Geo-blocking

Scenarios

You can use geo-blocking when your businesses cannot be accessed by users in specific regions due to local laws and regulations or business attributes. CDN identifies client IP addresses to determine the user access source. The working principle is as follows:

1. Assume that your domain name www.example.com does not serve users in city W, and you have configured a blacklist for city W on the CDN console.
2. CDN receives a request to access www.example.com from an IP address in city W. The DNS resolves the request to a CDN PoP in city W.
3. The PoP detects that this IP address is not allowed to download resources under your domain name.
4. CDN returns HTTP status code 403 (Forbidden) to the user.

Precautions

• You can configure up to 20 rules.
• If a blacklist and whitelist are configured for the same resource, when a user in both lists accesses the resource, the blacklist takes effect and status code 403 is returned.
• If a blacklist and whitelist are configured for the same resource, when a user outside both lists accesses the resource, status code 403 is returned.
• Huawei Cloud periodically updates the IP address library. The locations of IP addresses that are not in the library cannot be identified. CDN allows requests from such IP addresses and returns resources to the users.
• If your domain name is connected to EdgeSec and a geo-blocking rule is configured in both services, the rule in CDN is executed first.

Procedure

1. Log in to Huawei Cloud console. Choose Service List > Content Delivery & Edge Computing > Content Delivery Network.

   The CDN console is displayed.

2. In the navigation pane, choose Domains.
3. In the domain list, click the target domain name or click Configure in the Operation column.
4. Click the Access Control tab.
5. In the Geo-blocking area, click Add.
   Figure 1 Adding a geo-blocking rule
   

   Table 1 Parameter details

   Parameter	Description	Example
   Rule Type	Blacklist: Users in regions specified in the blacklist cannot access resources and status code 403 is returned. Whitelist: Only users in regions specified in the whitelist can access resources. Status code 403 is returned for other users.	Blacklist
   Content	All files: The rule takes effect for all files. Directory: The rule takes effect for resources in the specified directory. Full path: The rule takes effect for resources corresponding to the paths.	All files
   Rule	Directory Start with a slash (/) and separate directories by commas (,). Enter up to 100 directories. Do not enter wildcard characters (*). Full path Start with a slash (/) or wildcard (*). Wildcards (*) can be used for match. Do not enter two consecutive wildcard characters (*). Enter up to two wildcard characters (*). Enter up to 100 paths and separate them by comma (,). NOTE: Each whitelist or blacklist rule must be unique. You can configure only one rule for all files.	/test/folder01,/test/folder02
   Locations	User locations to which the rule applies. That is, users in the specified locations cannot access the resources (blacklist) or only they can access the resources (whitelist). For details about the supported regions, see Table 2.	Chinese mainland
   IP Exceptions	IP addresses excluded from this rule. For example, if you have configured a blacklist whose Content is All files and added an exception IP address 0.0.0.0, this IP address is not restricted by this blacklist rule and requests from this IP address are accepted. IP addresses and CIDR blocks in the IP address/Subnet mask format are supported. Enter up to 500 IP addresses and CIDR blocks separated by commas (,). Wildcards are not supported, for example, 192.168.0.*. IPv6 is supported.	0.0.0.0

6. Configure related information and click OK.

Supported Regions

Examples

Example 1: Assume that you have configured the following rules for the domain name www.example.com.

Result:

• The blacklist takes precedence over the whitelist. Therefore, the blacklist takes effect. When a user in the Chinese mainland accesses a resource in the /test folder (for example, www.example.com/test/abc.jpg), status code 403 is returned.
• When a user in Hong Kong (China) accesses the same resource, neither the blacklist nor the whitelist is hit. In this case, the access is denied and status code 403 is returned.

Example 2: Assume that you have configured the following rules for the domain name www.example.com.

Result:

• When a user in Hong Kong (China) accesses a resource in the /test folder (for example, www.example.com/test/abc.jpg), the blacklist is hit and status code 403 is returned.
• When a user in the Chinese mainland accesses the same resource, the whitelist is hit and the resource is returned to the user.
• When a user in Macao (China) accesses the same resource, neither the blacklist nor the whitelist is hit. In this case, the access is denied by default and status code 403 is returned.

Example 3: Assume that you have configured the following rules for the domain name www.example.com.

Result:

• When a user in Hong Kong (China) accesses a resource in the /test/abc folder (for example, www.example.com/test/abc/1.jpg), the blacklist is hit and status code 403 is returned.
• When a user in the Chinese mainland accesses a resource in the /test folder (for example, www.example.com/test/cat.jpg), the whitelist is hit and the corresponding resource is returned to the user.
• When a user in Hong Kong (China) accesses a resource in the /test folder (for example, www.example.com/test/cat.jpg), neither the blacklist nor the whitelist is hit. In this case, the access is denied by default and status code 403 is returned.
• When a user in Macao (China) accesses a resource in the /test folder (for example, www.example.com/test/cat.jpg), neither the blacklist nor the whitelist is hit. In this case, the access is denied by default and status code 403 is returned.