Block malicious IPs and limit concurrent connections

Limitations

Support for access control to block malicious IPs and limit concurrent connections depends on the Web Hosting instance type. The following table provides details.

For Web Hosting instance types that do not support the console access control feature, you can block malicious IP addresses using the following alternative methods:

• Exclusive Web Hosting (Windows, economy edition): The console does not include an access control entry. Open the File Manager in the console, navigate to your website root directory, and edit the web.config file to add IP blocking rules. Example:

  <configuration>
    <system.webServer>
      <security>
        <ipSecurity allowUnlisted="true">
          <add ipAddress="192.168.0.1" allowed="false" />
          <add ipAddress="192.168.0.0" subnetMask="255.255.255.0" allowed="false" />
        </ipSecurity>
      </security>
    </system.webServer>
  </configuration>

• Exclusive Web Hosting (Linux, non-enhanced edition): Edit the .htaccess file in the website root directory and add blocking rules. Example:

  Order Deny,Allow
  Deny from 192.168.0.1
  Deny from 192.168.0.0/24

• Exclusive Web Hosting (Linux, enhanced edition): Modify the Nginx configuration file to block IP addresses. Example:

  deny 192.168.0.1;
  deny 192.168.0.0/24;

Usage notes

• When adding IP addresses to the IP blacklist, note the following:

  • You can block one or more malicious IP addresses.

  • To add multiple malicious IP addresses or IP address ranges, separate them with a comma (,) or a line break. For example, 192.168.0.1,192.168.0.0/24 blocks the IP address 192.168.0.1 and the IP address range 192.168.0.0/24.

  • You can enter up to 500 IP addresses, but you cannot block the 127.0.0.1 address.

  • After you block a malicious IP address, the specified IP address or IP address range cannot access your website or its FTP service.

• When limiting concurrent connections to control access frequency, note the following:

  • Limiting concurrent connections for each IP address or IP address range can mitigate the impact of DoS and DDoS attacks.

  • When setting a connection limit, set the value higher than the limit for common browsers. For example, most browsers allow about six concurrent connections per domain. Setting a lower value might degrade browser performance.

  • A limit that is too low can block access for multiple users sharing a single outbound IP address, such as users in an office.

Block malicious IPs

Blocking malicious IPs prevents them from accessing your website. If your website's connections are at their limit, block malicious IPs to ensure normal access for legitimate users.

1. Log on to the Cloud Web Hosting management page.
2. Find the Cloud Web Hosting instance you want to manage and click Manage in the Actions column.

3. In the left-side navigation pane, click Access Control.

4. On the IP Blacklist tab, click Add IP.

5. In the Add IP dialog box, enter the malicious IP address or IP address range in the IP field.

6. Click OK.

   The added IP address appears in the list.

   Note

   To remove one or more blocked IP addresses, select the IP addresses in the list, and then click Delete in the Actions column. Alternatively, click Batch Delete at the bottom of the list. In the message that appears, click OK.

Limit concurrent connections

A concurrent connection limit is the maximum number of simultaneous TCP connections a server allows. For example, if the limit is 10, a maximum of 10 connections can be active on the server at one time.

1. Log on to the Cloud Web Hosting management page.
2. Find the Cloud Web Hosting instance you want to manage and click Manage in the Actions column.

3. In the left-side navigation pane, click Access Control.

4. Click the Connection Limit tab.

5. In the Connection Limit Settings section, click [Enable Limit].

   By default, the connection limit status is Disabled.

6. In the [Enable Limit] dialog box, enter the concurrent connection limit and connection mask.

   The connection mask defines the network mask for the connection limit. The value can be any integer from 0 to 32, inclusive. The default value is 32. To enter a connection mask, first click Advanced Settings, and then enter a value based on your requirements.

   For example, if the concurrent connection limit is 10, a connection mask of 32 indicates that each source IP address can have a maximum of 10 connections. A connection mask of 24 limits each C-class network (/24 subnet) to a total of 10 connections. A connection mask of 0 limits the entire website to a total of 10 connections.

7. Click OK.

   After you set the limit, you can view the Connection Limit Status, Concurrent Connection Limit, and Connection Mask details.

8. (Optional) Modify or disable the connection limit.

   • Modify limit: If the current settings do not meet your needs, click [Modify Limit] in the Connection Limit Settings section. In the Modify Limit dialog box, change the concurrent connection limit and connection mask, and then click OK.

   • Disable limit: To disable the feature, click [Disable Limit] in the Connection Limit Settings section. In the confirmation message, click OK.

Monitor website connections

Web Hosting lets you monitor website connections in real time. You can hover over a point on the connection usage graph to view connection details for that specific time.

1. Log on to the Cloud Web Hosting management page.
2. Find the Cloud Web Hosting instance you want to manage and click Manage in the Actions column.

3. In the left-side navigation pane, click Access Control.

4. In the Monitoring Information section of the Access Control page, view the website connection status.

   Web Hosting provides two ways to view connection statistics: Statistics by Source IP and Statistics by Connection Type.

   • Statistics by Source IP

   • Statistics by Connection Type

FAQ

Related documents

• To improve the security of your website on a Web Hosting instance, configure different files to specify access permissions. This prevents malicious IP addresses from accessing your website and protects against hotlinking and resource scraping. For more information, see Improve website security by blocking malicious IP addresses.

• On Exclusive Web Hosting Linux non-enhanced edition instances, an incorrectly configured file, such as the .htaccess file, can cause high CPU or memory usage, which can make the website inaccessible. To resolve this issue, block IPs or limit concurrent connections. For more information, see Troubleshoot website inaccessibility due to high CPU or memory usage.