# CDN and WAF with DDoS protection | Edgium > CDN and WAF on an anycast network with points in Brazil and abroad: DDoS protection, SSL certificate, root domain without CNAME, custom ports and HTTP/3. Your DNS stays where it is. Source: https://edgium.net/en/cdn Leia esta página em português: https://edgium.net/cdn --- [Edgium](https://edgium.net/en/) / CDN and WAF # CDN and WAF with DDoS protection for your site, store and API Your site answers from the network point closest to each visitor, in Brazil or abroad. Attacks stop at the edge, your origin stays hidden, and even the root domain, without the www, is protected with no CNAME and no need to move your DNS. [Set up a CDN trial](https://edgium.net/en/contact?interesse=cdn#formulario) See how traffic flows ![Lime-green cloud surrounded by orbits, illustration of the CDN](https://edgium.net/assets/img/cdn.webp) ## A whole network with the same address At Edgium, every point on the network, in Brazil and abroad, announces the same IPs over the internet (anycast, via BGP). Routing itself takes each visitor to the nearest point. That lets us manage traffic and protect everything before it reaches your server. ### Closer to your visitors Each visitor lands on the nearest point through the network path, not through DNS guesswork. Fewer hops, less time to first byte. ### DDoS attacks split and contained A distributed attack arrives spread across the points on the network, and each one filters its share. Your origin does not receive the volume. [More about DDoS protection](https://edgium.net/en/ddos-protection) ### A point goes down, traffic keeps flowing If a point goes offline, BGP sends traffic to the next one, which has the same IP. No DNS change and no waiting for TTL. ## Root domain protected, no CNAME The DNS standard does not allow a CNAME on the root domain (`yourcompany.com`, without the www). That is why many CDNs ask you to move your whole DNS to them, or only protect the www. At Edgium, the IPs are anycast and fixed. The root domain gets plain `A` and `AAAA` records pointing to the network, in the DNS you already use. For your visitors nothing changes: same address, same certificate, just faster and protected. ``` ; in the DNS you already use (example) yourcompany.com. A Edgium anycast IP yourcompany.com. AAAA Edgium anycast IPv6 www.yourcompany.com. CNAME yourcompany.com. ; email, SPF and everything else stay the same yourcompany.com. MX 10 mx.yourprovider.com. ``` ## What the CDN does for your application Separate settings for each application. You decide what goes into the cache, what gets blocked and how the edge talks to your origin. ### Custom HTTP ports Does your application run on `8080`, `8443` or another port? The CDN serves on the port you need and talks to the origin on its port. ### Your own SSL certificate, or one issued for you Use your company certificate (EV, OV or wildcard) or let Edgium issue and renew one through Let's Encrypt. TLS with HTTP/2, HTTP/3 and HSTS turned on. ### Web application firewall (WAF) Rules against SQL injection and other common web attacks, blocking by country, IP, host and user-agent, and a challenge for bots and suspicious traffic before it reaches your server. ### Static and dynamic cache Images, scripts and pages are served from the edge, compressed with Brotli or Gzip, with the cache and expiry times you choose. Content that changes on every request goes straight to the origin over the Edgium network, on a path that is already open. ### WebSocket by default Chat, live dashboards and notifications work through the CDN with no extra setup. ### Real IP and logs on your server Your application receives the visitor's real IP, port and country in headers (`X-Real-IP` and `X-Client-IP`). Access logs can go by syslog to your own server, to meet LGPD requirements. ### Hidden origin Your server's IP does not appear in DNS. The origin can accept only Edgium and close itself off from the rest of the internet. ### IPv4 and IPv6 The network announces IPv4 and IPv6 addresses. Even if your origin only has IPv4, visitors on IPv6 are served. ## Each application with its own settings, in the panel In the Edgium panel, each domain and subdomain has its own tabs: SSL certificate, security, cache, WAF, origins (upstreams) and analytics. You adjust things whenever you want, and our team follows along with you. ![Edgium panel on the CDN screen of a subdomain, with the tabs Home, SSL, Security, Cache, WAF, General, Upstreams and Analytics, and the menu with DNS, CDN, DNS Firewall and Load Balancer](https://edgium.net/assets/img/painel-cdn.jpg) Real Edgium panel screen, with fictitious data. ### Performance - HTTP/2 and HTTP/3 - IPv4 and IPv6 - Cache and expiry control - Brotli and Gzip compression - Multiple origins per application - WebSocket ### Monitoring - Real visitor IP (X-Real-IP and X-Client-IP) - Geolocation headers - Response time metrics - Log delivery by syslog and rsyslog - Analytics per application ### Security - WAF and DDoS protection - Your own SSL certificate or Let's Encrypt - Hotlink protection - Custom blocking rules - Hidden origin ## What changes for your company and your visitors ### For your company - **A smaller cloud bill:** what is served from cache does not go through your origin or through paid cloud transfer. - **A smaller server:** with the edge absorbing peaks and attacks, the origin does not need to be sized for the worst day. - **Onboarding without migration:** your DNS does not move, and going back means undoing one record. - **Support in Brazil:** our team sets it up and follows along with you, in Portuguese. ### For your visitors - **Pages that open fast,** because the response comes from the closest point, including on mobile. Speed also counts for Google. - **A site that stays up during an attack,** because bad traffic stays at the edge and good traffic keeps flowing. - **No strange address:** the same domain, the same padlock, no redirect. - **A modern connection,** with HTTP/3 and IPv6 for those who have them, and everything else keeps working. ## How your application joins the CDN ### You tell us what goes to the edge The domain, where the origin is, the port, and what can be cached. ### We set it up and test it Your application is registered on the network and tested before it receives real traffic, with your certificate or one issued for you. If you prefer, start with a test subdomain. ### You point the records In the DNS you already use, switch the `A` and `AAAA` (or the subdomain's `CNAME`) to Edgium. To go back, just undo it. ## Use cases Common situations and how Edgium handles each one. ### Online stores and e-commerce Black Friday without slow pages: edge cache, WAF against bots and DDoS protection at the peak. [See the full example](https://edgium.net/en/use-cases#loja-virtual) ### News portals, blogs and media A viral story without an outage: the cache absorbs the peak and hotlinking stops costing you bandwidth. [See the full example](https://edgium.net/en/use-cases#portal) ### Agencies and web developers Dozens of sites in a single panel, with certificates that renew themselves and a protected domain without the www. [See the full example](https://edgium.net/en/use-cases#agencias) ## Questions about the CDN ### Can I test the CDN before signing up? Yes. Talk to us: Edgium sets up a trial with a subdomain or with your application, and you measure it with your own traffic before pointing your main domain. ### Do I need to move my DNS to Edgium? No. Your DNS stays where it is. You only change the site records to point to Edgium: A and AAAA on the root domain, and A, AAAA or CNAME on subdomains. ### Can you protect the root domain, without the www? Yes. Because Edgium IPs are anycast and fixed, the root domain gets plain A and AAAA records, with no CNAME and no DNS tricks. ### My application uses a port other than 80 and 443. Does it work? Yes. The CDN accepts custom HTTP and HTTPS ports, both for incoming traffic and for the connection to your origin. ### Can I use my own certificate? Yes. You upload your company certificate, including EV or wildcard, or Edgium issues and renews one for your domain. ### What happens if a point on the network goes down? Internet routing (BGP) sends the traffic to the next point, which announces the same IP. There is no DNS change and no waiting for TTL. ### Will my application still see the visitor's IP? Yes. Edgium sends headers with the visitor's real IP, port and country, and the logs can go to your own server. ### Does the CDN protect against DDoS attacks? Yes. Because the network is anycast, a distributed attack arrives split across the points in Brazil and abroad, and each one filters its share. The WAF also blocks suspicious requests before they reach the application. ### Can I stop other sites from using my images? Yes. Hotlink protection makes the CDN refuse files requested by pages on other domains, so your bandwidth stops paying for content shown there. ## Talk to Edgium and test the CDN Tell us your domain and where your origin is. We set up a trial with a subdomain or with your application, you measure it with your traffic, and then comes the proposal. [Set up a CDN trial](https://edgium.net/en/contact?interesse=cdn#formulario) [Chat on WhatsApp](https://wa.me/5547999659121?text=Hello%21%20I%20came%20from%20the%20edgium.net%20website%20and%20I%20would%20like%20to%20talk%20about%20a%20CDN%20and%20WAF%20trial.)