Source IP Error Protection

What Is Source IP Error Protection?

Source IP Error Protection limits the number of error responses that a single source address receives in a certain time window. Since not the volume but the failure is measured, the block catches the scanning and trial-and-error behavior that works with few requests but that tries addresses which do not exist: a scanner looking for the management panel receives errors one after another even if it sends few requests per second.

The responses counted are the errors originating from the client (4xx). The errors originating from the server (5xx) are deliberately not counted: a backend failure must not be read as an attack. The measurement is not a rate but an absolute number; a percentage calculation is not made.

The block is present only on the vServices of the HTTP type.

Outcome-Based

Not the Request but the Response Is Counted

Not the volume but the failure is measured; the scanners that work with few requests are caught

4xx Only

The Responses Counted

The 5xx errors originating from the server do not enter the counter

50

Default Limit

The number of error responses that a single address can receive in a 1-minute window

Absolute Number

Not a Rate

A percentage calculation is not made; the threshold is directly the number of errors

No Hard Ceiling

A Single Tier

The decision is given with a single threshold; if necessary, Quarantine is selected directly as the action

HTTP Only

vService Type

The error counting is not made on L7 TCP vServices

The Source IP Error Protection Card on L7 DDoS Protection

The block in the body of the L7 DDoS Protection card reduces its setting to a single sentence: if traffic from any single IP exceeds <limit> errors in <window>, <action>. The limit value is written in bold, the time window faded, and the action in its own color. Since there is no hard ceiling in this block, the sentence has a single tier.

When the pencil icon at the top right of the card is clicked, the edit screen opens.

L7 DDoS Protection - The Source IP Error Protection Card

The Source IP Error Protection Edit Screen

1. The Bot/DDoS Management tab is opened.
2. The pencil icon at the top right of the Source IP Error Protection block in the body of the L7 DDoS Protection card is clicked; the edit window titled Edit - Source IP Error Protection opens.
3. The following fields are edited and confirmed with the Edit button.

The Source IP Error Protection Edit Screen

INFO

Source IP Error Protection Default: On

It determines whether the block is on or not; its default value is on and this value is written to the configuration record created when the protection is enabled. While it is on, the block makes measurements and produces events even while the protection is in the Monitor mode; for it to be off, the switch must be turned off manually.

When it is turned off, all the other fields in the form (the time window, the limit, the action and the hard ceiling if there is one) are hidden.

When it is turned off, the block card does not leave the screen: it fades and the Disabled badge appears on it, and the values written continue to be read.

INFO

Time Window Default: 1 minute

For how long the counter will be accumulated is defined. The value is entered with a number and unit pair; seconds, minutes or hours can be selected as the unit. Its default value is 1 minute; at least 1 second and at most 1 hour can be defined.

The window is repeated in the suffix on the right of the limit field as well: with a label such as / 1m the field shows to which period the limit belongs.

INFO

Error Limit Default: 50

How many error responses a single source address can produce within the window is defined; its default value is 50. Only an integer, at least 1, can be entered in the field. When the counter exceeds this value, the block is triggered.

INFO

Limit Action Default: Show Captcha

The enforcement to be applied when the limit is exceeded is selected; its default value is Show Captcha.

Option	What it does
Silent Drop	The request is left unanswered, the connection is silently dropped.
Block	It is blocked with the defined status code.
Tarpit	The request is slowed down by being kept waiting.
Redirect	It is redirected to the defined address.
Show Content	A page from the selected content profile and a status code are returned.
Show Captcha	The source is directed to the shared challenge.
Quarantine	The source is taken into the shared penalty box and meets the same enforcement on every request until its period expires.

In this block Tarpit and Quarantine can also be selected. Quarantine takes the source that produces errors onto the list not for a single request but for a period.

According to the selected action, additional fields appear in the form: Block status code (default 403) for Block, Redirect location (default /robots.txt) and Redirect code (default 302) for Redirect, and Content page and Status code (default 403) for Show Content. Show Captcha and Quarantine do not carry an additional field in this form: the appearance of the challenge and the period, the scope and the response of the quarantine are managed from the cards of the Bot/DDoS Protection Mode strip.

INFO

Edit

Changes in the form are saved by clicking the Edit button. There is no additional confirmation window or deploy step; the Load Balancer configuration is regenerated and applied automatically. The operation is written to the user log with a change summary.

The sentence below the form is live

The information box below the fields builds the sentence that will appear on the card while it is being written: as the limit, the window and the action change, the sentence is updated instantly. Before saving, how the setting will be read on the screen is seen from here.

There is no hard ceiling in this block

Unlike the other source-based blocks, there is no second tier here: the number of errors is evaluated with a single threshold. If a harder enforcement is wanted, Limit Action can be selected directly as Quarantine.

The verified bots can be exempted from this block

While the Trust Verified Bots setting of the L7 DDoS Protection card is on, the verified search engine bots are not caught by the limit of this block.

Scope and Limits

INFO

• It is present only on HTTP vServices. The error counting is not made on L7 TCP vServices.
• Only the 4xx responses are counted. The 5xx errors originating from the server do not enter the counter of this block.
• There is no hard ceiling. The block has a single tier.
• The block is on by default. When the configuration is saved, the switch is written as on; turning it off is the decision of the operator.
• The enforcement is applied only in the Active mode. While L7 DDoS Protection is in the Monitor mode, the counters work, events are produced and the card sentence is read; however no request is stopped.
• The first match wins. If a request has been decided in a block further above, this block does not produce an enforcement for that request.
• The pencil icon depends on the permission. The block card is displayed with read-only permission; the pencil icon that opens the edit window is displayed only on the users that have edit permission.