dos.yaml Reference

Python 2.7/3.7 |Java 8 |PHP 5.5/7.2 |Go 1.9/1.11 |Node.js

Warning: This feature is deprecated and replaced with the App Engine firewall. App Engine firewall provides more reliable protection as well as improved features. You can manage your firewall with the GCP Console, gcloud command-line tool, and Admin API.

The dos.yaml file provides the controls to blacklist IP addresses or subnets to protect your app from Denial of Service (DOS) attacks or similar forms of abuse. For more information, see Configuring DoS protection.

By default, App Engine serves a generic error page to blacklisted addresses. You can configure your app to serve a custom response instead. For details, see the app.yaml reference on error handlers.

Example

The following is an example dos.yaml file:

blacklist:
- subnet: 192.0.2.1
  description: a single IP address
- subnet: 192.0.2.0/24
  description: an IPv4 subnet
- subnet: 2001:DB8::1
  description: an IPv6 address
- subnet: 2001:DB8::/32
  description: an IPv6 subnet

Syntax

A dos.yaml file in the root directory of your application alongside app.yaml: it configures DoS Protection Service blacklists for your application.

The syntax of dos.yaml is the YAML format. For more information about this syntax, see the YAML website.

Element	Description
description	An optional description for the blacklist entry.
subnet	Required. The subnet value is any valid IPv4 or IPv6 subnet in CIDR notation.

Deploying the DoS configuration file

To deploy the DoS configuration file, run the following command:

gcloud

gcloud app deploy dos.yaml

appcfg

If you install the original App Engine SDK, you can run:

appcfg.py update_dos [YOUR_APP_DIR]

Deleting all DoS configuration

To delete all DoS configuration:

1. Edit the contents of the dos.yaml file to:

   blacklist:
   

2. Deploy the dos.yaml file to App Engine.

Limits

You can define a maximum of 100 blacklist entries in your configuration file. Uploading a configuration file with more than 100 entries will fail.