Learn how to correlate Cloud Firewall IPS attack detection results with NAT session logs. This integration lets you trace network attacks to the private IP address of a compromised resource.
Background
When using a public NAT Gateway in a VPC environment, the private IP addresses of your cloud services are translated and hidden to create a secure internet gateway. While this improves security, it also presents a challenge for incident response. If an internet-based attack or malicious outbound connection occurs, security alerts typically identify only the elastic IP address (EIP) of the NAT Gateway. This makes it difficult to pinpoint the compromised resource, such as an ECS instance, which delays attack tracing and remediation.
How it works
To solve this problem, Cloud Firewall introduced the private IP tracing feature, which works with NAT session logs. By automatically correlating NAT Gateway session logs with attack events, this feature directly reveals the private IP address of the affected instance. This helps you quickly and accurately locate compromised assets and take effective countermeasures.
-
Cloud Firewall IPS capabilities: The Cloud Firewall intrusion prevention system (IPS) engine detects and protects against inbound and outbound attack traffic. The IPS engine filters all network traffic that passes through Cloud Firewall before forwarding it. The engine uses deep packet inspection to identify protocols and parse packets, then applies stream and packet filtering based on its IPS engine and threat intelligence. If traffic matches a threat signature and a corresponding IPS rule action, the malicious packet is dropped or allowed, enabling real-time alerting and interception. Cloud Firewall also records detailed IPS attack logs.
-
NAT session log: NAT Gateway provides a session log feature. When you create an SNAT entry for a NAT Gateway, traffic passing through it generates SNAT session records for tracing and monitoring. These session logs are written to Simple Log Service (SLS). Each log entry captures a specific five-tuple network flow within a capture window. For inbound DNAT traffic, you can use port mapping to locate the specific private IP address.
Outbound traffic attack tracing:
Inbound traffic attack tracing:
Use case
Consider an online mall run by a mid-sized new retail company. To ensure service stability and security, the company deploys a NAT Gateway in a DMZ VPC as the single entry and exit point for all internet traffic to reduce its exposure risk. The company also uses Cloud Firewall with the internet firewall feature enabled to filter and protect traffic to the NAT Gateway's elastic IP address (EIP). One night, the security operations team receives an alert for suspicious traffic. It appears an attacker has exploited a vulnerability, implanted a trojan, and is now using the compromised machine to make malicious outbound requests to an overseas IP address, download a bash script, and install a CoinMiner family trojan. The team needs to quickly identify the compromised back-end server.
This is where the Cloud Firewall private IP tracing feature becomes crucial. After the company enables this feature, the system automatically correlates and analyzes NAT Gateway session logs with Cloud Firewall IPS attack logs. It matches the specific five-tuple network flow from each NAT session log with the corresponding IPS event log recorded by Cloud Firewall, pinpointing the at-risk private IP address within minutes. This enables security personnel to quickly identify the compromised server, apply an access control policy to block its outbound access, and remove the trojan, effectively containing the threat and preventing further damage.
Usage notes
-
This feature is supported by both pay-as-you-go and subscription Cloud Firewall instances. It is supported by public NAT Gateway instances that are billed based on capacity units (CUs). NAT Gateway instances that are billed by specification do not support the session log feature.
-
Enabling private IP tracing does not incur additional charges from Cloud Firewall itself. However, the system creates and queries an index on your NAT Gateway session logs, which generates costs in Simple Log Service (SLS). For more information about SLS billing, see SLS pricing.
-
After you enable private IP tracing, if the system detects that the index for the NAT session log is disabled or that required fields for tracing are missing, it will automatically create or add the necessary indexes and fields.
Procedure
-
Log on to the Cloud Firewall console. In the left-side navigation pane, choose .
-
On the tab, view the list of public assets that support tracing. Before Cloud Firewall can perform private IP tracing, the target NAT Gateway must have both internet firewall protection and the NAT session log feature enabled. When you click the switch in the Actions column, prompts will guide you to enable these features if they are not already active. Alternatively, refer to the following documentation for detailed configuration instructions:
-
Enable internet firewall protection: Enable the firewall switch
-
Enable the NAT session log: NAT session log configuration process
For detailed instructions, see IPS private IP tracing.
View tracing data
The private IP tracing feature depends on NAT Gateway session logs. Due to data capture and delivery latency in NAT Gateway, tracing results may be delayed by up to 20 minutes.
After you enable Private IP Traceback, you can view the tracing data in the following locations.
The list of intrusion prevention events includes columns such as Time, Source IP, Destination IP, Event Name (which includes the attack type, direction, and detection source), Event Count/Risk Level, Protection Status, and Action. For example, a record might show an inbound web attack named MeterSphere plugin remote code execution originating from a public IP address. The detection source is a virtual patch, the target is a private IP address, the risk level is High, and the protection status is Alert Only.
The event details page has two tabs: Basic Information and Attack Payload. The Basic Information tab displays alert details as key-value pairs, including fields such as First Discovered, Last Discovered, Direction (inbound/outbound), Source IP, Destination IP, and Private IP. The Private IP field shows the correlated private IP address of the internal cloud resource.
The list of breach awareness events displays information for each alert, including its Risk Level, Event Name, Asset Type, Instance ID/Name, Affected Asset IP/UID, Time, and Handling Status. In the Affected Assets column, you can use the private IP tracing feature to locate the private IP address. The Action column provides options such as One-Click Defense, Ignore, and Details.
The details page contains two tabs: Basic Information and Compromise Payload. On the Basic Information tab, the Event Summary section shows the event name (such as trojan backdoor communication), time, risk level (such as High), and event description. The Affected Assets section displays the affected asset name, public IP address, and private IP address, which identifies the affected internal asset.
On the tab:
The table displays security event records with columns including Reception Time, Type, Detection Source, Rule Name, Source IP, Destination IP, Private IP, and Private Port. The Private IP and Private Port columns are the key fields for tracing. For example, an Nmap web scanning event might correspond to a private IP address of 10.11.x.x and a private port of 8000.