WAF and security

Each CDN domain has a Firewall page where you manage the security policy that the edge applies to that domain. Go to CDN管理 (CDN) → 域名管理 (Domains), open a domain, then select 防火墙 (Firewall). The console URL is /cdn/domains/<domain>/firewall.

The Firewall page has four tabs:

When you save, the configuration is sent to the edge automatically. Changes usually take effect within seconds to a minute, and you don't need to purge the cache.

#WAF managed rule sets

The WAF (web application firewall) checks the URI, query string, User-Agent, Referer and cookies of each request. It also checks form and JSON request bodies. It looks for common attack payloads.

1. Open Firewall → 规则配置 (Rules) and find the WAF 预设规则集 (WAF managed rule sets) card.

2. Turn on the master switch in the card header.

3. Expand a category, then turn individual rule sets on or off:

   Rule set	Detects
   SQL injection	SQL injection payloads
   XSS	Cross-site scripting payloads
   Path traversal	../-style directory traversal
   Command injection	OS command injection
   LFI/RFI	Local and remote file inclusion
   Protocol attack	Malformed or abnormal HTTP requests
   Scanner detection	Common vulnerability scanners
   Bad robots	Known malicious crawlers

4. Under CRS 引擎设置 (engine settings), choose a 检测模式 (detection mode):

   • Active (拦截): blocks a matching request with 403 and logs the event.
   • Simulate (仅记录): logs the event but doesn't block. Use this to check for false positives before you enforce new rules.

5. Click 保存 (Save).

The anomaly score threshold (异常分阈值) applies to scoring rules. Each matching rule adds points to the request's score, and the request is blocked when its score reaches the threshold. The default is 5. Lower values are stricter.

#Custom WAF scoring rules

If the managed rule sets don't cover your case, add rules in the 自定义 WAF 规则（评分）(Custom WAF rules, scoring) card:

• Where to inspect: URI (with query string), path, query parameters, request body, a request header, a cookie, User-Agent, or method. For headers and cookies, you can give a name.
• Match type: regular expression, SQL injection (libinjection) or XSS (libinjection).
• Action:
  • Block: blocks immediately. You can set the status code; the default is 403.
  • Log (score): adds the rule's score to the request. The request is blocked once its total score reaches the anomaly score threshold.

#Custom firewall rules

A custom firewall rule pairs conditions with an action. Typical uses are blocking IP addresses, allowing traffic only from certain countries, and protecting login endpoints.

#Create a rule

1. In Rules, click 新增规则 (Add rule).
2. Enter a name. The priority can be from 1 to 9999; the default is 100.
3. Add one or more conditions. Each condition has a field, an optional key, an operator and a value. A request matches the rule only if it meets all of the conditions.
4. Choose an action and fill in its settings.
5. Save. You can enable, disable or delete a rule from the list at any time.

#Fields

The available operators are equals, not equals, contains, does not contain, starts with, ends with, in list, not in list, regex match, greater/less than (or equal), exists and does not exist. For list operators, put each value on its own line.

#Actions

#API example

Block a subnet:

curl -X POST "https://api.yeap.cloud/api/user/cdn/firewall-rules/create" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "domain_id": 123,
    "name": "Block bad subnet",
    "expression": {"op": "and", "conditions": [
      {"collection": "IP", "op": "in", "var": ["203.0.113.0/24"]}
    ]},
    "action": "block",
    "action_config": {"status": 403},
    "priority": 100,
    "enabled": true
  }'

Other endpoints:

• List rules: GET /api/user/cdn/firewall-rules?domain_id=123
• Update a rule: POST /api/user/cdn/firewall-rules/update, with id in the body
• Delete a rule: DELETE /api/user/cdn/firewall-rules/delete?id=<id>

#Rate limiting

To rate-limit traffic, create a firewall rule with the Rate limit action. Use its conditions to select the requests to protect, such as paths that start with /api/login. Then set:

• Request limit and window (seconds): the request is over the limit when the count within the window goes above the limit.
• Key: IP address, request header, cookie, URI path or country. For headers and cookies, also enter the name, such as X-Api-Key.
• Scope: Domain (整域) keeps a separate counter for each key value, such as one counter for each IP. Global (全局) uses one counter for all requests that match the rule.
• When exceeded: block with 429, challenge, log only, or tarpit. Tarpit slows the response down but doesn't reject it.

#Access control

The 访问控制 (Access control) tab contains several dedicated modules. Each module has its own switch. When you're done, click 保存访问控制 (Save access control) to save them all.

#Hotlink protection (Referer list)

• Allow empty Referer and Allow same domain: let through direct visits and links from your own site.
• Allowed domains: one entry per line. You can use exact names, wildcards such as *.example.com, or regular expressions that start with ~. If this list isn't empty, the Referer must match one of its entries.
• Blocked domains: a matching request is blocked. This list takes precedence over the allowed list.
• Protected extensions: limits protection to certain file types, such as .jpg or .mp4. Leave it empty to protect all paths.

#Country / ASN blocking

Set block and allow lists, one entry per line, for countries, subdivisions (ISO 3166-2 codes) and ASNs. A match on a block list is blocked. If the allow list for a dimension isn't empty, only visitors on that list are let through. When you use more than one dimension, a visitor must pass all of them.

#User-Agent list

Set the default action, how to handle an empty User-Agent, and the block status code, then add rules. Choosing allow as the default works as a blocklist; choosing block works as an allowlist. Rules are checked from top to bottom, and the first match decides the outcome. You can match by substring, wildcard, regex, exact value, prefix or suffix.

#Access authentication

You can set IP allow and deny lists, which accept CIDR ranges. You can also require HTTP Basic authentication, a token parameter, or a signed URL (types A, B, C or D). If you configure more than one method, choose whether a request must pass all of them or any one of them.

#Under-attack mode (UAM)

You can tune minimum wait (seconds) (5 or more recommended), difficulty (15 or more recommended) and clearance lifetime (seconds). Enter 0 to use the default. Allowlisted IPs/CIDRs skip the challenge in every mode. Static file extensions and allowed bot ASNs apply only in Adaptive mode; Under attack and Force CAPTCHA ignore them.

#Connection protection (Slowloris)

Limits the number of concurrent connections from each IP and detects slow-request attacks. You can set the minimum body transfer rate, sampling window, grace period, maximum idle time and maximum time to receive the body. Enter 0 for no limit.

#Related

• Page rules
• Logs and analytics