Web Application Firewall (WAF) uses specific back-to-origin classless inter-domain routing (CIDR) blocks to forward normal traffic back to an origin server. After you add a website to WAF, you must configure security software or access control policies for the origin server to allow inbound traffic from the back-to-origin CIDR blocks.

Background information

If you use security software such as FortiGate for your origin server, you must add the back-to-origin CIDR blocks of WAF to the IP address whitelist of the security software. This way, the security software does not block the normal traffic forwarded by WAF to the origin server.

For security purposes, we recommend that you configure access control policies for the origin server to allow inbound traffic only from the back-to-origin CIDR blocks of WAF. This way, attackers cannot bypass WAF to attack the origin server. For more information, see Configure protection for an origin server.

Obtain the back-to-origin CIDR blocks of WAF

  1. Log on to the Web Application Firewall console.
  2. In the top navigation bar, select the resource group and region to which the WAF instance belongs. The region can be Mainland China or International.
  3. In the left-side navigation pane, choose System Management > Product Information.
  4. In the lower part of the Product Information page, find the WAF IP Segments section and click Copy All IPs.
    The WAF IP Segments section displays the latest back-to-origin CIDR blocks. Back-to-origin CIDR blocks of WAF

What to do next

After you obtain the back-to-origin CIDR blocks of WAF, you must add them to the IP address whitelist of the security software on the origin server.

Warning If you do not add the back-to-origin CIDR blocks of WAF to the IP address whitelist of the origin server, normal requests forwarded by WAF may be blocked. This may cause service interruptions.

FAQ

  • What is a back-to-origin CIDR block of WAF?
    A back-to-origin CIDR block is a CIDR block used by WAF to forward requests that are sent from clients to the origin server. After a website is added to WAF, the origin server considers that all requests come from the back-to-origin CIDR blocks of WAF. The actual IP addresses of clients are added to the X-Forwarded-For (XFF) fields in the HTTP headers of requests. Architecture in which WAF is used
  • Why must I add the back-to-origin CIDR blocks of WAF to the IP address whitelist of the security software on the origin server?

    After a website is added to WAF, the origin server receives most requests from the back-to-origin CIDR blocks of WAF, and requests are sent at a high rate. In this case, the firewall or security software on the origin server may consider these CIDR blocks as attack IP addresses and block them. If these IP addresses are blocked, WAF cannot receive responses from the origin server as expected. Make sure that the back-to-origin CIDR blocks of WAF are added to the IP address whitelist of the origin server after you add a website to WAF. Otherwise, the website may be inaccessible or become slow.

References