Anti-DDoS Origin Basic
DDoS attacks flood targeted systems to disrupt services. Alibaba Cloud provides free Anti-DDoS Origin Basic for NAT gateways, mitigating DDoS attacks at up to 5 Gbit/s.
How Anti-DDoS Origin Basic works
Anti-DDoS Origin Basic is enabled by default for NAT gateways, mitigating DDoS attacks at up to 5 Gbit/s. All Internet traffic passes through Alibaba Cloud Security for scrubbing before reaching the NAT gateway. For more information, see What is Anti-DDoS Native?.
If Internet traffic to a cluster exceeds Anti-DDoS capacity, all traffic is routed to a blackhole. For more information about the default thresholds at which Anti-DDoS Origin Basic automatically triggers blackhole filtering in each region, see View the thresholds that trigger blackhole filtering in Anti-DDoS Basic. Blackhole filtering thresholds for NAT gateways vary by region and bandwidth. Check the Assets page for current values.
Traffic scrubbing triggers based on:
Traffic patterns: Scrubbing triggers when traffic matches known attack patterns.
Traffic volume: When inbound traffic exceeds the threshold (set automatically based on NAT gateway bandwidth), all traffic is scrubbed regardless of type.
The methods of traffic scrubbing include attack packet filtering, bandwidth throttling, and packet throttling. The following scrubbing thresholds are provided by Anti-DDoS Origin Basic:
Scrubbing threshold based on bits per second (BPS): When the amount of inbound traffic per second exceeds this value, scrubbing is triggered.
Scrubbing threshold based on packets per second (PPS): When the number of inbound packets per second exceeds this value, scrubbing is triggered.
Scrubbing threshold
NAT gateway scrubbing thresholds are calculated as follows:
EIP bandwidth (Mbit/s) | Max BPS scrubbing threshold (Mbit/s) | Max PPS scrubbing threshold (pps) |
≤ 300 | 450 | 100,000 |
> 300 | EIP bandwidth × 1.5 | EIP bandwidth × 1,000 |
For example, if an EIP has 1,000 Mbit/s bandwidth, the max BPS scrubbing threshold is 1,500 Mbit/s and the max PPS scrubbing threshold is 1,000,000 pps.
After the EIP is associated with a cloud resource, the scrubbing thresholds change. Check the Assets page in the Anti-DDoS console for updated values. For more information, see View the Assets page.