Outbound and inbound traffic control on the Internet firewall

Outbound traffic control

1. Log on to the Cloud Firewall console.
2. In the left-side navigation pane, choose Security Policies > Access Control.
3. Navigate to Internet Firewall > Outbound Policies, click Create Policy.
   
4. In the Create Outbound Policy dialog box, configure the policy parameters.
   

   1. In the first outbound policy, allow traffic from trusted IP addresses.
      1. Configure the following parameters.

         Parameter	Description
         Source Type	Select IP or Address Book. IP: Specify only one CIDR block. Address Book: Select a pre-configured address book. The address book contains multiple CIDR blocks, which simplifies the configuration of access control policies.
         Source	Specify the source addresses that are allowed to access the Internet. If Source Type is set to IP, enter a CIDR block, for example, 1.1.1.1/32. If Source Type is set to Address Book, find the target address book and click Select in the Actions column to configure IP addresses in the address book as the source.
         Destination Type	Select IP, Address Book, Domain Name, or Region. Note If you select Region, you can select a destination from all seven continents in the world and regions in China. The regions in China include 23 provinces, 4 municipalities, 5 autonomous regions, and 2 special administrative regions.
         Destination	Specify the destination address that can be accessed.
         Protocol	Specify the protocol used in outbound traffic, which can be TCP, UDP, or ICMP. If you are not sure about the protocol, select ANY, which means that all protocols are matched.
         Port Type	Select Port or Address Book. Port: Enter only one port range. Address Book: Select a pre-configured port address book, which contains multiple ports.
         Ports	Specify the ports whose traffic is to be allowed or denied. Enter a port number range or select a port address book, depending on whether you select Ports or Address Book in the Port Type field.
         Application	Select the application to which the policy applies. Note If Destination Type is set to Domain Name, you can set this parameter to HTTP, HTTPS, SMTP, or SMTPS.
         Policy Action	Specify whether the policy allows or denies traffic on the Internet firewall. Select Allow for this policy.
         Description	Enter a description to identify the policy.
         Priority	Configure the priority of the policy, which defaults to Lowest.

      2. Click Submit.
         Note The created policy is displayed in the last row on the last page of the policy list.
   2. In the second outbound policy, deny traffic from all other IP addresses.

      Set Source to 0.0.0.0/0 and Policy Action to Deny to prevent all unauthorized access activities. Configure the other parameters according to the descriptions in the preceding table.

   3. Check that the priority of the allow policy on the trusted IP addresses is higher than that of the deny policy.

   Note By default, Cloud Firewall assigns priorities to access control policies based on the order in which they are created. A new policy has a lower priority than all existing policies. For more information about the policy priorities, see Change the priority of an access control policy.

   For more information about policy parameters, see Parameters in an access control policy.

Inbound traffic control

1. Log on to the Cloud Firewall console.
2. In the left-side navigation pane, choose Security Policies > Access Control.
3. Navigate to Internet Firewall > Inbound Policies, click Create Policy.
   
4. In the Create Inbound Policy dialog box, create a policy to allow traffic from trusted external IP addresses.

   Set Source to a trusted CIDR block or an IP address book. Set Policy Action to Allow. For information about other parameters, see the parameter descriptions in Outbound traffic control.

   Note If you set Source Type to Address Book for an inbound policy, you can set Source to an IP address book or cloud address book. If you set Destination Type to Address Book, you can only set Destination to an IP address book.
5. In the second inbound policy, deny the traffic from all other external IP addresses.

   Set Source to 0.0.0.0/0 and Policy Action to Deny to prevent all unauthorized access activities.

6. Check that the priority of the allow policy on the trusted IP addresses is higher than that of the deny policy.

Check whether the policies have taken effect

A created policy takes effect immediately. However, if the policy parameters are invalid or the Internet firewall is disabled, the policy does not take effect.

In the policy list, find the target policy and click the number in the Hits column. The Traffic Logs page appears. If the name of the policy is displayed in the Policy Name column, this policy has taken effect.

Note If you delete a policy, the allow or deny action configured in this policy becomes invalid. Exercise caution when you perform this operation.

Parameters in an access control policy