How do I exempt specific IPs, networks or countries from L4 DDoS protection (Whitelist & Known Peers)?

Short answer

In L4 DDoS Protection, the exemption is defined per route table: the DDoS Whitelist window is opened with the pencil icon of the Whitelist & Known Peers box in the L4 DDoS Management tab, an entry is added of the IP, Network or Country type and saved with OK. Sources derived from the configuration, such as the Backend Service servers and the device's own addresses, are exempted with the Trust Known Peers switch without being written one by one. A source that has been quarantined is both added to the exemption and taken out of quarantine with a single click on the shield icon in L4 DDoS Live View. An exempt source is not caught by any L4 DDoS threshold, signature check or quarantine; the exemption means turning off the protection for that source.

Problem: My Own Infrastructure Gets Caught by the L4 DDoS Rules

L4 DDoS Protection measures the traffic entering the route table per source: how many packets per second a source sends, how many connections it holds at the same time and the format of its packets are checked by rules. Monitoring systems, backup servers, a NAT exit that gathers many users behind a single address, or a business partner that opens many connections can reach these thresholds with legitimate traffic. If the rule is in the Block or Quarantine mode, the packets of this source are dropped or the source is quarantined.

The exemption list is also an input of AI Learning: while the list is not filled in (only with the system default Local networks (XX) entry), a recommendation that moves a rule from monitoring to enforcement carries a warning; for the rules that protect the device's own management ports, the recommendation cannot be applied (Local network default).

Solution: Three Methods

The three methods use the same exemption list and can be applied together.

Your situation	Suitable method
I want to exempt a specific address, network block or country	Method 1: Adding an entry in the DDoS Whitelist window
I want to exempt my Backend Service servers and the device's own addresses without writing them one by one	Method 2: Trust Known Peers
A legitimate source has been quarantined; I want to release it immediately and keep it from being caught again	Method 3: Adding to the exemption from L4 DDoS Live View

Method 1: Adding an Entry in the DDoS Whitelist Window Recommended

• How it works Traffic coming from the address, network block or country written in the list stays outside all the L4 DDoS measurements in the route table (the effect area of the exemption).
• Where it is opened Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management → Whitelist & Known Peers box → pencil icon
• RequirementL4 DDoS Protection (add-on); the permission to make changes in the Network area
• Scope All the traffic in the selected route table; independent of the vService type
• Limits At most 5 country entries; there is no limit on the number of address and network entries. The note field is cut to 200 characters.

Step-by-Step Configuration

1

Adım 1 Open the L4 DDoS Management tab

In the Left Monitor Panel, Route Tables & L4 DDoS is selected from the category tabs at the top left, the route table for which the exemption will be defined is clicked, and on the screen that opens, the L4 DDoS Management tab is opened (accessing the screen).

2

Adım 2 Open the DDoS Whitelist window

The pencil icon at the top right of the Whitelist & Known Peers box is clicked; the DDoS Whitelist window opens. The pencil icon is visible only to a user who has the permission to make changes in the Network area.

3

Adım 3 Enter the entry type and value

In the add row below the list, IP, Network or Country is selected from the type selector. For the IP and Network types, the value is written in the text box (e.g. 198.51.100.25 or 198.51.100.0/24); for the Country type, the country is selected from the country selector. Optionally, a description is written in the note (optional) field.

4

Adım 4 Add the entry to the list

The + Add button is clicked (Enter in the value or note field does the same). An invalid value is rejected with the Invalid value: <value> message, a value already in the list with Already listed: <value>, and a country beyond the fifth with At most 5 countries can be whitelisted. A network block is stored reduced to its own network address (198.51.100.77/24 → 198.51.100.0/24).

5

Adım 5 Save

The OK button is clicked. Additions and deletions inside the window stay local until this button; with OK, they are written to the L4 DDoS record of the route table and take effect. In a cluster, the record is also carried to the peer device.

Verification

1Whitelist & Known Peers boxTR7 side

In the L4 DDoS Management tab, the first row of the box and the entry list below it are read.

Expected<number> exempt entries (<distribution>) — these sources are exempt from every DDoS measure in this route table

The first eight entries are visible in the box; the rest are collapsed and opened by clicking.

2L4 DDoS Live ViewTR7 side

If the exempted source is in quarantine at that moment, the quarantine table is checked.

ExpectedThe traffic of the source is released without waiting for the quarantine duration

Method 2: Trust Known Peers

• How it works Own sources derived from the configuration (the device's own addresses and the defined Backend Service servers) are exempted collectively without being written in the list. Of the Backend Service servers, only the ones in private address ranges or in the route table's own subnets are covered; the device's own addresses are covered in every case (Trust Known Peers).
• Where it is openedDDoS Whitelist window → Trust Known Peers switch
• Requirement Same as Method 1
• Scope The selected route table; it is off by default
• Servers with public addresses The switch does not cover them; they are shown in a separate list in the window, and when clicked, they are written to the add row as an IP entry

Step-by-Step Configuration

1

Adım 1 Open the DDoS Whitelist window

Steps 1 and 2 of Method 1 are applied.

2

Adım 2 Turn on the switch

The Trust Known Peers switch is turned on. The Known peers (N) — derived from the configuration list below the switch shows the sources that will be exempt when the switch is turned on; while the switch is off, the list is displayed dimmed.

3

Adım 3 Evaluate the servers with public addresses (if needed)

When a row in the Public addresses in the configuration — not trusted automatically list is clicked, the address is written to the add row with the IP type; if it is to be exempted, the + Add button is clicked. The networks in the Your defined networks — click to add as a whitelist entry list are also added as a Network entry in the same way; these networks are never trusted automatically.

4

Adım 4 Save

The OK button is clicked.

If there are derived servers that are not yet exempt, the same switch is also turned on, after confirmation, with the Trust Known Peers (N) operation shown in the What It Can Do for You card of the Learning strip (trust in its own servers).

Verification

1Second row of the boxTR7 side

The second row of the Whitelist & Known Peers box is read; the eye icon in the row opens the list of the derived sources.

ExpectedThe <N> config-derived own IPs / backend servers are exempt too

While the switch is off, the row says "Trust for config-derived known peers is off". The eye icon is visible while the switch is off as well; it does not show that the exemption is on.

Method 3: Adding to the Exemption from L4 DDoS Live View

• How it works The shield icon in the address cell of the quarantine table adds the source to the exemption list as an IP entry and takes it out of quarantine; the other L4 DDoS settings of the route table do not change (row operations).
• Where it is opened Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Live View → Quarantine table
• Requirement The source must be in quarantine at that moment
• Scope The selected route table

Step-by-Step Configuration

1

Adım 1 Open the L4 DDoS Live View tab

Left Monitor Panel → Route Tables & L4 DDoS → route table → the L4 DDoS Live View tab is opened.

2

Adım 2 Add the source to the exemption

The row of the source is found in the quarantine table, and the shield icon in the address cell is clicked. The operation is applied without asking for confirmation.

Verification

1Exemption listTR7 side

The entry list of the Whitelist & Known Peers box in the L4 DDoS Management tab is checked.

ExpectedThe source is in the list with the IP label; it has no row in Live View

The exemption entry is also carried to the peer device with the cluster synchronization; taking out of quarantine, however, works only on the device that reports the row. If the source is in quarantine on both devices, the row of the other device can remain until its duration expires, but the exemption releases the traffic of that source on both devices.

Common Mistakes

The exemption is not a priority but turning off the protection

An exempt source is not stopped even if it produces a flood or sends packets that carry an attack signature. Only trusted sources are added to the list; wide network blocks and country entries are used with a deliberate decision.

• Leaving the Local networks (XX) entry while there are clients behind NAT. When the list is first created, it contains the Local networks (XX) entry that represents the private and local address ranges. If the real clients reach the system from private addresses (from behind NAT), this entry leaves all the client traffic unprotected; the warning band at the top of the window also says this. The entry can be deleted and does not come back on its own (local network default).
• Thinking a country exemption also bypasses the IP Reputation blacklist. The Blacklist rule recognizes only the address and network entries and the own servers derived while the trust is on; a blacklisted address in an exempt country is still blocked.
• Closing the window without pressing OK. Additions and deletions inside the window are not saved unless OK is used.
• Thinking the exemption is applied to all route tables. The list is per route table; for traffic in another route table, the source is added separately to the list of that table.
• Thinking Trust Known Peers also covers servers with public addresses. The switch covers only the Backend Service servers with private addresses or in the subnets of the route table; servers with public addresses are added manually as an IP entry.
• Thinking the reset to default operation preserves the list. The reset to default operation in the What It Can Do for You card also resets the exemption list: only the Local networks (XX) entry remains and Trust Known Peers is turned off.

How it is done in the documentation

• Whitelist & Known Peers · The DDoS Whitelist Screen
• Whitelist & Known Peers · The Effect Area of the Exemption
• Whitelist & Known Peers · The Local Network Default
• L4 DDoS Live View · The Row Operations

Related questions

• Can I block specific IPs/CIDRs or allow only them?
• How do I see the clients in quarantine?
• I am blocking legitimate users by mistake; how do I find out?
• What is the difference between L4 DDoS Protection and L7 DDoS Protection?