Cloud Firewall:Get Started with Cloud Firewall (Pay-as-you-go)

Step 1: Activate pay-as-you-go Cloud Firewall

1. Go to the Cloud Firewall purchase page. Set Product Type to Pay-as-you-go 2.0, and complete the following configuration items.

   Configuration item	Description
   Auto Protection for Internet Assets	Select Yes to automatically add all public assets to the firewall and enable automatic protection for new assets. You can change this later in the console.
   Log Analysis and Log Analysis and Storage Capacity	Keep the default to store access logs. This enables real-time log collection, querying, and analysis for protected assets, meeting classified protection compliance requirements.
   Service-linked Role	Cloud Firewall requires access to your Alibaba Cloud resources for traffic control and monitoring. Click Create Service-linked Role to create AliyunServiceRoleForCloudFW. Do not modify this role.

2. Read and accept the Cloud Firewall (pay-as-you-go) Service Agreement, then click Buy Now and complete payment.

Step 2: View asset protection

1. Log on to the Cloud Firewall console. In the navigation pane on the left, click Firewall.

2. On the Internet Firewall tab, view your public assets under the current Alibaba Cloud account and their protection status. Because you enabled Auto Protection for Internet Assets during purchase, all public assets are in Protected status by default.

Step 3: Understand default IPS protection

Cloud Firewall includes built-in intrusion prevention (IPS) that automatically blocks:

• Network attacks (SQL injection, XSS, command injection)

• Vulnerability exploits (CVE-tracked vulnerabilities)

• Brute-force attacks (SSH, RDP, database logins)

• Worm propagation and cryptomining activity

• Backdoor trojan communications

• Denial-of-service (DoS) attacks

To view IPS rules:

1. In the navigation pane on the left, choose Prevention Configuration > IPS Configuration.

2. By default, the system enables Basic Protection and Virtual Patching, using the Block - Medium Threat Engine Mode, which is suitable for routine security protection scenarios.

Step 4: Configure access control (ACL) policies

ACL policies define which traffic reaches your servers. Use a whitelist approach: explicitly allow required traffic and deny everything else.

By default, Cloud Firewall includes the following policies with Action set to Allow. You can view them in the navigation pane on the left under Prevention Configuration > Access Control > Policy Configuration > Internet Border.

Most attacks originate from the Internet. Use a whitelist approach: create a low-priority Deny All catch-all policy, then add specific allow rules above it.

1. Configure policies: Go to the Prevention Configuration > Access Control > Policy Configuration > Internet Border page and configure the following:

   Inbound (priority from high to low):

   Source	Purpose	Protocol	Application	Port	Action
   Alibaba trusted IPs	Public IP of cloud asset	All	ANY	All	Allow
   Origin URLs of Alibaba Cloud services (such as WAF, DDoS)	Public IP of cloud asset	All	ANY	All	Allow
   Trusted O&M engineer or Bastionhost addresses	Public IP of cloud asset	TCP	RDP, SSH	3389, 22	Allow
   Trusted Operations and Maintenance (O&M) Engineer Address	Public IP of cloud asset	ICMP	ANY	-	Allow
   All	Public IP of cloud asset providing web services	TCP	HTTPS	443	Allow
   All	Public IP of cloud asset providing API services	TCP	HTTP	Corresponding API port	Allow
   All	All	All	All	All	Deny

   Outbound (priority from high to low):

   Source	Purpose	Protocol	Application	Port	Action
   All	Alibaba trusted IPs, Alibaba trusted domains	All	ANY	All	Allow
   All	Software repositories, Certificate Service	All	ANY	All	Allow
   All	Trusted domains such as Microsoft, Google, Windows	TCP	HTTPS, HTTP	All	Allow
   All	All	UDP	ANY	53, 123	Allow
   All	All	ICMP	ANY	-	Allow
   All	All	All	All	All	Deny

2. Adjust ACL engine mode: By default, Cloud Firewall allows traffic with unrecognized applications or domains to prevent false blocking. After confirming your policies are correct, click ACL Engine Management in the upper-right corner and switch the ACL Engine Mode for your assets to Strict Mode.

3. Validation test: After configuring policies, wait 3–5 minutes. Test with ping or curl, then click the number in the Hits/Last Hit At column to view hit logs on the Log Audit page.