Skip to main content

Restrict Origin Access to CDNs Only

By default, an origin server is reachable by anyone who knows its address. This lets users bypass the CDN (and its caching, WAF, and security features) and hit your origin directly.

To prevent this, configure an access control list (ACL) on your origin's firewall, load balancer, or security group that allows traffic only from the IP ranges (CIDRs) of the CDNs you use, and blocks everything else.

How it works​

IO River routes traffic across multiple CDN providers. Each provider fetches content from your origin using its own set of IP addresses. To lock down your origin, add the CIDRs of every CDN you have enabled in your service to your origin's allow list.

warning

If you use more than one CDN, you must allow the CIDRs of all of them. Missing a CDN will cause requests routed through it to fail with errors such as 502/504, and may break failover between CDNs.

CDN IP ranges​

Amazon CloudFront​

CloudFront publishes its IP ranges in JSON format:

https://d7uri8nf7uskq.cloudfront.net/tools/list-cloudfront-ips

The file contains two lists, and you should allow both:

  • CLOUDFRONT_GLOBAL_IP_LIST
  • CLOUDFRONT_REGIONAL_EDGE_IP_LIST

Fastly​

Fastly publishes its IP ranges in JSON format:

https://api.fastly.com/public-ip-list

The response contains IPv4 ranges under addresses and IPv6 ranges under ipv6_addresses.

Akamai​

Akamai uses a dedicated set of origin-facing IP ranges, called Origin IP ACL. The current IPv4 and IPv6 CIDRs, as well as downloadable lists, are available here:

https://techdocs.akamai.com/origin-ip-acl/docs/update-your-origin-server

Akamai: configure the Origin ACL behavior first

For Akamai, you MUST configure the Origin ACL behavior in your Akamai property before you apply the IP restriction on your origin. Otherwise, Akamai will not connect to your origin from the Origin IP ACL ranges, and your origin will block its requests.

Cloudflare​

Cloudflare publishes its IP ranges here:

https://www.cloudflare.com/ips/

The page links to plain-text lists of IPv4 ranges (ips-v4) and IPv6 ranges (ips-v6), with one CIDR per line. The same data is also available in JSON format from the Cloudflare API.

Setting up the restriction​

  1. Identify which CDN providers are enabled in your IO River service.
  2. For each CDN, collect its current IP ranges from the links above (IPv4 and IPv6, if your origin is reachable over IPv6).
  3. Add all the CIDRs to the allow list of your origin's firewall, security group, load balancer, or web server configuration.
  4. For Akamai, verify that the Origin ACL behavior is configured and active before applying the restriction.
  5. Deny all other inbound traffic to the origin on the HTTP/HTTPS ports.
  6. Verify that the service works through every CDN, and that direct requests to the origin from other IPs are rejected.

Keep the ACLs up to date​

important

The IP ranges published by the CDNs can change over time. You must update your origin ACLs whenever a CDN adds or removes a range. An outdated ACL can cause legitimate CDN requests to be blocked and result in downtime.

We recommend that you:

  • Automate the process. Periodically fetch the published lists and update your firewall or security group rules, for example with a scheduled job or your infrastructure-as-code pipeline.
  • Add new ranges before removing old ones, so that you don't drop traffic during a transition.
  • Review the ACLs again after enabling an additional CDN in your service.

Example: fetching the ranges​

# CloudFront (global + regional edge)
curl -s https://d7uri8nf7uskq.cloudfront.net/tools/list-cloudfront-ips \
  | jq -r '.CLOUDFRONT_GLOBAL_IP_LIST[], .CLOUDFRONT_REGIONAL_EDGE_IP_LIST[]'

# Fastly (IPv4 + IPv6)
curl -s https://api.fastly.com/public-ip-list \
  | jq -r '.addresses[], .ipv6_addresses[]'

# Cloudflare (IPv4 + IPv6)
curl -s https://www.cloudflare.com/ips-v4
curl -s https://www.cloudflare.com/ips-v6

For Akamai, download the lists linked from the Origin IP ACL page.