Help Center/ Anti-DDoS Service/ User Guide/ Advanced Anti-DDoS User Guide/ Managing Domain Names/ Configuring Field Forwarding
Updated on 2026-08-26 GMT+08:00
View PDF
Share

Configuring Field Forwarding

After connecting your website to Advanced Anti-DDoS, you can configure Header field forwarding for your domain name. This inserts custom fields into the Header field before traffic is passed to your origin server, enabling backend servers to analyze traffic forwarded by Advanced Anti-DDoS. This section describes how to configure field forwarding.

Limitations and Constraints

  • You can configure up to eight key/value pairs.
  • Note that the key value of a custom header field cannot be the same as any native Nginx fields.
  • The value can be set to a custom string or a variable starting with $. Variables starting with $ support only the following fields: 
    $time_local
$request_id
$connection_requests
$tenant_id
$project_id
$remote_addr
$remote_port
$scheme
$request_method
$http_host
$origin_uri
$request_length
$ssl_server_name
$ssl_protocol
$ssl_curves
$ssl_session_reused

Application Scenarios

Table 1 Application scenarios of the value

Value

Description

Application Scenario

$time_local

Local access time of the server.

The access log records the request time, which is used to filter and collect statistics on requests by time.

$request_id

Unique ID of a request.

Check the access latency problem at the front end.

$connection_requests

Number of requests per connection.

Monitor connection reuse.

$tenant_id

Huawei Cloud user ID.

Service providers can distinguish requests from different users based on this value.

$project_id

Service project ID.

Multiple projects share the same gateway. Exceptions are collected by project to accurately locate affected services.

$remote_addr

Layer-4 network address of the client.

IP address-based traffic limiting, access control (blacklist and whitelist), and region statistics.

$remote_port

Layer-4 network port of the client.

Assistance to source tracing: If a large number of requests are initiated from different ports of the same IP address, they are regarded as a batch scan.

$scheme

Request protocol (HTTP or HTTPS).

Distinguish plaintext and encrypted access.

$request_method

Request method.

Method-level access control, RESTful route distribution, and traffic limiting policies.

$http_host

Request host header.

Distinguish sites with multiple domain names.

$origin_uri

Original request URL.

Record the original path before rewriting, which is used to debug the rewriting rules and collect access statistics.

$request_length

Total length of a request.

Limit the request body size and detect oversized request attacks.

$ssl_server_name

Server name requested by the client in TLS Server Name Indication (SNI).

Encrypted malicious connections without a Host header.

$ssl_protocol

SSL/TLS version.

Security compliance audit, which forcibly checks the minimum protocol version.

$ssl_curves

Elliptic curve algorithm used in the TLS handshake.

Check for security risks and identify malicious connections with weak encryption curves.

$ssl_session_reused

SSL session reuse identifier.

Evaluate the TLS session reuse rate to optimize handshake performance.

Configuring Field Forwarding

  1. Log in to the AAD console.
  2. In the navigation pane on the left, choose Advanced Anti-DDoS > Domain Name Access. The Domain Name Access page is displayed.
  3. In the Advanced Setting column of the row containing the target domain name, click Modify.
  4. Enter the Key/Value value and click Add.

    Figure 1 Forwarding rule fields

  5. Click OK.
Parent Topic: Managing Domain Names