VMRack CDN Configuration Tutorial: Hide Your Origin IP and Boost Security

Foreword

Today, I’m sharing the VMRack CDN configuration tutorial, designed to help you hide your website's real IP address and significantly enhance its security and defensive capabilities. We will walk you through key settings step-by-step, including: confirming and adjusting website configurations within the Baota Panel (Aapanel), integrating the domain with the CDN, setting up DNS resolution, and implementing strict security hardening—specifically blocking direct access via IP address and configuring an SSL certificate. We will also cover how to check the CDN node IP to ensure the protection measures have been successfully applied.

I. Baota Panel Preparation and Website Deployment Confirmation

Before starting the VMRack CDN configuration, you must complete the following critical deployment status and configuration checks to ensure a smooth process:

1. Website Deployment Status Check

Target Domain: blog.dcnod.com
Confirmation: Verify that the target website is running normally on the current server (IP address: $0.0.0.0$) and that all management tasks for this website are performed through the Baota Panel.

2. Website Configuration Verification in Baota Panel

Please log in to your Baota Panel, navigate to the "Website" menu, and perform the following checks:

Site Creation and Accessibility: Confirm that the blog.dcnod.com site has been successfully created and can be displayed correctly, either via direct IP access or a temporary domain.
Root Directory Path Verification: Check the site's Root Directory settings to ensure it accurately points to the correct path of your website program files.

II. Configuring VMRack CDN

1. Adding the Site and Configuring the Origin

Log in to the VMRack Console and click “Site Management”
Click “Add Site”
Configure Domain:
- Enter the domain: $blog.dcnod.com$.
- Select HTTPS for the Back-to-Origin Protocol
- For Origin Server Configuration , input the IP Address (0.0.0.0.) and the Port 443.
- For Back-to-Origin Host, select Custom and enter the domain: [www.dcnod.com](https://www.dcnod.com).
- The operation is very simple and fast.

2. Configuring DNS Resolution

Go to the DNS resolution console of your domain registrar, Cloudflare.

Add CNAME Record:
- Subdomain Configuration: Find the existing A record for blog.dcnod.com, change its type to CNAME, and set the Record Value to the CNAME address assigned by VMRack CDN. The Host Record should be the subdomain prefix (e.g., blog).
- Root Domain Configuration: Directly add a CNAME record, setting the Host Record to @.
- If a record conflict warning appears, delete the original record before setting the new one.
Wait for the DNS resolution to take effect (usually a few minutes to a few hours).

3. Configuration Success Confirmation

After completing the steps above, you should see the domain status displayed as "Running Normally" in the VMRack CDN Console.

III. Baota Panel Security Hardening (The Key to Hiding the IP)

1. Blocking Direct Access via IP Address

This is the core measure to prevent attackers from bypassing the CDN and accessing the origin server directly:

In the Baota Panel, open the website list and locate the default site for the corresponding IP (usually ***.***.***.***). If it doesn't exist, you can create a new site using the IP address as the domain name.
Click Settings > Configuration File , and modify the Nginx configuration to handle both HTTP and HTTPS:

Nginx

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _; # Matches all unbound domains and direct IP access
    return 444; # Closes the connection immediately without returning any information (safer than 403)
}

# If the server has HTTPS enabled (443)
server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    server_name _;

    # Configure an invalid or self-signed SSL certificate, or point to a non-existent certificate path
    # The goal is to make HTTPS access via IP fail due to a certificate error
    ssl_certificate /etc/nginx/ssl/dummy.crt; # Ensure the certificate file does not exist or is invalid
    ssl_certificate_key /etc/nginx/ssl/dummy.key;

    # Returning an error can also work, but a certificate error usually prevents connection establishment
    return 444;
}

2. Configuring the SSL Certificate

Go to the site settings for blog.dcnod.com, and select the SSL tab.
Apply for or upload a certificate (we recommend applying for a free Let's Encrypt certificate). VMRack also supports free certificate application; you can refer to the guide: How to Apply for Domain and Certificate for Beginners
Enable the Force HTTPS option.

IV. Verifying CDN Activation

Check the CDN Node IP

Use the ping command to verify that the CDN has correctly taken over the website traffic:

ping blog.dcnod.com

The returned IP address should be a VMRack CDN node IP (and not your server's real IP, ***.***.***.***).

Summary

By integrating VMRack CDN for your website or IP address, you can immediately experience a dual improvement in security and speed. By hiding the real origin IP, we can significantly enhance your website's security, while the global acceleration nodes greatly optimize the user access experience. Most importantly, VMRack CDN is currently available for completely free use, helping you achieve high-performance protection at zero cost.

Regarding choosing an overseas VPS, I recommend several established providers: VMRack, Bandwagonhost, and DMIT. I primarily recommend VMRack for its superior cost-effectiveness.

The blogger recommends cloud servers from VMRack. VMRack’s data center is located in the Equinix LA4 financial-grade data center in Los Angeles, USA. Their servers are primarily equipped with the new AMD EPYC 7K62 high-performance processors, offering up to 192 CPU cores with a stable 1:1 vCPU resource allocation for reliable performance. They utilize distributed block storage with a triple-replica mechanism, which significantly boosts disk read/write capabilities, easily meeting demands for ultra-high IOPS.

VMRack currently operates three main network routes: Three-Network Premium (CN2 GIA/9929/CMIN2), Three-Network Optimized (163/10099/CMI), and US Native (Global BGP). These three routes essentially meet the daily needs of most individuals and the operational requirements of small to medium-sized enterprises. VMRack holds a highly competitive advantage in network connectivity:

Three-Network Premium direct connection offers Chinese mainland users a low-latency, high-speed optimized network experience, making it highly suitable for daily office work, entertainment, streaming, and cross-border e-commerce.
Three-Network Optimized features very large bandwidth capacity, perfectly satisfying application scenarios requiring high-volume downloads, such as CDN content distribution and video streaming sites.
US Native focuses on ultimate cost-effectiveness and global connectivity, making it a highly valuable choice as a West Coast USA landing machine.

Telegram Group: https://t.me/vmrack_chat