CDN Two-Layer Architecture in Practice – China CDN + Cloudflare Configuration Steps

Overview

For websites targeting both Chinese and overseas users, a single cdn is hard to satisfy both. China CDNs (Upyun/Qiniu Cloud/Alibaba Cloud) are fast in mainland China but have weak overseas nodes; Cloudflare is strong overseas but slow in China.

Two-layer architecture: Chinese users -> China CDN -> Cloudflare -> Origin; overseas users -> Cloudflare -> Origin. This article uses Upyun + Cloudflare as an example and explains step by step.

I. Architecture Principle

Chinese users access Upyun nodes, Upyun requests resources from Cloudflare, and Cloudflare then goes back to your origin. Overseas users directly access Cloudflare nodes.

The advantage is that China speed is close to China CDN level while retaining Cloudflare's security protection and overseas acceleration. The disadvantage is an added proxy layer, one extra hop, but it has little impact on Chinese users.

II. Prerequisites

• The origin domain has completed ICP filing (required by China CDN).
• The origin website is already configured (e.g., baike300.com).
• You have an Upyun (or other China CDN) account and a Cloudflare account.
• Domain DNS supports route-based resolution (e.g., Alibaba Cloud DNS, DNSPod).

III. Step 1: Configure the Origin on Cloudflare

1. Add your main domain (e.g., baike300.com) to Cloudflare and keep the cloud icon orange (proxied status).
2. Add an A record pointing to the origin IP, with the cloud icon enabled.
3. Ensure Cloudflare SSL/TLS is set to "Full" or "Full (strict)".

At this point, accessing baike300.com will go through Cloudflare.

IV. Step 2: Add an Accelerated Domain on the China CDN

Using Upyun as an example:

1. Add an accelerated domain: static.baike300.com (a subdomain is recommended).
2. Origin configuration: enter baike300.com (the domain proxied by Cloudflare).
3. Ports: 80 and 443.
4. Acceleration region: select "Mainland China".

Upyun will generate a CNAME address, such as static.baike300.com.upyun.com.

V. Step 3: Configure DNS Traffic Splitting

Add DNS records at your domain DNS provider (e.g., DNSPod):

• The main domain baike300.com uses default resolution (can point to Cloudflare IP or CNAME).
• Add a CNAME record for static.baike300.com pointing to the Upyun CNAME address, with the line selected as "Default" or "Overseas".
• Add another CNAME record, also pointing to the Upyun CNAME, with the line selected as "Domestic".
• If you need to force Chinese users to use the static domain, modify the resource URLs (images, CSS, JS) in the website code to static.baike300.com.

VI. Step 4: Configure Upyun Back-to-Origin HTTPS

Upyun goes back to baike300.com (Cloudflare), and certificate issues need to be handled.

Method A: Generate an origin certificate on Cloudflare (free), download the .pem and .key files, and upload them to Upyun's "Back-to-Origin Certificate" section.

Method B: Upyun uses HTTP for back-to-origin (not recommended unless the origin forces HTTPS).

Method A is recommended, configured as follows:

1. Cloudflare dashboard -> SSL/TLS -> Origin Server -> Create Certificate. Keep the default settings (generated by Cloudflare).
2. Copy the public and private key contents and paste them into Upyun's "Back-to-Origin Certificate" section.
3. Enable HTTPS in the Upyun domain configuration, and upload a free/paid SSL certificate for the domain (for visitor access).

VII. Step 5: Testing

1. Use a Chinese proxy or tool (such as 17ce) to access static.baike300.com and check whether it resolves to an Upyun node.
2. Use an overseas proxy to access baike300.com and check whether it goes through Cloudflare.
3. Check the HTTP response headers to confirm headers such as X-Cache or CF-Cache.

VIII. Frequently Asked Questions

Q: Will China CDN back-to-origin to Cloudflare affect overseas access?
No. Overseas users directly access Cloudflare nodes without going through the China CDN.

Q: China CDN cache hit rate is low?
It may be because back-to-origin needs to go through Cloudflare, causing latency. Increase the China CDN cache time (30 days) to reduce back-to-origin requests.

Q: Do Cloudflare firewall rules still take effect?
Yes. All traffic passing through Cloudflare (including China CDN back-to-origin) goes through firewall rules. Be careful not to mistakenly block the China CDN's back-to-origin IP; you can add Upyun's IP ranges to the whitelist.

This solution is suitable for webmasters with some technical background. If you only target Chinese users, using a China CDN alone is sufficient; if you only target overseas users, the Cloudflare free plan is enough.