DDoS Protection - Learning Module

Loading content...

0/273

CDN for DDoS Mitigation

The Internet's Shield

When a 100+ Tbps attack targets your infrastructure, even the largest enterprise networks crumble. But Content Delivery Networks like Cloudflare, Akamai, and AWS CloudFront operate networks with 200+ Tbps capacity distributed across 300+ global points of presence. What would overwhelm any single organization barely registers on their monitoring dashboards.

CDNs weren't originally designed for security—they were built to cache content closer to users for lower latency. But their architecture provides inherent DDoS resilience:

Massive distributed capacity — Attack traffic is absorbed across hundreds of locations
Anycast routing — Traffic automatically routes to nearest POP
Traffic analysis at scale — Seeing internet traffic at global scale enables pattern detection
Caching reduces origin load — Cached responses don't require origin processing

Today, CDNs have evolved into comprehensive security platforms. This page explores how to leverage CDN architecture for robust DDoS protection.

What You Will Learn

By the end of this page, you will understand how CDN architecture provides DDoS resilience, how to configure CDNs for optimal protection, cache strategies that reduce origin exposure, origin protection techniques, and how to architect multi-CDN strategies for maximum resilience.

CDN Architecture for DDoS Defense

CDN architecture provides multiple layers of DDoS defense through its fundamental design:

1. Global Distribution:

CDNs operate hundreds of Points of Presence (POPs) worldwide. When attack traffic targets a CDN-protected site:

Traffic is distributed across all POPs based on attacker location
No single location receives the full attack volume
Each POP absorbs only its regional share

2. Massive Aggregate Capacity:

While a 100 Gbps attack might overwhelm a single datacenter, major CDNs operate networks of 100+ Tbps total capacity—1000x large attack volumes.

3. Anycast IP Addressing:

CDN edge servers share the same IP addresses globally. BGP routing automatically directs traffic to the topologically nearest POP, providing inherent load distribution and attack absorption.

Converting Mermaid diagram...

Major CDN Network Capacities (2024)
CDN Provider	Network Capacity	Global POPs	Countries
Cloudflare	209+ Tbps	310+	120+
Akamai	200+ Tbps	4,200+	130+
AWS CloudFront	Multi-Tbps	450+	90+
Fastly	270+ Tbps	90+	60+
Azure CDN	Multi-Tbps	180+	75+
Google Cloud CDN	Google scale	150+	40+

Caching as Defense

CDN caching isn't just about performance—it's a powerful DDoS defense mechanism. Cached content is served from edge servers without touching your origin, making cache optimization a security practice.

Cache Hit = Origin Protection:

Consider an attack sending 1 million requests/second:

0% cache hit rate: 1M requests hit origin → origin overwhelmed
90% cache hit rate: 100K requests hit origin → manageable
99% cache hit rate: 10K requests hit origin → barely noticeable

Cache-Everything Strategy:

Maximize caching for static assets and semi-static content:

Static files (CSS, JS, images, fonts): Cache indefinitely
API responses (where appropriate): Cache with short TTL
HTML pages: Cache with validation (ETag/Last-Modified)
Personalized content: Edge personalization or bypass

Cache Configuration for DDoS Resilience
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
# Cache everything: Maximum origin protection
# Cloudflare Pages Rules equivalent (conceptual)
 
# Static assets - Cache forever with version busting
- match: "/*.(js|css|png|jpg|gif|ico|woff2|svg)"
  settings:
    cache_level: cache_everything
    edge_cache_ttl: 31536000  # 1 year
    browser_cache_ttl: 31536000
    
# HTML pages - Cache with revalidation
- match: "/*.html"
  settings:
    cache_level: cache_everything
    edge_cache_ttl: 3600  # 1 hour
    origin_cache_control: on
    
# API responses - Short cache for common endpoints
- match: "/api/products/*"
  settings:
    cache_level: cache_everything
    edge_cache_ttl: 60  # 1 minute stale-while-revalidate
    
# Dynamic/personalized - Never cache, but protect
- match: "/api/user/*"
  settings:
    cache_level: bypass
    security_level: high
    waf: on

Cache Busting Attacks

Sophisticated attackers use unique query strings or cache-busting headers to bypass CDN cache. Mitigation: Strip unknown query parameters, ignore specific headers in cache keys, and use rate limiting on origin requests. Don't let attackers control your cache key.

Origin Protection Strategies

CDN protection is only effective if attackers cannot bypass it by contacting your origin server directly. Origin protection ensures all traffic must flow through CDN.

The Origin Exposure Problem:

Attackers can discover origin IPs through:

DNS history (check historical records)
SSL certificate transparency logs
HTTP headers revealing origin IP
Scanning IP ranges for similar server signatures
Email headers (if mail originates from web server)
Side channels (subdomain servers on same IP)

Origin Protection Strategies:

Origin Protection Techniques

•IP Allowlisting — Configure origin firewall to accept only CDN IP ranges. Most CDNs publish their IP ranges for this purpose.
•Authenticated Origin Pulls — Require mTLS or secret header for CDN-to-origin communication. Origin rejects requests without valid credentials.
•Private Connectivity — Use AWS PrivateLink, GCP Private Service Connect, or VPN tunnels between CDN and origin. No public origin IP exists.
•Change Origin IP — If origin is discovered, migrate to new IP and restrict to CDN-only access.
•Origin Shields — Add intermediate cache layer between edge and origin, reducing origin connections and adding protection layer.

Origin Protection Configurations
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
# Origin server NGINX configuration
# Only accept traffic from known CDN IP ranges
 
geo $is_cdn {
    default 0;
    
    # Cloudflare IPv4 ranges
    173.245.48.0/20 1;
    103.21.244.0/22 1;
    103.22.200.0/22 1;
    103.31.4.0/22 1;
    141.101.64.0/18 1;
    108.162.192.0/18 1;
    190.93.240.0/20 1;
    188.114.96.0/20 1;
    197.234.240.0/22 1;
    198.41.128.0/17 1;
    162.158.0.0/15 1;
    104.16.0.0/13 1;
    104.24.0.0/14 1;
    172.64.0.0/13 1;
    131.0.72.0/22 1;
    
    # Add your CDN's IP ranges here
}
 
server {
    listen 443 ssl;
    server_name origin.example.com;
    
    # Reject non-CDN traffic
    if ($is_cdn = 0) {
        return 403 "Direct access forbidden";
    }
    
    # Verify Cloudflare authenticated origin pull
    ssl_client_certificate /etc/nginx/certs/cloudflare_origin_ca.pem;
    ssl_verify_client on;
    
    location / {
        proxy_pass http://app:8080;
    }
}

Rotate Origin Secrets

If using secret headers for origin authentication, rotate these secrets regularly. If an attacker captures the secret through log exposure or breach, they can bypass CDN. Consider short-lived tokens with automatic rotation via secrets management.

CDN Security Features

Modern CDNs integrate comprehensive security features beyond basic caching and distribution:

Integrated DDoS Protection:

Major CDNs include automatic L3/L4 DDoS mitigation:

Cloudflare — Unmetered DDoS protection on all plans
AWS CloudFront + Shield — Standard (free) and Advanced protection
Akamai Prolexic — Dedicated scrubbing with CloudFront integration
Fastly — Edge rate limiting and DDoS mitigation

Bot Management:

Beyond basic WAF, CDNs offer bot detection platforms:

Machine learning-based bot classification
JavaScript challenges
Device fingerprinting
Behavioral analysis
Managed bot lists (search engines, social media, etc.)

CDN Security Feature Comparison
Feature	Cloudflare	AWS CloudFront	Akamai	Fastly
DDoS Protection	Unmetered, all plans	Shield Standard/Advanced	Prolexic add-on	Built-in
WAF	Ruleset + custom	AWS WAF integration	Kona Site Defender	Edge WAF
Bot Management	Bot Fight Mode (Pro+)	Bot Control (add-on)	Bot Manager	Next-Gen WAF
Rate Limiting	Configurable rules	AWS WAF rate rules	Rate Control	Edge rate limiting
SSL/TLS	Free universal SSL	ACM integration	SSL acceleration	Managed TLS
API Protection	API Shield	API Gateway	API Security	GraphQL protection

Edge Computing for Security:

CDN edge compute (Cloudflare Workers, Lambda@Edge, Fastly Compute@Edge) enables custom security logic at the edge:

Custom authentication schemes
Real-time threat response
Token validation without origin round-trips
A/B testing security measures
Geographic or device-based access control

Custom Security Logic at Edge
Cloudflare Workers
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
// Edge security logic with Cloudflare Workers
 
export default {
  async fetch(request, env) {
    // Get request details
    const ip = request.headers.get('CF-Connecting-IP');
    const country = request.headers.get('CF-IPCountry');
    const url = new URL(request.url);
    
    // Check IP reputation (from KV store)
    const ipReputation = await env.IP_REPUTATION.get(ip);
    if (ipReputation === 'blocked') {
      return new Response('Forbidden', { status: 403 });
    }
    
    // Geo-based restrictions for sensitive endpoints
    if (url.pathname.startsWith('/admin')) {
      const allowedCountries = ['US', 'CA', 'GB'];
      if (!allowedCountries.includes(country)) {
        return new Response('Access denied from your region', { 
          status: 403 
        });
      }
    }
    
    // Rate limiting check (using Durable Objects)
    const rateLimiter = env.RATE_LIMITER.get(
      env.RATE_LIMITER.idFromName(ip)
    );
    const rateLimitResult = await rateLimiter.fetch(request);
    if (rateLimitResult.status === 429) {
      return rateLimitResult;
    }
    
    // Token validation for API endpoints
    if (url.pathname.startsWith('/api/')) {
      const token = request.headers.get('Authorization');
      if (!token || !await validateToken(token, env)) {
        return new Response('Unauthorized', { status: 401 });
      }
    }
    
    // Custom headers to origin for tracking
    const modifiedRequest = new Request(request, {
      headers: new Headers(request.headers)
    });
    modifiedRequest.headers.set('X-Edge-Processed', 'true');
    modifiedRequest.headers.set('X-Client-Country', country);
    modifiedRequest.headers.set('X-Request-ID', crypto.randomUUID());
    
    // Forward to origin
    return fetch(modifiedRequest);
  }
};
 
async function validateToken(token, env) {
  // Implement JWT validation at edge
  const [header, payload, signature] = token.replace('Bearer ', '').split('.');
  
  try {
    const key = await crypto.subtle.importKey(
      'raw',
      new TextEncoder().encode(env.JWT_SECRET),
      { name: 'HMAC', hash: 'SHA-256' },
      false,
      ['verify']
    );
    
    const data = new TextEncoder().encode(`${header}.${payload}`);
    const sig = Uint8Array.from(atob(signature), c => c.charCodeAt(0));
    
    return await crypto.subtle.verify('HMAC', key, sig, data);
  } catch (e) {
    return false;
  }
}

Traffic Analysis at Scale

CDNs see internet traffic at a scale no individual organization can match. This visibility enables unique detection capabilities:

1. Cross-Customer Attack Correlation:

When attackers target multiple CDN customers, patterns emerge:

Same botnet IPs appearing across sites
Identical attack payloads with different targets
Coordinated timing of attacks

CDNs automatically block attackers identified across their customer base.

2. Global Threat Intelligence:

CDN traffic analysis identifies:

New attack techniques as they emerge
Botnet command-and-control infrastructure
Credential stuffing campaigns using leaked databases
Vulnerability exploitation attempts (zero-days)

3. Anomaly Detection at Internet Scale:

With baseline data from billions of requests daily, CDNs detect anomalies that would be noise at smaller scales:

Sudden geographic shifts in traffic
New device fingerprints appearing in volume
Unusual request pattern distributions

Converting Mermaid diagram...

Shared Defense Benefit

Using a major CDN means benefiting from security insights across their entire customer base. Attacks blocked on other sites protect you before attackers even target you. This network effect is a significant advantage over self-hosted security infrastructure.

Multi-CDN Strategies

For maximum resilience, some organizations deploy across multiple CDNs. While adding complexity, multi-CDN provides benefits:

Benefits:

No single point of failure — CDN-wide outages (rare but possible) don't affect availability
Attack absorption — If one CDN is targeted, traffic shifts to another
Vendor negotiation leverage — Competition keeps pricing competitive
Geographic optimization — Different CDNs excel in different regions

Implementation Approaches:

Multi-CDN Traffic Distribution

•DNS-Based Load Balancing — Use intelligent DNS (NS1, Route 53, DNSMadeEasy) to distribute traffic across CDNs based on health checks, geography, or performance.
•Active-Passive Failover — Primary CDN handles all traffic; secondary activates only during primary outage or attack. Simpler but doesn't distribute load.
•Weight-Based Distribution — Split traffic (e.g., 70/30) across CDNs. Both handle traffic normally; shift weights during incidents.
•Geography-Based Routing — Route regions to their best-performing CDN. Requires RUM data to determine optimal routing.

Multi-CDN with Route 53 Health Checks

HCL

# Terraform: Multi-CDN failover with Route 53
 
# Health checks for each CDN endpoint
resource "aws_route53_health_check" "cloudflare" {
  fqdn              = "cdn1.example.com"
  port              = 443
  type              = "HTTPS"
  resource_path     = "/health"
  failure_threshold = 2
  request_interval  = 10
 
  tags = {
    Name = "cloudflare-health"
  }
}
 
resource "aws_route53_health_check" "fastly" {
  fqdn              = "cdn2.example.com"
  port              = 443
  type              = "HTTPS"
  resource_path     = "/health"
  failure_threshold = 2
  request_interval  = 10
 
  tags = {
    Name = "fastly-health"
  }
}
 
# Primary record - Cloudflare
resource "aws_route53_record" "primary" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "www.example.com"
  type    = "A"
  
  set_identifier = "primary"
  
  failover_routing_policy {
    type = "PRIMARY"
  }
  
  alias {
    name                   = "cdn1.example.com"
    zone_id               = var.cloudflare_zone_id
    evaluate_target_health = true
  }
  
  health_check_id = aws_route53_health_check.cloudflare.id
}
 
# Secondary record - Fastly
resource "aws_route53_record" "secondary" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "www.example.com"
  type    = "A"
  
  set_identifier = "secondary"
  
  failover_routing_policy {
    type = "SECONDARY"
  }
  
  alias {
    name                   = "cdn2.example.com"
    zone_id               = var.fastly_zone_id
    evaluate_target_health = true
  }
  
  health_check_id = aws_route53_health_check.fastly.id
}
 
# Weighted distribution alternative
# resource "aws_route53_record" "weighted_cloudflare" {
#   zone_id        = aws_route53_zone.main.zone_id
#   name           = "www.example.com"
#   type           = "A"
#   set_identifier = "cloudflare"
#   
#   weighted_routing_policy {
#     weight = 70
#   }
#   
#   alias {
#     name    = "cdn1.example.com"
#     zone_id = var.cloudflare_zone_id
#   }
# }

Multi-CDN Complexity

Multi-CDN adds significant operational complexity: duplicate configurations, cache invalidation across vendors, different APIs and feature sets, and more complex debugging. Only pursue multi-CDN if your availability requirements justify the overhead. For most organizations, a single enterprise CDN with SLA provides sufficient resilience.

CDN Configuration Best Practices

Optimizing CDN configuration for DDoS resilience requires attention to multiple areas:

1. DNS Configuration:

Use CDN nameservers directly (benefits from CDN DNS DDoS protection)
If using external DNS, minimize TTL during incidents for faster failover
Enable DNSSEC to prevent DNS spoofing
Hide origin IP from DNS records

2. SSL/TLS Configuration:

Terminate SSL at edge (reduces origin load)
Use modern TLS versions only (1.2+)
Enable HSTS to prevent protocol downgrade attacks
Consider mutual TLS for origin authentication

CDN Security Checklist

•Enable all available DDoS protection — Many features are off by default or require explicit opt-in
•Configure WAF with appropriate rule sets — Use managed rules + custom rules for your application
•Set up rate limiting — Implement rate limits at edge before requests hit origin
•Enable bot management — Block malicious bots while allowing legitimate crawlers
•Maximize caching — Every cached request is one that doesn't hit origin during attack
•Protect origin servers — Use IP allowlisting, mTLS, or secret headers
•Monitor and alert — Configure dashboards and alerts for attack detection
•Plan for emergencies — Document escalation procedures with CDN vendor support

Comprehensive CDN Security Configuration
Cloudflare (API)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
#!/bin/bash
# Configure Cloudflare security settings via API
 
ZONE_ID="your-zone-id"
API_TOKEN="your-api-token"
API_URL="https://api.cloudflare.com/client/v4/zones/$ZONE_ID"
 
# Enable essential security features
curl -X PATCH "$API_URL/settings" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "items": [
      {"id": "security_level", "value": "medium"},
      {"id": "challenge_ttl", "value": 1800},
      {"id": "browser_check", "value": "on"},
      {"id": "opportunistic_encryption", "value": "on"},
      {"id": "always_use_https", "value": "on"},
      {"id": "min_tls_version", "value": "1.2"},
      {"id": "automatic_https_rewrites", "value": "on"},
      {"id": "email_obfuscation", "value": "on"},
      {"id": "hotlink_protection", "value": "on"},
      {"id": "waf", "value": "on"}
    ]
  }'
 
# Enable Bot Fight Mode (requires Pro+)
curl -X PUT "$API_URL/bot_management" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "fight_mode": true,
    "challenge_mode": true
  }'
 
# Create rate limiting rule
curl -X POST "$API_URL/rate_limits" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "threshold": 100,
    "period": 60,
    "match": {
      "request": {
        "url_pattern": "*"
      }
    },
    "action": {
      "mode": "challenge",
      "timeout": 3600
    },
    "disabled": false,
    "description": "Global rate limit - 100 req/min per IP"
  }'
 
echo "Security configuration applied successfully"

Incident Response with CDN

When attacks occur, your CDN is your first responder. Having documented procedures ensures rapid, effective response:

Detection:

Monitor CDN dashboards for traffic anomalies
Set up alerts for blocked request spikes
Watch origin error rates (may indicate attack bypassing CDN)
Monitor bandwidth and request counts

Immediate Response Actions:

DDoS Incident Response Runbook
Phase	Action	CDN Capability
Detection	Identify attack type and scale	Real-time analytics dashboard
Triage	Assess impact on legitimate users	Sampled request logging
Mitigation	Enable I'm Under Attack mode (Cloudflare) or equivalent	Aggressive challenge posture
Mitigation	Increase security level	Block suspicious traffic
Mitigation	Enable geo-blocking for non-critical regions	Country/region blocking
Mitigation	Reduce rate limits	Tighten thresholds
Analysis	Review blocked request patterns	WAF logging and sampling
Response	Create custom rules targeting attack signature	Custom WAF rules
Recovery	Gradually relax emergency measures	Staged rollback
Post-Incident	Document and improve	Log access for forensics

Vendor Support Escalation:

Know how to escalate to your CDN's security team:

Cloudflare Enterprise: Dedicated customer success + 24/7 emergency support
AWS Shield Advanced: 24/7 DRT (DDoS Response Team) engagement
Akamai: SOCC (Security Operations Command Center) engagement

Maintain up-to-date contact information and escalation procedures. During an attack is not the time to figure out how to reach support.

Practice Before Incidents

Run DDoS drills before real attacks. Test emergency procedures, practice CDN configuration changes, and verify vendor escalation paths work. An incident is the worst time to learn your runbook has gaps or vendor contacts are outdated.

Summary: CDN for DDoS Mitigation

CDNs provide the most accessible and cost-effective foundation for DDoS protection. Their inherent architecture—massive capacity, global distribution, anycast routing—absorbs attacks that would overwhelm any single organization's infrastructure.

Key Takeaways

•CDN architecture is inherently defensive — Global distribution, anycast routing, and massive capacity absorb attacks
•Caching is security — High cache hit rates dramatically reduce origin exposure during attacks
•Origin protection is mandatory — Attackers who discover origin IPs bypass CDN protection entirely
•Integrated security features add layers — WAF, bot management, rate limiting, and threat intelligence
•Edge compute enables custom security — Run security logic at edge for zero-latency protection
•Scale enables unique detection — CDN traffic visibility identifies threats no single customer can see
•Multi-CDN adds resilience at cost of complexity — Only pursue if availability requirements demand it
•Incident response procedures are essential — Document and practice runbooks before attacks occur

Module Complete:

You've now completed the comprehensive exploration of DDoS protection for distributed systems. From understanding attack types through Layer 3/4 defenses, Layer 7 protection, WAF implementation, and CDN-based mitigation, you have the knowledge to architect systems resilient against the internet's most pervasive threat.

Remember: DDoS protection is not a one-time implementation but an ongoing practice. Attacks evolve, your application changes, and new vulnerabilities emerge. Continuous monitoring, regular testing, and staying current with threat intelligence are essential for maintaining effective protection.

Module Complete

You now understand the complete landscape of DDoS protection at scale—from attack taxonomy through defense in depth across all network layers. With CDN-based mitigation as your foundation, layered with L3/L4 filtering, L7 intelligence, and WAF protection, your distributed systems can withstand the most aggressive attacks while maintaining availability for legitimate users.

CDN for DDoS Mitigation

The Internet's Shield

CDNs weren't originally designed for security—they were built to cache content closer to users for lower latency. But their architecture provides inherent DDoS resilience:

Massive distributed capacity — Attack traffic is absorbed across hundreds of locations
Anycast routing — Traffic automatically routes to nearest POP
Traffic analysis at scale — Seeing internet traffic at global scale enables pattern detection
Caching reduces origin load — Cached responses don't require origin processing

Today, CDNs have evolved into comprehensive security platforms. This page explores how to leverage CDN architecture for robust DDoS protection.

What You Will Learn

CDN Architecture for DDoS Defense

CDN architecture provides multiple layers of DDoS defense through its fundamental design:

1. Global Distribution:

CDNs operate hundreds of Points of Presence (POPs) worldwide. When attack traffic targets a CDN-protected site:

Traffic is distributed across all POPs based on attacker location
No single location receives the full attack volume
Each POP absorbs only its regional share

2. Massive Aggregate Capacity:

While a 100 Gbps attack might overwhelm a single datacenter, major CDNs operate networks of 100+ Tbps total capacity—1000x large attack volumes.

3. Anycast IP Addressing:

CDN edge servers share the same IP addresses globally. BGP routing automatically directs traffic to the topologically nearest POP, providing inherent load distribution and attack absorption.

Converting Mermaid diagram...

Major CDN Network Capacities (2024)
CDN Provider	Network Capacity	Global POPs	Countries
Cloudflare	209+ Tbps	310+	120+
Akamai	200+ Tbps	4,200+	130+
AWS CloudFront	Multi-Tbps	450+	90+
Fastly	270+ Tbps	90+	60+
Azure CDN	Multi-Tbps	180+	75+
Google Cloud CDN	Google scale	150+	40+

Caching as Defense

Cache Hit = Origin Protection:

Consider an attack sending 1 million requests/second:

0% cache hit rate: 1M requests hit origin → origin overwhelmed
90% cache hit rate: 100K requests hit origin → manageable
99% cache hit rate: 10K requests hit origin → barely noticeable

Cache-Everything Strategy:

Maximize caching for static assets and semi-static content:

Static files (CSS, JS, images, fonts): Cache indefinitely
API responses (where appropriate): Cache with short TTL
HTML pages: Cache with validation (ETag/Last-Modified)
Personalized content: Edge personalization or bypass

Cache Configuration for DDoS Resilience
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
# Cache everything: Maximum origin protection
# Cloudflare Pages Rules equivalent (conceptual)
 
# Static assets - Cache forever with version busting
- match: "/*.(js|css|png|jpg|gif|ico|woff2|svg)"
  settings:
    cache_level: cache_everything
    edge_cache_ttl: 31536000  # 1 year
    browser_cache_ttl: 31536000
    
# HTML pages - Cache with revalidation
- match: "/*.html"
  settings:
    cache_level: cache_everything
    edge_cache_ttl: 3600  # 1 hour
    origin_cache_control: on
    
# API responses - Short cache for common endpoints
- match: "/api/products/*"
  settings:
    cache_level: cache_everything
    edge_cache_ttl: 60  # 1 minute stale-while-revalidate
    
# Dynamic/personalized - Never cache, but protect
- match: "/api/user/*"
  settings:
    cache_level: bypass
    security_level: high
    waf: on

Cache Busting Attacks

Origin Protection Strategies

CDN protection is only effective if attackers cannot bypass it by contacting your origin server directly. Origin protection ensures all traffic must flow through CDN.

The Origin Exposure Problem:

Attackers can discover origin IPs through:

DNS history (check historical records)
SSL certificate transparency logs
HTTP headers revealing origin IP
Scanning IP ranges for similar server signatures
Email headers (if mail originates from web server)
Side channels (subdomain servers on same IP)

Origin Protection Strategies:

Origin Protection Techniques

•IP Allowlisting — Configure origin firewall to accept only CDN IP ranges. Most CDNs publish their IP ranges for this purpose.
•Authenticated Origin Pulls — Require mTLS or secret header for CDN-to-origin communication. Origin rejects requests without valid credentials.
•Private Connectivity — Use AWS PrivateLink, GCP Private Service Connect, or VPN tunnels between CDN and origin. No public origin IP exists.
•Change Origin IP — If origin is discovered, migrate to new IP and restrict to CDN-only access.
•Origin Shields — Add intermediate cache layer between edge and origin, reducing origin connections and adding protection layer.

Origin Protection Configurations
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
# Origin server NGINX configuration
# Only accept traffic from known CDN IP ranges
 
geo $is_cdn {
    default 0;
    
    # Cloudflare IPv4 ranges
    173.245.48.0/20 1;
    103.21.244.0/22 1;
    103.22.200.0/22 1;
    103.31.4.0/22 1;
    141.101.64.0/18 1;
    108.162.192.0/18 1;
    190.93.240.0/20 1;
    188.114.96.0/20 1;
    197.234.240.0/22 1;
    198.41.128.0/17 1;
    162.158.0.0/15 1;
    104.16.0.0/13 1;
    104.24.0.0/14 1;
    172.64.0.0/13 1;
    131.0.72.0/22 1;
    
    # Add your CDN's IP ranges here
}
 
server {
    listen 443 ssl;
    server_name origin.example.com;
    
    # Reject non-CDN traffic
    if ($is_cdn = 0) {
        return 403 "Direct access forbidden";
    }
    
    # Verify Cloudflare authenticated origin pull
    ssl_client_certificate /etc/nginx/certs/cloudflare_origin_ca.pem;
    ssl_verify_client on;
    
    location / {
        proxy_pass http://app:8080;
    }
}

Rotate Origin Secrets

CDN Security Features

Modern CDNs integrate comprehensive security features beyond basic caching and distribution:

Integrated DDoS Protection:

Major CDNs include automatic L3/L4 DDoS mitigation:

Cloudflare — Unmetered DDoS protection on all plans
AWS CloudFront + Shield — Standard (free) and Advanced protection
Akamai Prolexic — Dedicated scrubbing with CloudFront integration
Fastly — Edge rate limiting and DDoS mitigation

Bot Management:

Beyond basic WAF, CDNs offer bot detection platforms:

Machine learning-based bot classification
JavaScript challenges
Device fingerprinting
Behavioral analysis
Managed bot lists (search engines, social media, etc.)

CDN Security Feature Comparison
Feature	Cloudflare	AWS CloudFront	Akamai	Fastly
DDoS Protection	Unmetered, all plans	Shield Standard/Advanced	Prolexic add-on	Built-in
WAF	Ruleset + custom	AWS WAF integration	Kona Site Defender	Edge WAF
Bot Management	Bot Fight Mode (Pro+)	Bot Control (add-on)	Bot Manager	Next-Gen WAF
Rate Limiting	Configurable rules	AWS WAF rate rules	Rate Control	Edge rate limiting
SSL/TLS	Free universal SSL	ACM integration	SSL acceleration	Managed TLS
API Protection	API Shield	API Gateway	API Security	GraphQL protection

Edge Computing for Security:

CDN edge compute (Cloudflare Workers, Lambda@Edge, Fastly Compute@Edge) enables custom security logic at the edge:

Custom authentication schemes
Real-time threat response
Token validation without origin round-trips
A/B testing security measures
Geographic or device-based access control

Custom Security Logic at Edge
Cloudflare Workers
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
// Edge security logic with Cloudflare Workers
 
export default {
  async fetch(request, env) {
    // Get request details
    const ip = request.headers.get('CF-Connecting-IP');
    const country = request.headers.get('CF-IPCountry');
    const url = new URL(request.url);
    
    // Check IP reputation (from KV store)
    const ipReputation = await env.IP_REPUTATION.get(ip);
    if (ipReputation === 'blocked') {
      return new Response('Forbidden', { status: 403 });
    }
    
    // Geo-based restrictions for sensitive endpoints
    if (url.pathname.startsWith('/admin')) {
      const allowedCountries = ['US', 'CA', 'GB'];
      if (!allowedCountries.includes(country)) {
        return new Response('Access denied from your region', { 
          status: 403 
        });
      }
    }
    
    // Rate limiting check (using Durable Objects)
    const rateLimiter = env.RATE_LIMITER.get(
      env.RATE_LIMITER.idFromName(ip)
    );
    const rateLimitResult = await rateLimiter.fetch(request);
    if (rateLimitResult.status === 429) {
      return rateLimitResult;
    }
    
    // Token validation for API endpoints
    if (url.pathname.startsWith('/api/')) {
      const token = request.headers.get('Authorization');
      if (!token || !await validateToken(token, env)) {
        return new Response('Unauthorized', { status: 401 });
      }
    }
    
    // Custom headers to origin for tracking
    const modifiedRequest = new Request(request, {
      headers: new Headers(request.headers)
    });
    modifiedRequest.headers.set('X-Edge-Processed', 'true');
    modifiedRequest.headers.set('X-Client-Country', country);
    modifiedRequest.headers.set('X-Request-ID', crypto.randomUUID());
    
    // Forward to origin
    return fetch(modifiedRequest);
  }
};
 
async function validateToken(token, env) {
  // Implement JWT validation at edge
  const [header, payload, signature] = token.replace('Bearer ', '').split('.');
  
  try {
    const key = await crypto.subtle.importKey(
      'raw',
      new TextEncoder().encode(env.JWT_SECRET),
      { name: 'HMAC', hash: 'SHA-256' },
      false,
      ['verify']
    );
    
    const data = new TextEncoder().encode(`${header}.${payload}`);
    const sig = Uint8Array.from(atob(signature), c => c.charCodeAt(0));
    
    return await crypto.subtle.verify('HMAC', key, sig, data);
  } catch (e) {
    return false;
  }
}

Traffic Analysis at Scale

CDNs see internet traffic at a scale no individual organization can match. This visibility enables unique detection capabilities:

1. Cross-Customer Attack Correlation:

When attackers target multiple CDN customers, patterns emerge:

Same botnet IPs appearing across sites
Identical attack payloads with different targets
Coordinated timing of attacks

CDNs automatically block attackers identified across their customer base.

2. Global Threat Intelligence:

CDN traffic analysis identifies:

New attack techniques as they emerge
Botnet command-and-control infrastructure
Credential stuffing campaigns using leaked databases
Vulnerability exploitation attempts (zero-days)

3. Anomaly Detection at Internet Scale:

With baseline data from billions of requests daily, CDNs detect anomalies that would be noise at smaller scales:

Sudden geographic shifts in traffic
New device fingerprints appearing in volume
Unusual request pattern distributions

Converting Mermaid diagram...

Shared Defense Benefit

Multi-CDN Strategies

For maximum resilience, some organizations deploy across multiple CDNs. While adding complexity, multi-CDN provides benefits:

Benefits:

No single point of failure — CDN-wide outages (rare but possible) don't affect availability
Attack absorption — If one CDN is targeted, traffic shifts to another
Vendor negotiation leverage — Competition keeps pricing competitive
Geographic optimization — Different CDNs excel in different regions

Implementation Approaches:

Multi-CDN Traffic Distribution

•DNS-Based Load Balancing — Use intelligent DNS (NS1, Route 53, DNSMadeEasy) to distribute traffic across CDNs based on health checks, geography, or performance.
•Active-Passive Failover — Primary CDN handles all traffic; secondary activates only during primary outage or attack. Simpler but doesn't distribute load.
•Weight-Based Distribution — Split traffic (e.g., 70/30) across CDNs. Both handle traffic normally; shift weights during incidents.
•Geography-Based Routing — Route regions to their best-performing CDN. Requires RUM data to determine optimal routing.

Multi-CDN with Route 53 Health Checks

HCL

# Terraform: Multi-CDN failover with Route 53
 
# Health checks for each CDN endpoint
resource "aws_route53_health_check" "cloudflare" {
  fqdn              = "cdn1.example.com"
  port              = 443
  type              = "HTTPS"
  resource_path     = "/health"
  failure_threshold = 2
  request_interval  = 10
 
  tags = {
    Name = "cloudflare-health"
  }
}
 
resource "aws_route53_health_check" "fastly" {
  fqdn              = "cdn2.example.com"
  port              = 443
  type              = "HTTPS"
  resource_path     = "/health"
  failure_threshold = 2
  request_interval  = 10
 
  tags = {
    Name = "fastly-health"
  }
}
 
# Primary record - Cloudflare
resource "aws_route53_record" "primary" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "www.example.com"
  type    = "A"
  
  set_identifier = "primary"
  
  failover_routing_policy {
    type = "PRIMARY"
  }
  
  alias {
    name                   = "cdn1.example.com"
    zone_id               = var.cloudflare_zone_id
    evaluate_target_health = true
  }
  
  health_check_id = aws_route53_health_check.cloudflare.id
}
 
# Secondary record - Fastly
resource "aws_route53_record" "secondary" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "www.example.com"
  type    = "A"
  
  set_identifier = "secondary"
  
  failover_routing_policy {
    type = "SECONDARY"
  }
  
  alias {
    name                   = "cdn2.example.com"
    zone_id               = var.fastly_zone_id
    evaluate_target_health = true
  }
  
  health_check_id = aws_route53_health_check.fastly.id
}
 
# Weighted distribution alternative
# resource "aws_route53_record" "weighted_cloudflare" {
#   zone_id        = aws_route53_zone.main.zone_id
#   name           = "www.example.com"
#   type           = "A"
#   set_identifier = "cloudflare"
#   
#   weighted_routing_policy {
#     weight = 70
#   }
#   
#   alias {
#     name    = "cdn1.example.com"
#     zone_id = var.cloudflare_zone_id
#   }
# }

Multi-CDN Complexity

CDN Configuration Best Practices

Optimizing CDN configuration for DDoS resilience requires attention to multiple areas:

1. DNS Configuration:

Use CDN nameservers directly (benefits from CDN DNS DDoS protection)
If using external DNS, minimize TTL during incidents for faster failover
Enable DNSSEC to prevent DNS spoofing
Hide origin IP from DNS records

2. SSL/TLS Configuration:

Terminate SSL at edge (reduces origin load)
Use modern TLS versions only (1.2+)
Enable HSTS to prevent protocol downgrade attacks
Consider mutual TLS for origin authentication

CDN Security Checklist

•Enable all available DDoS protection — Many features are off by default or require explicit opt-in
•Configure WAF with appropriate rule sets — Use managed rules + custom rules for your application
•Set up rate limiting — Implement rate limits at edge before requests hit origin
•Enable bot management — Block malicious bots while allowing legitimate crawlers
•Maximize caching — Every cached request is one that doesn't hit origin during attack
•Protect origin servers — Use IP allowlisting, mTLS, or secret headers
•Monitor and alert — Configure dashboards and alerts for attack detection
•Plan for emergencies — Document escalation procedures with CDN vendor support

Comprehensive CDN Security Configuration
Cloudflare (API)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
#!/bin/bash
# Configure Cloudflare security settings via API
 
ZONE_ID="your-zone-id"
API_TOKEN="your-api-token"
API_URL="https://api.cloudflare.com/client/v4/zones/$ZONE_ID"
 
# Enable essential security features
curl -X PATCH "$API_URL/settings" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "items": [
      {"id": "security_level", "value": "medium"},
      {"id": "challenge_ttl", "value": 1800},
      {"id": "browser_check", "value": "on"},
      {"id": "opportunistic_encryption", "value": "on"},
      {"id": "always_use_https", "value": "on"},
      {"id": "min_tls_version", "value": "1.2"},
      {"id": "automatic_https_rewrites", "value": "on"},
      {"id": "email_obfuscation", "value": "on"},
      {"id": "hotlink_protection", "value": "on"},
      {"id": "waf", "value": "on"}
    ]
  }'
 
# Enable Bot Fight Mode (requires Pro+)
curl -X PUT "$API_URL/bot_management" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "fight_mode": true,
    "challenge_mode": true
  }'
 
# Create rate limiting rule
curl -X POST "$API_URL/rate_limits" \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "threshold": 100,
    "period": 60,
    "match": {
      "request": {
        "url_pattern": "*"
      }
    },
    "action": {
      "mode": "challenge",
      "timeout": 3600
    },
    "disabled": false,
    "description": "Global rate limit - 100 req/min per IP"
  }'
 
echo "Security configuration applied successfully"

Incident Response with CDN

When attacks occur, your CDN is your first responder. Having documented procedures ensures rapid, effective response:

Detection:

Monitor CDN dashboards for traffic anomalies
Set up alerts for blocked request spikes
Watch origin error rates (may indicate attack bypassing CDN)
Monitor bandwidth and request counts

Immediate Response Actions:

DDoS Incident Response Runbook
Phase	Action	CDN Capability
Detection	Identify attack type and scale	Real-time analytics dashboard
Triage	Assess impact on legitimate users	Sampled request logging
Mitigation	Enable I'm Under Attack mode (Cloudflare) or equivalent	Aggressive challenge posture
Mitigation	Increase security level	Block suspicious traffic
Mitigation	Enable geo-blocking for non-critical regions	Country/region blocking
Mitigation	Reduce rate limits	Tighten thresholds
Analysis	Review blocked request patterns	WAF logging and sampling
Response	Create custom rules targeting attack signature	Custom WAF rules
Recovery	Gradually relax emergency measures	Staged rollback
Post-Incident	Document and improve	Log access for forensics

Vendor Support Escalation:

Know how to escalate to your CDN's security team:

Cloudflare Enterprise: Dedicated customer success + 24/7 emergency support
AWS Shield Advanced: 24/7 DRT (DDoS Response Team) engagement
Akamai: SOCC (Security Operations Command Center) engagement

Maintain up-to-date contact information and escalation procedures. During an attack is not the time to figure out how to reach support.

Practice Before Incidents

Summary: CDN for DDoS Mitigation

Key Takeaways

•CDN architecture is inherently defensive — Global distribution, anycast routing, and massive capacity absorb attacks
•Caching is security — High cache hit rates dramatically reduce origin exposure during attacks
•Origin protection is mandatory — Attackers who discover origin IPs bypass CDN protection entirely
•Integrated security features add layers — WAF, bot management, rate limiting, and threat intelligence
•Edge compute enables custom security — Run security logic at edge for zero-latency protection
•Scale enables unique detection — CDN traffic visibility identifies threats no single customer can see
•Multi-CDN adds resilience at cost of complexity — Only pursue if availability requirements demand it
•Incident response procedures are essential — Document and practice runbooks before attacks occur

Module Complete:

Module Complete