Alibaba Cloud Anti-DDoS Premium (New BGP) Access Delay Increase, Website Access Catton and Source IP Exposure Troubleshooting
In the process of daily SEO optimization and website operation and maintenance, what we fear most is not "no traffic", but "it is not easy to get traffic, but the website cannot be opened".
In order to resist high-traffic DDoS attacks, many operation and maintenance and webmasters will choose to access
Alibaba Cloud Anti-DDoS Pro (new BGP)
. This in itself is a very correct defensive decision, after all, the new BGP has multi-line automatic switching and strong traffic cleaning capabilities. However, in the actual landing process, many friends encountered a series of "secondary disasters" after accessing the high defense ":
The ping delay of the website increased sharply, the user page visited Catton, and even the source station was bypassed by hackers (source IP exposure)
.
This will directly lead to Google and Baidu spider crawl timeout, Core Web Vitals index plummeted, and then drag down the SEO ranking of the entire site.
Today, from the perspective of SEO and operation and maintenance, I will use the most down-to-earth language to disassemble the real reasons for the "high delay, stuck, and source station exposure" after accessing Aliyun's new BGP high defense, and teach you a complete set of investigation and optimization plans.
Why does the website delay increase after the 1. is connected to Anti-DDoS Pro?
First of all, we must have a technical understanding:
After any reverse proxy architecture (Anti-DDoS Pro, CDN, WAF) is connected, the delay physically increases slightly.
Before access to high security:
Client-> direct connection source station IP
After access to high security:
Client ---> Anti-DDoS Pro BGP node (traffic cleaning/proxy) ---> Alibaba Cloud internal back-to-source link ---> Origin
Even in the absence of any attack in peacetime, the packet also went to the "transit station". However, if the delay increases too far (for example, from 20ms to more than 200ms or even overtime), it is definitely not the normal loss of "agents", but the following problems:
1. Physical nodes and scheduling span (most common)
Alibaba Cloud Anti-DDoS Pro (new BGP) protection nodes are mainly deployed in large cities (such as Beijing and Hangzhou). If your source station is located in Hong Kong, Singapore or the United States and you have configured the default source return logic of the high-security node incorrectly, the traffic may first go to the domestic high-security node for cleaning and then cross the sea to return to the source. This is equivalent to data packets circling more than half of the world, and it is strange that the delay does not soar.
2. If Anti-DDoS High "back-to-source IP network segment" is not released, the source station is triggered to limit the flow.
After you access Anti-DDoS Pro, the traffic of thousands of users is packaged into a few "back-to-origin IP addresses" by Anti-DDoS Pro nodes to access your origin.
If your source station ECS firewall, security group, or installed pagoda firewall, cloud lock, security dog and other software,
You did not whitelist the Anti-DDoS Pro back-to-source IP address.
, the source station will treat these high-frequency requests as an attack and directly block them.
Interception or frequent current limiting shows that front-end users are severely stuck and frequently report 502/504 errors.
3. The number of source station connections is full (caused by Full NAT mode)
Anti-DDoS High usually uses the Full NAT mode when forwarding traffic. If your Web server (Nginx/Apache) or database connection pool configuration is too conservative, facing high-security concurrent connections, it is easy to cause the source station TCP connections to be full, and requests that are not processed in time will get stuck in the queue.
2. websites to visit Caton's "in-depth investigation and location" guide
When you meet Caton, don't rush to the doctor. Follow the following 4 steps:
[Client Access Catton]
│
├──> 1. Test with MTR/TCPing: Determine whether the delay occurs in [User-> High Security] or [High Security-> Source Station]]
│
├──> 2. Check the security policy of the source station: whether the security group/firewall whitelist allows high protection [back-to-source IP segment]]
│
├──> 3. Check whether the load of the source station: CPU, memory, bandwidth, and number of Nginx connections are tight
│
This ─ ─ ─> 4. check the high-security console: whether [manslaughter cleaning] or [CC policy too strict] is triggered]
Step 1: Tool Positioning (MTR and TCPing)
Do not use ordinary.
ping
(many high anti-ping or restricted ICMP), please use
tcping
Test the domain name and port 80/443 of Anti-DDoS Pro.
Use MTR(My Traceroute) route trace to check whether the packet loss is before entering the Alibaba Cloud BGP network or inside Alibaba Cloud.
Judgment logic: if the tcping high-security IP delay is very low (such as 20ms), but the browser opens the webpage very slowly (TTFB exceeds 2 seconds), the problem must be in the "high-security back to the source station" section, or the source station processing is too slow.
Step 2: Release the Anti-DDoD-high back-to-source IP segment completely
Log on to the Alibaba Cloud Anti-DDoS Premium console and find [Access Management]]
$\rightarrow$
[View back-to-source IP network segment]].
Copy these IP network segments completely.
Enter the inbound rules of the security group of the origin ECS instance (all protocols/ports or specific web ports are allowed).
If the source station is equipped with Nginx pagoda firewall or other security software, these back-to-source IP addresses must be released in the "IP whitelist.
Step 3: Adjust the Anti-DDoS High protection strategy
New BGP high defense
The default CC protection policy may be too strict. Sometimes, normal dynamic API requests (such as frequent user refreshing and POST submission) are misjudged as CC attacks, thus challenging the client with verification code or limiting the speed.
It is recommended to adjust CC protection to "early warning" or "medium" mode first, check whether the stuck phenomenon disappears, and then configure accurate matching rules (such as release/api/path).
3. Fatal Vulnerability: How is the IP address of the source station exposed after accessing the high security?
The most embarrassing thing about accessing high security is:
Gao Fong bought it and spent the money, but the hacker directly bypassed Gao Fong and hit your source station's real IP.
Once the source IP is exposed, hackers can directly launch a high-traffic attack, causing your ECS to instantly break into a black hole and the website to be completely paralyzed.
The source IP is exposed, and the following 5 hidden vulnerabilities are common:
1. Legacy of historical DNS resolution records (most common)
Before accessing Anti-DDoS High, if the domain name A record is directly resolved to the origin IP address, the historical resolution record will be permanently collected by various DNS history query tools (such as SecurityTrails and Censys). Hackers can find your past IP by checking the historical DNS.
2. Mail services (MX records) share the same server
If the website has its own sending function (such as user registration verification code and order notification) and sends mail directly from the source server,
Received: from
The real IP of the source station will be directly exposed!
Solution: You must not use the origin server to send emails directly. You must use a third-party SMTP service (such as Alibaba Cloud email push service and SendGrid) instead.
3. Subdomain "Black under the Light"
Main Station
[www.yourdomain.com](https://www.yourdomain.com)
High defense is hung up, but the subdomain name is tested.
dev.yourdomain.com
or backstage
admin.yourdomain.com
Also directly connected to the source IP. Hackers only need to check the domain name for a while, and the IP of the source station will be lost instantly.
4. Website SSR/SSRF/dynamic crawl function
If your website supports users to input URL to automatically generate preview, or has SSR (server rendering) and the function of calling a third-party API, an attacker can construct a malicious receiver to trick your source server into initiating HTTP requests, thus getting your source IP in the receiver's log.
5. Source code/configuration disclosure
For example
phpinfo.php
No, Git blind area leaked, or probe page typed directly
done
SERVER_ADDR
.
Ultimate anti-exposure policy of the source station: change the IP address of the source station (if exposed) and set strict inbound rules in the source station security group: only high-security back-to-source IP segment is allowed to access port 80/443 of the source station, blocking all other IP connections from the public network. In this way, even if a hacker scans your new IP, he cannot directly access or launch an attack.
4. architecture optimization and enterprise-level operation and maintenance suggestions
To protect the SEO experience (high speed, high availability) while protecting against DDoS, the following combination architecture is recommended:
Best Architecture Scenario:
Client ---> CDN / DCDN ---> DDoS high protection ---> load balancing (SLB) ---> origin station
Static resources go to CDN/DCDN: static files such as pictures, CSS, JS, etc. are handed over to CDN global nodes for acceleration, reducing the bandwidth pressure of high protection and greatly reducing user access delay.
Dynamic Request/Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-CNAME Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti-DDoS Anti Anti Anti-DDoS Anti-DDoS Anti-DDo.
Combined with the traffic scheduler: using the "traffic scheduler" function of ariyun high defense, the traffic goes through the normal acceleration route when there is no attack, and automatically cuts into the high defense once it encounters an attack. This can not only ensure the usual extreme speed (good SEO grab), but also at a critical moment to withstand the attack.
Operation and maintenance and cost control: reasonable planning of account number and fund link
High-security products are high-end security components, and the adjustment of specifications (such as guaranteed protection bandwidth and flexible protection bandwidth) is often accompanied by high costs. For many enterprise teams that have multiple sites and do business at home and abroad, the renewal and upgrade management of high defense and cloud resources must ensure extremely high stability, and service interruption must not be caused by credit card expiration or deduction failure.
In the actual project operation and maintenance, many mature enterprises will be through the official authorized partners.
Alibaba Cloud account recharge
With Escrow Services:
Fund and bill protection: through the professional Aliyun account recharge service, enterprises can use the public transfer method to deposit funds, flexible monthly/annual settlement, effectively avoiding the risk of deduction failure caused by personal credit card limit or wind control.
Support the combination of major customer discounts and traffic packages: When purchasing products such as high-security instances and DCDN traffic packages through proxy channels, you can usually obtain step-by-step discounts or exclusive service support supported by the original factory, significantly reducing the overall security defense cost.
Compliance and Invoice: Solves the pain points of corporate financial compliance and issuance of special VAT invoices, facilitating input deduction and cost accounting.
Summary
Alibaba Cloud Anti-DDoS Pro (new BGP) is a powerful and mature security product. After the access, there was a lag and a delay,
More than 90% of the reasons are that the network topology back-to-source path is not optimized and the source station security group does not release the back-to-source path.
The source IP segment or CC protection policy is too strict.
.
As an SEO optimizer or operation and maintenance engineer, you must remember these 16-word guidelines when accessing high defense:
White list of the whole network, short distance back to the source, hidden source IP of the source station, and usual scheduling.
Tuning network links to address stuck and latency, while combining compliance
Alibaba Cloud account top-up
Do a good job of financial protection of cloud resources, your website can be safe at the same time, in the search engine to maintain excellent loading speed and steady ranking growth