In a communication network, IP addresses are unique and remain constant throughout the request process. When a client sends a request to CDN edge servers, the CDN can obtain the client’s IP address. Therefore, IP addresses can be used for access control. After receiving a client request, the CDN node checks the client IP address and then allows or denies the request according to the configured rules.

IP access rules are suitable for the following scenarios:

• When abnormal access behavior is detected from certain IP addresses, such as content piracy or attacks, those IP addresses can be added to a blacklist. Requests from those IP addresses to CDN servers will then be denied directly.
• When access to accelerated content should be restricted by IP address, such as allowing only employees within a company to access the content and denying access to others, the company’s fixed outbound IP addresses can be added to a whitelist. Requests from IP addresses not included in the whitelist will then be denied directly.
• When access to content should be restricted by geographic region, such as allowing viewing or downloading only for users in Singapore and denying access to users from other regions, the regional access control feature can be used.

How to Set Up an IP Access Rule

1. Log in to the Atomile Console and select the appropriate product.
2. Go to Configuration, locate the domain you want to configure, and click Edit Configuration.
3. In the left sidebar, go to Access Control - IP Access List and click Add.
4. Configure the settings according to your requirements.

Effective Range

This defines the range of requests to which the rule applies. You can choose from the following options:

Setting	Description
All Requests	The access control rule applies to all request types.
Only Homepage	Applies only to the root directory of the domain, such as http://domain/ or https://domain/.
Specified File Type	Applies only to specific file types. You can select predefined file types or define custom file types. Separate multiple custom types with a semicolon ;, for example, jpg;png.
Specified URI	Applies only to requests for content at a specific URI. Two URI matching options are available: Exact matching: Matches the complete URI, including query parameters, for example, path/index.html?abc=123. Ignore parameter matching: Matches the URI without query parameters, for example, path/index.html.
Specified Directory	Applies to requests under specific directories. For example, /file/abc/ applies to all content under http://domain/file/abc/*. Note: Directory paths must start and end with / and can contain only letters, numbers, and certain special characters (underscore, hyphen, percent sign, and period). Separate multiple directories with line breaks.
URL Pattern	Uses regular expressions to define the range of requests to which the rule applies. For example, the pattern .*\.jpg$ ensures that access control applies to all URLs ending with .jpg.

Rule Type

You can configure either an IP blacklist or an IP whitelist.

Type	Description
Blacklist	Configure an IP blacklist to deny access from specific IP addresses or IP ranges. Four options are available: Custom: Define a blacklist by entering specific IP addresses or IP ranges. Requests from these IPs are denied. All IPs: Denies access for all IP addresses. All IPv4: Denies access for IPv4 addresses only. All IPv6: Denies access for IPv6 addresses only. You can also allow access for certain IPs within a blocked range by configuring Exception IP Addresses/IP Segments. Multiple exceptions can be added at the same time and should be separated by ;.
Whitelist	Configure an IP whitelist to allow access only from specific IP addresses or IP ranges. Multiple IPs or IP ranges can be added at the same time and should be separated by ;.

The system supports only one whitelist rule. If multiple IP addresses or IP ranges are required, they must all be included in the same whitelist rule.

Action

When a client IP does not meet the configured rules and the request is denied by the CDN, choose whether to return an error directly or redirect the request to another URL.

• Deny Access: The CDN rejects the request and returns HTTP status code 403.
• Redirect URL: The CDN redirects the request to another URL.

Priority

When multiple access control rules are configured, the CDN applies them based on numerical priority. Higher numbers are evaluated first.

After you complete the configuration, click OK, and then click Next to submit your settings. To minimize potential disruption to your production environment, we strongly recommend performing a Pre-deploy test in a staging environment. This important step helps ensure that your configuration is correct before it goes live.

After you confirm that the settings are correct, click Deploy Now to apply them in the live environment. The configuration typically takes effect within 3 to 5 minutes. For more information about pre-deployment testing and validation, refer to Deploy the Configurations to Staging Environment for Validation.

Best Practices

Example 1: Configure an IP Blacklist

Block access from IP addresses 1.1.1.1 and 2.2.2.2 to http://atomile/browse/index.html.

Example 2: Configure an IP Whitelist

Allow access only from IP addresses 1.1.1.1 and 2.2.2.2 to http://atomile/browse/index.html.

Example 3: Permanent URL Ban

Block access to http://atomile/browse/index.html for all users. The block remains in effect until the configuration is removed manually.

Notes

Do not configure IP blacklists and whitelists at the same time, as this may cause all CDN access to be denied and affect your business. For example, if both an IP blacklist and whitelist are configured as shown below, all access requests may be denied by the CDN.

Why Would All Requests Be Denied?

1. When a request comes from IP address 1.1.1.1, it matches the IP blacklist rule and is denied by the CDN.
2. Requests from other IP addresses are not denied by the blacklist, but they still fail the whitelist rule, which allows access only from 1.1.1.1, and are therefore also denied.

If you need to configure both a blacklist and a whitelist, contact Atomile technical support for assistance to ensure the configuration is set up correctly.