This solution helps you trace the source of network attacks by integrating Cloud Firewall's Intrusion Prevention (IPS) detection with the NAT session log. This allows you to quickly pinpoint the private IP address of a compromised asset, enabling rapid attack source analysis.
Business risk
In a VPC environment, enterprises often use a NAT Gateway to create a secure, isolated internet gateway. By translating and hiding the private IP addresses of cloud services, the NAT Gateway prevents them from being directly exposed. Security devices such as firewalls are also deployed at this gateway to filter traffic. However, when a public network attack or an unauthorized outbound connection occurs, security alerts typically identify only the NAT Gateway's elastic IP address (EIP). As a result, pinpointing the specific ECS instance or other asset with the at-risk private IP address is difficult, which delays attack tracing and incident response.
Solution
To address this challenge, Cloud Firewall has introduced the IPS private IP tracing feature. This feature automatically correlates events from the NAT Gateway's session log with Cloud Firewall IPS alerts, directly revealing the private IP address of the compromised instance. This allows your team to quickly locate affected assets and take effective countermeasures.
Cloud Firewall IPS capabilities: The Cloud Firewall IPS engine detects and protects against inbound and outbound attacks from the internet. All network traffic that passes through Cloud Firewall is filtered by the IPS engine before being forwarded. Cloud Firewall uses a Deep Packet Inspection (DPI) engine to identify traffic protocols and parse packets. It then filters traffic flows and packets using the IPS engine and threat intelligence. If a packet matches a threat engine pattern and an IPS rule, the IPS engine drops or allows the packet based on the rule's action, enabling real-time alerting and interception. Cloud Firewall also records detailed IPS attack logs.
NAT session log: NAT Gateway provides a session logging feature. When you create an SNAT entry for a NAT Gateway, the gateway records traffic that passes through it as SNAT sessions in a log for tracing and monitoring. The gateway writes these session logs to Simple Log Service (SLS). Each log entry captures a specific five-tuple network flow within a specific capture window. For inbound traffic using DNAT, you can locate the specific private IP address through port mapping.
Outbound attack tracing
Inbound attack tracing
Use case
Consider a medium-sized new retail enterprise with an e-commerce business on the cloud. To ensure service stability and security, the enterprise deploys a NAT Gateway in a DMZ VPC to handle all inbound and outbound internet traffic, reducing exposure risk. They also use Cloud Firewall with the internet firewall enabled to filter and protect traffic to the NAT Gateway's elastic IP address. One night, the security operations team receives an alert about abnormal traffic. They suspect an attacker exploited a server vulnerability to plant a trojan. This trojan initiated malicious outbound connections to an overseas IP address, downloaded a bash script, and installed a CoinMiner family trojan. The security team needs to quickly identify the compromised back-end server.
This is where the Cloud Firewall IPS private IP tracing feature becomes crucial. Once enabled, the system matches the specific five-tuple network flow captured in each NAT session log to the corresponding IPS event, pinpointing the at-risk private IP address within minutes. This enables security personnel to quickly identify the compromised server, apply an ACL policy to block its outbound access, and remove the trojan to minimize loss and prevent the risk from spreading.
Usage notes
This feature is supported by both pay-as-you-go and subscription Cloud Firewall instances. It is also supported by public NAT Gateway instances that are billed by CU. NAT Gateway instances that are billed by specification do not support the session log feature.
Enabling IPS private IP tracing does not incur additional charges from Cloud Firewall. However, the system creates an index on your NAT Gateway session logs and queries them, which incurs fees from SLS. For information about SLS pricing, see SLS pricing.
After you enable IPS private IP tracing, the system checks the NAT session log index. If the index is disabled or missing required fields for tracing, it automatically creates or updates the index with the necessary fields.
Configuration
Log on to the Cloud Firewall console. In the left-side navigation pane, choose .
On the tab, view the list of public assets that support tracing. For the corresponding NAT Gateway, the internet firewall and NAT session log must be enabled to use IPS private IP tracing. When you click the switch in the Actions column, you will be prompted to enable these features if they are disabled. Click the links in the prompts and follow the instructions to complete the setup. You can also refer to the following documents for detailed configuration instructions:
Enable the internet firewall: Enable protection for assets
Enable the NAT session log: Configure the session log feature
For detailed instructions, see Traffic tracing.
View tracing results
Due to log collection and delivery delays, tracing results are typically available about 20 minutes after an event occurs.
After Private IP Traceback is enabled, you can view the tracing data in the following scenarios.
The intrusion prevention event list contains the following columns: Time, Source IP, Destination IP, Event Name (including attack type, direction, and detection source), Event Count/Risk Level, Defense Status, and Operation. For example, a record might show an inbound web attack from a public IP address, such as a MeterSphere plugin remote code execution event, detected by virtual patching, targeting a private IP address. The risk level is High, and the defense status is Alert Only.
The intrusion prevention details page has two tabs: Basic Information and Attack Payload. The Basic Information tab displays alert details as key-value pairs, including fields such as First discovered, Last discovered, Direction (Inbound/Outbound), Source IP, Destination IP, and Private IP. The Private IP field shows the associated internal IP address.
The alert event list displays the Risk Level, Event Name, Asset Type, Instance ID/Name, Affected Asset IP/UID, Time, and Processing Status for each alert. The Affected Assets column allows you to locate the private IP address by using the private IP tracing feature. The Operation column provides options such as One-Click Defense, Ignore, and Details.
The details page has two tabs: Basic Information and Breach Payload. On the Basic Information tab, the Event Summary section shows the event name (such as Trojan backdoor communication), time, risk level (such as High), and event description. The Affected Assets section displays information such as the affected asset name, public IP, and private IP address, which helps you locate the affected asset.
On the tab:
The table displays security event records, with columns including Received Time, Type, Detection Source, Rule Name, Source IP, Destination IP, Private IP, and Private Port. The Private IP and Private Port are key fields. For example, a Nmap web scan event corresponds to a private IP address of 10.11.xxx.xxx and a private port of 8000.