Origin Protection(Obtaining/Updating Origin IP Address Range)
Feature Overview
The core of origin protection is to allow EdgeOne to access your origin server through a designated set of public IP address ranges (origin-pull IP address ranges). You can configure these IP address ranges as an "allowlist" in your origin server firewall or security group, thereby allowing trusted origin-pull traffic to pass through, effectively reducing the risk of malicious attackers bypassing EdgeOne to directly attack the origin server, enhancing origin server security and concealment, and achieving protection for the origin server.
This document introduces how to manually obtain and update EdgeOne's origin-pull IP range, or utilize the API to implement automated updates for configuring origin server firewall rules.
Note:
The origin protection feature is only supported for sites bound to a paid plan (non-free edition). The free edition plan is not supported.
Warning:
1. EdgeOne may update the origin IP range at irregular intervals to enhance network stability and reliability, improve security, handle expansion needs, or respond to compliance requirements. EdgeOne will send notifications via Message Center, SMS, or email 14 days, 7 days, 3 days, and 1 day before the change. Please ensure you have selected Message Center, SMS, and by email in Product notifications > Product service notifications in the Tencent Cloud Message Center console, and configured message recipients correctly. For the setting method, please refer to message subscription management.
2. Upon receiving Tencent's notification about "Origin IP Range Change Notification", please complete the origin IP range update operation by referring to Update Origin IP Range within no more than 14 calendar days. For example, if EO sends the "Origin IP Range Change Notification" at 12:00:00 (GMT+8) on January 1, 2025, you need to complete the origin IP range update operation by 12:00:00 (GMT+8) on January 15, 2025.
3. If you fail to complete the aforementioned operations within the agreed time limit, EdgeOne will update the CIDR blocks to the latest version in accordance with the Special Agreement for Enabling Origin Protection. Please understand and acknowledge that any adverse consequences arising from this, such as origin-pull failure and production service unavailability, will be borne by you, and such circumstances will not be covered under the service availability guarantee in the EdgeOne Service Level Agreement.
4. Origin protection is designed to minimize the risk of attacks on the origin server. However, the origin-pull IP address ranges provided by origin protection may contain a small number of IP addresses that do not belong to EdgeOne. If you need to further mitigate the risk of origin server attacks, we recommend that you use features such as origin-pull authentication (where custom authentication information is carried during origin-pull and the origin server responds only after successful verification) or mutual TLS authentication during origin-pull to perform a second-layer verification on origin-pull requests, thereby forming multi-layer protection.
Use Cases
Users who deploy their business origin servers on their own servers or cloud platforms and want to restrict IP address access through an allowlist to prevent the origin server from being bypassed and attacked.
Obtaining Origin IP Address Range
1. Log in to the Tencent Cloud EdgeOne console, enter Service Overview in the left menu bar, and click the site to be configured under Website Security Acceleration.
2. On the site details page, click Security > Origin Protection.
3. On the Origin Protection page, click Use Now, carefully read the Origin Protection Enablement Conditions of Use, and click Confirm to Enable after confirming the content of the "Special Agreement" is acceptable.
4. Click the origin protection status switch to set it to enable, select the site acceleration/Layer 4 proxy resource to be protected, and click Submit.
5. After successfully enabled, you can see the current origin-pull IP list used by these resources. Update it to your origin server firewall rules.
6. Log in to the cloud platform or server itself where your origin server is located, and locate the firewall/security group settings. Add inbound rules to allow traffic from all origin-pull IP ranges obtained in the above step 5 to access the ports required by your business (such as 80, 443).
Updating Origin IP Address Range
Note:
The IP range for origin servers is updated every 3-6 months on average.
Upon receiving the notification about the origin IP range change, you need to refer to the following steps to view the updated origin IP and complete the update within 14 calendar days to prevent service disruption caused by origin-pull failure.
1. Log in to the EdgeOne console, go to Service Overview in the left menu bar, and click the site listed in the in-console message/email under SCDN to enter the site details page.
2. On the site details page, click Security > Origin Protection.
3. Click Go to update.
4. The console will show the comparison information of old and new IP ranges. After updating the latest origin IP range to the origin server firewall, click I have updated to the latest origin IP range.
5. After confirming the update, the console shows "Origin IP ACL CIDRs is the latest version" to indicate the update is complete.
Automating Updates through API
If you wish to periodically obtain EdgeOne's latest origin IP range through automation scripts to avoid possible service interruption caused by untimely manual updates, you can leverage the API interface provided by EdgeOne to implement the following process:
1. Call the API regularly: call the DescribeOriginProtection API at a low frequency, preferably once every three days. Upon a successful call, the returned data contains the current Version field, which can be recorded for later comparison. If a network exception or insufficient permissions is returned, the script should retry and raise an alarm.
2. Check the update flag: in the data returned by the API, focus on the NextOriginACL field. If this field is not empty, it indicates that new origin IP address CIDR blocks are available for update. If NextOriginACL is empty, the current version is already the latest and no action is required.
"NextOriginACL":{
"Version":"mlc-1.0.1-20250422",
"PlannedActiveTime":"2014-12-30T10:00:00Z",
"EntireAddresses":{
"IPv4":[
"11.11.11.11/24",
"22.22.22.22/24"
],
"IPv6":[
"2001:980:7002:6::/64"
]
},
"AddedAddresses":{
"IPv4":[
"22.22.22.22/24"
],
"IPv6":[]
},
"RemovedAddresses":{
"IPv4":[],
"IPv6":[]
},
"NoChangeAddresses":{
"IPv4":[
"11.11.11.11/24"
],
"IPv6":[
"2001:980:7002:6::/64"
]
}
}
3. Synchronize configuration: After detecting an update, the script should automatically synchronize the new IP address CIDR blocks to your origin server firewall or security group policy. If synchronization fails, the script should retry and log an alarm to prevent origin-pull failures caused by missing origin server firewall rules.
4. Confirm the update: After synchronization is complete, call the ConfirmOriginIPACLUpdate API so that the system stops sending related change notifications. A successful response from the confirmation API indicates that the system has stopped sending change notifications, and you can verify that the console shows "Current origin IP is the latest version".
