Step-by-step: How we configured geo-blocking alongside Prolexic's mitigations.

Hey everyone! We've been running Akamai Prolexic for DDoS protection on our main API endpoints for about six months now. It's been solid for layer 3/4 floods, but we noticed a persistent pattern of application-layer attacks that seemed to originate from a few specific geographic regions we don't even serve.

We decided to implement a geo-blocking layer *ahead* of Prolexic to cut down on this noise, and it worked like a charm. Here's the step-by-step workflow we used, focusing on integration points.

First, we use AWS, so we set up a CloudFront distribution in front of our origin. Prolexic is already proxying our traffic, so our DNS points to them. The key was using CloudFront's geographic restriction feature (geoblocking) based on the `CloudFront-Viewer-Country` header that Prolexic passes through.

Here's the core Lambda@Edge function we wrote (in Python) to handle a more dynamic allowlist/blocklist. We attached it to the CloudFront *viewer request* trigger.

```python
import json

# Simple list - we manage this via a config file in S3 for easier updates
ALLOWED_COUNTRIES = ['US', 'CA', 'GB', 'DE', 'FR', 'NL']

def lambda_handler(event, context):
request = event['Records'][0]['cf']['request']
headers = request['headers']

# Country code header passed by Prolexic/CloudFront
country_header = headers.get('cloudfront-viewer-country')
if country_header:
country_code = country_header[0]['value']

if country_code not in ALLOWED_COUNTRIES:
return {
'status': '403',
'statusDescription': 'Forbidden',
'headers': {
'content-type': [{'key': 'Content-Type', 'value': 'application/json'}]
},
'body': json.dumps({'error': 'Access restricted in your region'})
}

# Allow request to proceed to Prolexic & origin
return request
```

Important integration points we learned:
* **Order of operations:** CloudFront (with geo-block) → Prolexic scrubbing center → Our origin. This means Prolexic still sees all traffic, but we drop unwanted requests before they even hit their network, reducing load and cost.
* **Header reliance:** You *must* confirm Prolexic is configured to pass the `CloudFront-Viewer-Country` header (or similar) to your origin. A quick support ticket did the trick for us.
* **Dynamic lists:** For rapidly changing threat intel, consider fetching the country list from a secure endpoint instead of hardcoding.

The result? A **70% drop** in suspicious POST requests hitting our Prolexic reports, which made the attack patterns we *do* need to analyze much clearer. It's a great example of using a simple, configurable control to complement Prolexic's heavy-duty mitigations.

Has anyone else tried a similar layered approach? I'm curious about other edge functions or WAF rules you've paired with Prolexic.

-- Weave