Dynamic CDN nodes authentication by IP address¶

Overview¶

The most of basic CDN node settings affecting signaling connections require WCS restart to apply. For more convenience, since build 5.3.482 cdn_allowed_ips parameter may be applied without WCS restart. This allows to connect a new nodes to the CDN with IP restriction smoothly, the entry point and other CDN nodes should not be restarted in this case amymore.

Connecting a new node to the CDN with IP restrictions¶

Use /rest-api/v3/settings REST API to change allowed IP addresses list defined in cdn_allowed_ips parameter:

\1. Get a current allowed IP addresses list

POST /rest-api/v3/settings/find_by_name HTTP/1.1
Host: localhost:8081
Content-Type: application/json

{
    "query": "cdn_allowed_ips"
}

For example, response will look like:

[
    {
        "name": "cdn_allowed_ips",
        "currentValue": "172.19.0.0/24,192.168.1.39,192.168.100.64",
        "dynamic": true
        ...
    }
]

\2. Perhaps the WCS instance with IP address 192.168.100.65 should be connected to the CDN. Add it to the allowed addresses list

POST /rest-api/v3/settings/update HTTP/1.1
Host: localhost:8081
Content-Type: application/json

{
    "name": "cdn_allowed_ips",
    "value": "172.19.0.0/24,192.168.1.39,192.168.100.64,192.168.100.65",
    "persist": true
}

That's all. The new restrictions will be applied to all the new CDN connection to the node where the allowed addresses list was changed.

Attention

\1. The new restrictions must be set on all the CDN nodes, so the steps above should be scripted and repeated for all working nodes.

\2. The new restrictions does not affect a current CDN nodes connections. If a node address was removed from allowed list, it will stay connected until disconnection by WCS restart on network limits etc.

How to reset IP restrictions on the CDN node¶

Allowed IP addresses list may be cleared on the CDN node if needed. Set the cdn_allowed_ips parameter to "allowed all" mask

POST /rest-api/v3/settings/update HTTP/1.1
Host: localhost:8081
Content-Type: application/json

{
    "name": "cdn_allowed_ips",
    "value": "0.0.0.0/0",
    "persist": true
}