origin past it. Old DNS records, mail headers and certificate logs often reveal the origin's address. Load the provider's address ranges from its published list in code, and refresh them once a week. A tunnel that the origin opens outward, or a client certificate the edge presents, also works. Build the rule on [Deny all traffic unless a rule allows it](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/deny-by-default-firewall.md). To leave the edge, change this rule in the same change as DNS, as [Use a managed DNS and CDN that exports your zone](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/managed-dns-and-cdn.md) plans. Per-client limits still belong in the app, as [Limit how often anyone can call your APIs](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/rate-limits.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Terraform example

```hcl
resource "aws_vpc_security_group_ingress_rule" "https_from_edge" {
  for_each          = toset(var.edge_ipv4_ranges)
  security_group_id = aws_security_group.origin.id
  cidr_ipv4         = each.value
  from_port         = 443
  to_port           = 443
  ip_protocol       = "tcp"
}
```

### Shell example

```sh
# Run from outside the edge. The first line must fail and the second must print 200.
curl --max-time 5 --resolve shop.example.com:443:203.0.113.10 https://shop.example.com/ && exit 1
curl -s -o /dev/null -w '%{http_code}\n' https://shop.example.com/
```

## Sources

- [CISA, Understanding and Responding to DDoS Attacks](https://www.cisa.gov/sites/default/files/publications/understanding-and-responding-to-ddos-attacks_508c.pdf)

## Related rules

- INF-30 [Deny all traffic unless a rule allows it](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/deny-by-default-firewall.md) in Infrastructure and environments
- STK-59 [Use a managed DNS and CDN that exports your zone](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/managed-dns-and-cdn.md) in Software choices
- APS-49 [Limit how often anyone can call your APIs](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/rate-limits.md) in Application security
- INF-86 [Put a web application firewall and flood protection in front of public services](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/waf-and-ddos.md) in Infrastructure and environments

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/networking-and-dns/origin-behind-edge">Agent Wranglers infrastructure and environments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Authenticate calls between your own services](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/service-to-service-auth.md)
- Next: [Put a web application firewall and flood protection in front of public services](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/waf-and-ddos.md)
- [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns.md)