Setting up DDoSX^®, CDN and WAF using an ALIAS, ANAME or CNAME¶

1) Prepare your domain¶

The first step to setting up DDoSX^® via an ALIAS, ANAME or CNAME is to prepare and check your domain before enabling DDoSX^® protection.

Before setting up a external domain in DDoSX^®, double-check that your current DNS provider allow the creation of either an ALIAS, ANAME or flattened CNAME record if you wish to put your root domain (like ukfast.co.uk) behind DDoSX^®.

Some DNS providers that allow these records include:

On the other hand, if you only wish to place subdomains that are not used in MX records etc behind DDoSX^®, then using a normal CNAME should work fine.

2) Connect and verify your domain¶

• Login to MyUKFast and head to DDoSX® Protection in the navigation menu.

• Click the red GET STARTED button if this is your first domain, or click ‘Add additional domain’ in the top-right if this is an additional domain.

• Enter the domain that you want to protect in the ‘Domain Name’ text box

• As this is an external domain, a message in a blue box should appear informing you that this domain is not in SafeDNS and will need to be setup via DNS changed.

• Select any additional features you’d like to add to this domain such as CDN or WAF by clicking the checkbox next to your chosen features.

• Double-check your domain and selected additional features and then press ‘Buy Now’

• Click Complete Transaction on the next page to complete the payment process. (You won’t have to complete this step if you have already ordered DDoSX^®, WAF or CDN via your UKFast account manager - Any existing credits will be consumed first).

Once the transaction has completed, you will be asked to verify that you own this domain. You can do this one of two ways, either add a TXT record in your current DNS provider with the provided value, or upload a file to your server that can be accessed via your domain.

CLI

ans ddosx domain create mydomain.example --name "mydomain.example"

• Select the verification type you want to use

Verify via DNS

• Select the DNS verification method

• Create a TXT record with your current DNS provider for the root of your domain, setting the value of the TXT record to the value provided on the verify domain page. An @ symbol or blank value is commonly used when specifying the root domain. For example:

• Once the TXT record has been created, allow some time for the DNS changes to propagate, this normally take no longer than 5 minutes but can take up to 48 hours.

• Use the Verify button on the Domain verification page to check if the record has been applied successfully. If DDoSX^® finds the correct TXT record, your domain will be verified. Be sure to leave this record applied to your DNS as DDoSX^® may periodically check that you still have control over domain.

CLI

ans ddosx domain verification dns verify mydomain.example

Verify via File Upload

• Select the File Upload verification method

• Press the Download File button to download the verification file to your local machine

• Using FTP or a web GUI for example, upload the downloaded verification file to the root of your website. This is commonly inside a www or public_html folder.

• Once uploaded, the file should be accessible by navigating to your domain followed by the name of the file. For example https://non-safedns-domain.co.uk/e9e0a272db6b707e81a88ac4baed776367d15dbd.txt

• Once the file has been uploaded and working, press the Verify button on the domain verification page. If DDoSX^® finds the correct verification file, your domain will be verified. Be sure to leave this file on your server as DDoSX^® may periodically check that you still have control over domain.

CLI

ans ddosx domain verification fileupload verify mydomain.example

3) Configure Domain¶

Once a new domain has been added to DDoSX^®, you will automatically be taken to the configuration page for that domain.

Setting up Records

Alternatively, navigate to the main DDoSX^® page on via the navigation bar on the left, click on the domain you want to configure, and then and click Configure tab.

First, use the Add Record button to configure your root and subdomains’ origin IP address. This will be the IP address that the request is forwarded to after being routed through DDoSX^®. This is usually your web server or load balancer’s external IP address.

You can add multiple subdomains at once via the Add Record button. Once you’re happy with your configure, press the Confirm button

The origin IP address of any of your subdomains (Including your root domain) can be changed by editing the IP in the text box shown under Origin IP for the specific record.

CLI

ans ddosx domain record create mydomain.example --name "mydomain.example" --content "1.2.3.4" --type "A"

Adding SSL Certificates

Before pressing the Apply Changes button, we can add any required SSL certificates to our domains.

To add an SSL certificate, click the SSL Tab. Any existing SSL certificates or SSL certificates purchased through UKFast for this domain should show up here.

If the required SSL certificate for the domain does not show up in here, we can add it by pressing the Add SSL button.

Enter your SSL’s Private Key, Certificate, any CA/Chain certificates (Optional) and a name for this SSL. Press the Create an SSL button to add your SSL to DDoSX^®.

CLI

ans ddosx ssl create --friendly-name "something to identify the ssl" --key-file "/path/to/priv.key" --certificate-file "/path/to/cert.pem" --ca-bundle-file "/path/to/ca.pem"

At this point, you should be able to go back into the DNS Records tab and select the SSL you want to apply via the SSL dropdown for each record. Only SSLs that are valid for the configured subdomain will show in the dropdown. For example, an SSL for only www.ukfast.co.uk and ukfast.co.uk will not show in the dropdown for portal.ans.co.uk. Wildcard SSL certificates should show for all applicable subdomains.

Finally, click Apply Changes and your domain will now be set up on the UKFast DDoSX^® network, and configured appropriately. (You should allow up to 10 minutes for the changes to be fully applied)

CLI

ans ddosx ssl list #Use this to retrieve the ID of the SSL (all the b's below)
ans ddosx domain record list mydomain.example #Use this to retrieve the ID of the record (all the a's below)
ans ddosx domain record update mydomain.example aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa --ssl-id "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbbb"
ans ddosx deploy mydomain.example

4) Configure Additional Features¶

You now have the option to configure and additional DDoSX^® features such as CDN and WAF before testing and putting your domain live.

The configuration of CDN and WAF can be quite complex, so each has its own documentation.

CDN Documentation

WAF Documentation

Alternatively, you can skip the configuration of additional features for now and re-visit it after DDoSX^® has been verified as working and put live. To do this, continue to step 5.

5) Test domain and put live¶

Test Domain

Once you’ve connected your domain to the DDoSX^® network and configured your DNS records, you may wish to test that your website or application will work correctly before changing your live DNS. This can be done by modifying your local hosts file to look for the DDoSX^® “DNS CNAME Record” address for your domain, which can found at the top of the DNS Records page in DDoSX^® for each domain.

Locate the hosts file on your computer. On Windows, you’ll find it in C:\Windows\System32\drivers\etc.

Open the hosts file using Notepad or another plain text editor (you may need administrator rights to make changes), and insert a line for each domain you wish to test, that includes the domain and the IP that your provided CNAME record resolves to. You can find this by going to mxtoolbox or kloth.net and entering your CNAME record and using the IP address from the A record below for example:

185.181.196.15 mydomain.co.uk
185.181.196.15 www.mydomain.co.uk
185.181.196.15 blog.mydomain.co.uk

On Linux and macOS you can open and edit the hosts file in a terminal window using a command such as

sudo nano /private/etc/hosts

This article contains more detailed instructions on modifying the hosts file on macOS, Linux, and different versions of Windows.

Once you’ve added all the domains you need to test to your hosts file, save the changes. Then open a web browser and try browsing to your domain. Your local hosts file will route the request directly to the DDoSX^® CNAME address so you’ll be able to see exactly how your site will perform when you change your DNS records.

Put domain Live

If you’re happy with how your site performs, you can make the required DNS changes with your current DNS provider to point traffic to DDoSX^®.

The process to change DNS record varies between providers, so we do recommended following your DNS providers documentation should you need assistance creating ALIAS, ANAME or CNAME records.

To create these records, you will need to log into to your current DNS provider and delete and existing A, AAAA, ALIAS ANAME or CNAME records for the domain or sub domain you want to route through DDoSX^®. Feel free to take a backup of your DNS configuration if your provider supports it. A screenshot may also be useful.

Next, if you’re setting up your root domain, create either an ALIAS or ANAME record and set the hostname to your root domain. This is commonly done by setting the hostname to an @ symbol or a blank value. Then set the value/target of this record to your unique DDoSX^® DNS CNAME Record value. For example:

If you’re setting up a non-root domain like portal.example.com that is not used in MX records etc, you can instead create a simple CNAME record, following the same process as above, but setting the record type to CNAME. An ALIAS or ANAME would also work too. For example:

Once your DNS changes have been applied and DNS propagation has concluded, your domain will be fully set up with DDoSX^® protection.

Further Configuration¶

You may wish to add further configuration on your origin server to work more closely with DDoSX^®. Some common configurations are documented below.

185.156.64.0/24
23.170.128.0/24
192.166.44.0/24
78.24.88.0/24
195.69.102.0/24
185.181.196.0/22

iptables --append INPUT --protocol tcp --src 185.156.64.0/24 --dport 80 --jump ACCEPT
iptables --append INPUT --protocol tcp --src 23.170.128.0/24 --dport 80 --jump ACCEPT
iptables --append INPUT --protocol tcp --src 192.166.44.0/24 --dport 80 --jump ACCEPT
iptables --append INPUT --protocol tcp --src 78.24.88.0/24 --dport 80 --jump ACCEPT
iptables --append INPUT --protocol tcp --src 195.69.102.0/24 --dport 80 --jump ACCEPT
iptables --append INPUT --protocol tcp --src 185.181.196.0/22 --dport 80 --jump ACCEPT
iptables --append INPUT --protocol tcp --src 185.156.64.0/24 --dport 443 --jump ACCEPT
iptables --append INPUT --protocol tcp --src 23.170.128.0/24 --dport 443 --jump ACCEPT
iptables --append INPUT --protocol tcp --src 192.166.44.0/24 --dport 443 --jump ACCEPT
iptables --append INPUT --protocol tcp --src 78.24.88.0/24 --dport 443 --jump ACCEPT
iptables --append INPUT --protocol tcp --src 195.69.102.0/24 --dport 443 --jump ACCEPT
iptables --append INPUT --protocol tcp --src 185.181.196.0/22 --dport 443 --jump ACCEPT
iptables --append INPUT --protocol tcp --dport 80 --jump DROP
iptables --append INPUT --protocol tcp --dport 443 --jump DROP

set_real_ip_from 185.156.64.0/24;
set_real_ip_from 23.170.128.0/24;
set_real_ip_from 192.166.44.0/24;
set_real_ip_from 78.24.88.0/24;
set_real_ip_from 195.69.102.0/24;
set_real_ip_from 2a02:21a8:1::/48;
set_real_ip_from 2a02:21a8:2::/48;
set_real_ip_from 2a02:21a8::/48;
set_real_ip_from 2a09:ba00:4::/48;
set_real_ip_from 2a09:b600:5::/48;
set_real_ip_from 2a09:b200:6::/48;
real_ip_header X-Forwarded-For;
real_ip_recursive on;

<IfModule remoteip_module>
    RemoteIPHeader X-Forwarded-For
    RemoteIPTrustedProxy 185.156.64.0/24
    RemoteIPTrustedProxy 23.170.128.0/24
    RemoteIPTrustedProxy 192.166.44.0/24
    RemoteIPTrustedProxy 78.24.88.0/24
    RemoteIPTrustedProxy 195.69.102.0/24
    RemoteIPTrustedProxy 2a02:21a8:1::/48
    RemoteIPTrustedProxy 2a02:21a8:2::/48
    RemoteIPTrustedProxy 2a02:21a8::/48
    RemoteIPTrustedProxy 2a09:ba00:4::/48
    RemoteIPTrustedProxy 2a09:b600:5::/48
   RemoteIPTrustedProxy 2a09:b200:6::/48
</IfModule>
LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" ddosx

# You may already have a line like the following in your VirtualHost declaration,
# if so, change the last part (likely the word `combined`) to `ddosx` to use the
# above log format.
CustomLog /var/log/httpd/acmecorp.com/access.log ddosx

defaults
    #option forwardfor except 192.168.1.10
...

backend webservers
    mode http
    http-request set-header X-Forwarded-For %[req.hdr(DDOSX-Connecting-IP)]
    server web1 ...