All Products
Search

This Product

    Web Application Firewall:Protect a CDN-accelerated domain with WAF

    Document Center

    Web Application Firewall:Protect a CDN-accelerated domain with WAF

    Last Updated:Mar 31, 2026

    Deploy Web Application Firewall (WAF) behind Alibaba Cloud CDN to protect your web services from attacks while keeping content delivery fast. In this architecture, CDN accelerates static content at the edge, and WAF inspects and filters dynamic traffic before it reaches your origin servers.

    Network architecture

    Traffic flows through three layers:

    • CDN (ingress layer): accelerates content delivery to end users

    • WAF (intermediate layer): inspects traffic and blocks attacks

    • Origin servers: receive only clean, filtered traffic

    Origin servers can run on Elastic Compute Service (ECS) instances, Server Load Balancer (SLB) instances, in virtual private clouds (VPCs), or in on-premises data centers.

    image

    Prerequisites

    Before you begin, make sure you have:

    Choose an access mode

    WAF supports two ways to integrate with CDN. Pick the one that matches your infrastructure before starting the configuration steps.

    CNAME record modeTransparent proxy mode
    How it worksCDN sends traffic to WAF's CNAME address; WAF forwards clean traffic to your originCDN sends traffic directly to your origin IP; WAF intercepts traffic transparently via SLB or ECS
    What you configure in CDNSet the CDN origin to WAF's CNAMESet the CDN origin to your origin server's IP
    Best forMost deployments; simpler DNS-based routingEnvironments where you want WAF to operate without changing DNS origin settings

    Step 1: Add a domain name to WAF

    1. Log in to the WAF console. In the top navigation bar, select the resource group and the region where your WAF instance is deployed (Chinese Mainland or Outside Chinese Mainland).

    2. In the left-side navigation pane, choose Asset Center > Website Access.

    3. On the Domain Names tab, click Website Access.

    4. Add the domain name using your chosen access mode:

      CNAME record mode

      Note

      On the Add Domain Name page, Access Mode defaults to CNAME Record. No change is needed.

      1. In the Enter Your Website Information step, configure the following parameters and click Next.

      ParameterDescription
      Domain NameThe domain name of the website to protect
      Protection ResourceThe type of protection resource to use
      Protocol TypeThe protocol your website supports
      Origin Server AddressIP: the public IP address of the SLB or ECS instance, or your non-Alibaba Cloud origin server IP
      Destination Server PortThe port your origin server uses, based on the Protocol Type
      Load Balancing AlgorithmIf you have multiple origin server addresses, select the algorithm based on your requirements
      Whether Layer 7 Proxy, Such as Anti-DDoS Pro, Anti-DDoS Premium, or Alibaba Cloud CDN, Is Deployed in Front of WAFSet to Yes.
      Enable Traffic MarkSpecify whether to enable WAF's traffic marking feature
      Resource GroupSelect the resource group for this domain name

      1. On the Domain Names tab, find the domain you added and copy the CNAME that WAF assigned to it.

      WAF侧CNAME地址

      Transparent proxy mode

      1. On the Add Domain Name page, set Access Mode to Transparent Proxy Mode.

      2. In the Add Domain Name step, configure the following parameters and click Next.

      ParameterDescription
      Domain NameThe domain name of the website to protect
      SLB-based Domains, Layer 7 SLB-based Domains, Layer 4 SLB-based Domains, and ECS-based DomainsSelect the instance type and corresponding ports
      Whether Layer 7 Proxy, Such as Anti-DDoS Pro, Anti-DDoS Premium, or Alibaba Cloud CDN, Is Deployed in Front of WAFSet to Yes.
      Enable Traffic MarkSpecify whether to enable WAF's traffic marking feature
      Resource GroupSelect the resource group for this domain name

      1. In the Check and Confirm Added Information step, review the information and click Next.

      2. Click Completed. Return to the website list. On the Servers tab, select Resource Instance ID from the drop-down list and enter an instance ID to find the IP address and port of the instance you added.

      image.png

    Step 2: Point CDN to WAF

    1. Log in to the Alibaba Cloud CDN console.

    2. In the left-side navigation pane, click Domain Names.

    3. Find the domain name and click Manage in the Actions column.

    4. In the left-side navigation pane, click Basics. In the Origin Information section, click Add Origin Server. In the dialog box, configure the following parameters and click OK.

      ParameterDescription
      Origin InfoCNAME record mode: select Site Domain and enter the WAF CNAME from Step 1. Transparent proxy mode: select IP and enter the public IP address of your origin server from Step 1.
      PriorityA primary origin server has higher priority than a secondary one
      WeightWhen multiple origin servers share the same priority, CDN distributes requests by weight
      PortThe port on the origin server that handles requests

    5. In the left-side navigation pane, click Back-to-origin. On the Configurations tab, confirm that Default Origin Host is disabled.

      默认回源HOST

    6. Update your DNS record to map the domain name to the CNAME assigned by Alibaba Cloud CDN. See Add a CNAME record for a domain name.

    After these steps, CDN accelerates static content delivery, and WAF continues to inspect and protect dynamic traffic.

    Note

    To forward traffic sent to Domain Name B to Domain Name A (which is added to WAF), add a URL forwarding record in the Alibaba Cloud DNS console. See the "Add an explicit or implicit URL forwarding record" section in Add a DNS record.

    Verify the configuration

    Run the following checks to confirm the setup is working:

    1. Connectivity: Open the domain name in a browser. If the website loads, traffic is routing through CDN and WAF correctly.

    2. Attack blocking: Append a test XSS payload to the URL — for example, <your-domain>/alert(xss) and alert(xss). If a 405 error page appears, WAF is blocking the attack.

    More operations

    If you want to provide WAF protection for a domain that is accelerated by Dynamic Route for CDN, you can enable and configure Edge WAF in the DCDN console. After the configuration is complete, WAF protection is applied to the DCDN nodes. For more information, see Quick start for Edge WAF.

    To protect a domain name that uses Dynamic Route for CDN (DCDN), enable WAF in the DCDN console. See Getting started with WAF (new).

    What's next