Configure access control policies for bidirectional traffic between assets and the internet - Cloud Firewall

Prerequisites

The Internet Firewall is enabled, and protection for your Internet-facing assets is enabled. For more information, see Enable the Internet firewall. For information about the scope of Internet-facing assets that Cloud Firewall can protect, see Protection scope.
Ensure you have a sufficient policy quota. You can view your quota usage on the Prevention Configuration > Access Control > Policy Configuration > Internet Border page. For information about how policy quotas are calculated, see Overview of access control policies.
If your available quota is insufficient, click Increase Quota to purchase a Quota for Additional Policy. For more information, see Purchase Cloud Firewall.
In the Usage area, view the Used/Edition Quota (for example, 14/10000) and Additional Quota (for example, 0/0) values to determine if your remaining quota is sufficient.
To add multiple objects as a source or destination, create an address book first. For more information, see Address books.

Configure access control policies for the Internet firewall

Cloud Firewall provides the following methods to configure access control policies:

Create a custom access control policy: You can create a custom policy that meets your business requirements.
Apply a recommended intelligent policy: Cloud Firewall learns your traffic patterns over the last 30 days, identifies potential risks, and recommends access control policies, which you can then review and apply.
Apply a recommended common policy: You can apply a built-in recommended common policy.

Important

For exposed public IPs, create policies to allow traffic on open, active ports, and deny all access to other ports. This reduces the attack surface of your assets on the internet.
To allow trusted sources (such as IP addresses and domain names) and deny all other sources, first create a high-priority allow policy for the trusted sources, and then create a low-priority deny policy that matches all sources.
Recommended policies do not take effect until you apply them.
Configuring an outbound policy to allow traffic to specific regions does not increase the risk of inbound attacks, such as DDoS. Outbound policies only control traffic initiated from internal assets and do not open any inbound ports. We recommend that you follow the principle of least privilege and allow traffic to only the necessary destination regions and ports.

Custom policy

You can create custom outbound and inbound policies for the internet firewall.

Log on to the Cloud Firewall console.
In the left-side navigation pane, choose Prevention Configuration > Access Control > Policy Configuration > Internet Border.
On the Outbound or Inbound tab, select the IP version and then click Create Policy. IPv4 is selected by default.
In the Create Outbound Policy or Create Inbound Policy panel, click Create Policy.
Configure the policy details based on the following tables, and then click OK.
Note
Note the following when you configure IP addresses:
- Address format requirements: Use commas (,) or line feeds to separate multiple IP address segments. Semicolons or spaces are not supported. A single IP address must include a subnet mask, for example, 192.168.1.1/32.
- IPv6 policy matching rules: When you create an IPv6 policy, the source and destination addresses must both be in IPv6 format.
- 0.0.0.0/0 coverage: In an inbound policy, a destination address of 0.0.0.0/0 matches all IPv4 public assets but does not include IPv6 assets. To cover IPv6 assets, you must create a separate IPv6 policy.
- Configuration for proxy scenarios: When you use proxy services such as WAF (with CNAME access), Anti-DDoS, or ESA, Cloud Firewall detects the source IP address of inbound traffic as the proxy's back-to-origin IP address, not the real client IP address. When you configure the source address for an inbound policy, reference the system's built-in Cloud Service IP Address Book to ensure that back-to-origin traffic is allowed.
Configure a traffic control policy for internal network traffic to the internet (outbound policy)
Basic Configuration
- Source Type: The source of network traffic. You need to select the access source type and enter the address based on the type.
  
  Select the IP type and enter an IP address range. Address ranges must use the standard CIDR format, such as 192.168.0.0/16.You can enter up to 2,000 address ranges separated by commas (,).
  
  If you enter multiple IP address ranges, Cloud Firewall automatically creates an address book and prompts you to set a name when you save the policy.
  
  Select the Address Book type and reference Custom IP Address Book or Cloud Asset IP Address Book.For more information, see Manage address books.
- Destination Type: The destination of network traffic. You need to select the destination type and enter the address based on the type.
  
  Select the IP type and enter an IP address range. Address ranges must use the standard CIDR format, such as 192.168.0.0/16.You can enter up to 2,000 address ranges separated by commas (,).
  
  If you enter multiple IP address ranges, Cloud Firewall will automatically create an address book for the multiple address ranges you enter, and when you save the policy configurationprompts you to set an address book name.
  
  Select Address Book type, and reference IP Address Book and Domain Address Book.For more information, see Manage address books.
  
  When you select the Domain Name type, you need to select the domain name recognition mode. Three domain name recognition modes are available:
  
  FQDN-based Resolution (Extract Host or SNI Field in Packets): We recommend this mode when managing traffic of the following seven protocols: HTTP, HTTPS, SMTP, SMTPS, SSL, POPS, and IMAPS.
  
  DNS-based Dynamic Resolution: We recommend this mode when managing traffic other than the seven protocols: HTTP, HTTPS, SMTP, SMTPS, SSL, POPS, and IMAPS.
  
  Important
  This mode does not support wildcard domains or wildcard domain address books.
  
  at the same time based on FQDN and DNS dynamic resolution: We recommend this mode when managing traffic of the seven protocols, but some or all traffic does not carry the HOST/SNI field.
  
  Important
  This mode takes effect only when ACL Engine Management strict mode is enabled, and does not support wildcard domains or wildcard domain address books.
  
  Select Location type, select the Destination address where the region. You can select China region or international region.
- Protocol: Transport layer protocol type. Supported settings: TCP, UDP, ICMP, ANY. If you are unsure of the specific protocol, you can select ANY.
- Application Protocol: Set the application type of the access traffic. Supported applications vary based on the destination type and protocol type.
  
  Protocol When you select TCP:
  
  Destination Type Select IP, IP Address Book or Location: You can select all applications.
  
  Destination Type Select Domain Name ordomain name Address Book:
  
  Domain Name Identification Mode When you select FQDN-based Resolution (Extract Host or SNI Field in Packets), you can only select applications such as HTTP, HTTPS, SMTP, SMTPS, SSL, POPS, and IMAPS.
  
  Domain Name Identification Mode When you select DNS-based Dynamic Resolution, you can select all applications.
  
  Domain Name Identification Mode When you select Based on both FQDN (extract Host/SNI from packets) and DNS dynamic resolution, you can only select applications such as HTTP, HTTPS, SMTP, SMTPS, SSL, POPS, and IMAPS.
  
  When you select UDP Protocol, the application type supports ANY and DNS.
  
  When you select ICMP or ANY Protocol, the application type can only be ANY.
  
  Note
  Application identification relies on packet features (protocol identification does not depend on ports). If application identification fails, the session traffic is allowed. To block traffic of unknown application types, we recommend that you enable strict mode for the Internet firewall. For more information, see Introduction to modes of the access control engine.
- Port: Set the destination port type and destination port.
  
  Select Port type, enter port range. Port ranges are separated by forward slashes (/), such as 22/22 and 80/88.You can add up to 2,000 port ranges, separated by commas (,).
  
  If you enter multiple port ranges, Cloud Firewall automatically creates a port address book and prompts you to set a name when you save the policy.
  
  When you select the Port Address Book type, you need to create a port address book in advance. For more information, see Manage address books.
- Action: Specify the action for matched traffic in this policy.
  
  Allow: Allow the traffic.
  
  Drop: Block the traffic without any notification.
  
  Monitor: In this mode, traffic is allowed by default. You can filter and observe this traffic by using relevant fields in Traffic Logs, After a period of observation, adjust to Allow or Deny.
Advanced Configuration

Web Filtering and Application Control: After you enable the corresponding features, you can reference the created Web Filtering and Application Control templates for fine-grained application layer traffic control, For more information, see URL Filtering and Application Control.
Note

Encrypted Traffic Decryption: To more completely extract traffic features and implement accurate access control.we recommend that you configure TLS inspection first. For more information, see TLS inspection.

Traffic Matching Exceptions:

If traffic is already blocked by a preceding Basic Configuration rule, it will directly skip Web Filtering and Application Control rule matching.

For the Web Filtering rule, if the URL cannot be recognized by the system, or if HTTPS traffic without TLS inspection is encountered, matching against this rule is skipped.

For the Application Control rule, if the application cannot be recognized by the system, the system executes the Unknown Application Action.
Advanced Configuration
- Policy Priority: Policy priority, Default value: Lowest, indicating the lowest priority.
  
  Highest: The access control policy takes effect with the highest priority.
  
  Lowest: The access control policy takes effect with the lowest priority.
  
  Custom: Customize the priority. Minimum: 1, Maximum: 50. The smaller the number, the higher the priority.
- Status: Specify whether to enable the policy. Only enabled policies take effect.
- Policy Validity Period: Set the validity period of the policy. The policy can match traffic only within the validity period.
  
  Always
  
  Single Time Range: Select a one-time time period.
  
  Recurrence Cycle: Select a recurring time period and effective dates.
  
  Note
  
  The start time of the effective date must be earlier than the end time. The policy takes 3 to 5 minutes to take effect.
  
  If you select Indefinite Recurrence, the effective end time is automatically set to December 31, 2099.
  
  Related FAQ: Does a policy take effect if the recurrence cycle spans multiple days?
- Description: Enter a description for the policy to help you identify its purpose.
Configure a traffic control policy for internet traffic to the internal network (inbound policy)
Basic Configuration
- Source Type: The source of network traffic. You need to select the access source type and enter the address based on the type.
  
  Select the IP type and enter an IP address range. Address ranges must use the standard CIDR format, such as 192.168.0.0/16.You can enter up to 2,000 address ranges separated by commas (,).
  
  If you enter multiple IP address ranges, Cloud Firewall automatically creates an address book and prompts you to set a name when you save the policy.
  
  Select Address Book type, and reference Custom IP Address Book, Cloud Asset IP Address Book or Cloud Service IP Address Book.For more information, see Manage address books.
  
  Select Location type, select the Source address where the region. You can select China region or international region.
- Destination Type: The destination of network traffic. You need to select the destination type and enter the address based on the type.
  
  Select the IP type and enter an IP address range. Address ranges must use the standard CIDR format, such as 192.168.0.0/16.You can enter up to 2,000 address ranges separated by commas (,).
  
  If you enter multiple IP address ranges, Cloud Firewall automatically creates an address book and prompts you to set a name when you save the policy.
  
  Select Address Book type, and reference Custom IP Address Book or Cloud Asset IP Address Book. For more information, see Manage address books.
- Protocol: Transport layer protocol type. Supported settings: TCP, UDP, ICMP, ANY. If you are unsure of the specific protocol, you can select ANY.
- Application Protocol: Set the application type of the access traffic.
  
  When you select TCP Protocol, the application type supports all applications such as HTTP, HTTPS, SMTP, SMTPS, SSL, and FTP.
  
  When you select UDP Protocol, the application type supports ANY and DNS.
  
  When you select ICMP or ANY Protocol, the application type can only be ANY.
  
  Note
  Application identification relies on packet features (protocol identification does not depend on ports). If application identification fails, the session traffic is allowed. To block traffic of unknown application types, we recommend that you enable strict mode for the Internet firewall. For more information, see Introduction to modes of the access control engine.
- Port: Set the destination port type and destination port.
  
  Select Port type, enter port range. Port ranges are separated by forward slashes (/), such as 22/22 and 80/88.You can add up to 2,000 port ranges, separated by commas (,).
  
  If you enter multiple port ranges at the same time, Cloud Firewall will automatically create an address book for the multiple port ranges you enter, and prompt you when you save the policy configuration to set the address book name. you to set an address book name.
  
  When you select the Port Address Book type, you need to create a port address book in advance. For more information, see Manage address books.
- Action: Specify the action for matched traffic in this policy.
  
  Allow: Allow the traffic.
  
  Drop: Block the traffic without any notification.
  
  Monitor: In this mode, traffic is allowed by default. You can filter and observe this traffic by using relevant fields in Traffic Logs, After a period of observation, adjust to Allow or Deny.
Advanced Configuration
- Policy Priority: Policy priority, Default value: Lowest, indicating the lowest priority.
  
  Highest: The access control policy takes effect with the highest priority.
  
  Lowest: The access control policy takes effect with the lowest priority.
  
  Custom: Customize the priority. Minimum: 1, Maximum: 50. The smaller the number, the higher the priority.
- Status: Specify whether to enable the policy. Only enabled policies take effect.
- Policy Validity Period: Set the validity period of the policy. The policy can match traffic only within the validity period.
  
  Always
  
  Single Time Range: Select a one-time time period.
  
  Recurrence Cycle: Select a recurring time period and effective dates.
  
  Note
  
  The start time of the effective date must be earlier than the end time. The policy takes 3 to 5 minutes to take effect.
  
  If you select Indefinite Recurrence, the effective end time is automatically set to December 31, 2099.
  
  Related FAQ: Does a policy take effect if the recurrence cycle spans multiple days?
- Description: Enter a description for the policy to help you identify its purpose.

Intelligent policy

You can apply recommended intelligent policies for outbound and inbound traffic.

Warning

Applying a policy carries risks. Review the policy details carefully before you apply it.
Ignored recommendations cannot be restored. Proceed with caution.

Check if recommended intelligent policies are available

On the Internet Border page, you can check if Cloud Firewall has generated intelligent policies. In the Policy Statistics section on the Policy Configuration page, check whether the value for Recommended Intelligent Policy is greater than 0.

In the left-side navigation pane, choose Prevention Configuration > Access Control > Policy Configuration > Internet Border.
In the upper-right corner of the policy list, click Agent Policy Generation to go to the SecOps Agent page.
View the recommended intelligent policies. In the section for the policy that you want to apply, click Apply Policy.

Common policy

Warning

Applying a policy carries risks. Review the policy details carefully before you apply it.
Ignored recommendations cannot be restored. Proceed with caution. If you ignore all common policy recommendations, the Recommended Common Policy tab is hidden.

In the left-side navigation pane, choose Prevention Configuration > Access Control > Policy Configuration > Internet Border.
On the Outbound or Inbound tab, click Create Policy, and then click the Recommended Common Policy tab.
View the recommended common policies. In the section for the policy that you want to apply, click Quick Apply.

ACL engine mode

The ACL engine for the internet firewall supports Loose Mode and Strict Mode:

Loose Mode (Default): In Loose Mode, traffic from unidentified applications or to unidentified domain names is allowed to prioritize service availability.
Strict Mode: In Strict Mode, traffic from unidentified applications or to unidentified domain names is matched against your policies. If a matching deny policy exists, this unidentified traffic is denied.

You can configure the ACL engine mode in one of the following three ways: as a default for new assets, for a single asset, or for multiple assets in batches. On the Prevention Configuration > Access Control > Policy Configuration > Internet Border page, click ACL Engine Management in the upper-right corner of the access control policy list. Then, configure the settings in the Access Control Engine Management - Internet Border panel.

Default mode for new assets

In the Access Control Engine Management - Internet Border panel, the Engine Management > Add ACL Engine Mode section shows the engine mode that is used when you enable protection for a new asset.

Click Modify to change the current mode.

Change mode per asset

In the Access Control Engine Management - Internet Border panel, the ACL Engine Mode column in the asset list shows the engine mode of the current asset.

Click Modify to change the engine mode of the selected asset.

Change mode in batches

In the Access Control Engine Management - Internet Border panel, select multiple assets and click Batch Modify in the lower-left corner to change the engine mode for the selected assets.

View policy hit statistics

After your business has been running for a period, you can view the hit count of access control policies in the Hits/Last Hit At column in the access control policy list.

Click the hit count to go to the Traffic Logs page to view traffic logs. For information about how to view traffic logs, see Traffic Logs.

Related operations

From the policy list, you can edit, delete (individually or in batches), download, copy, or move custom policies. Moving a policy changes its priority.

The priority of an access control policy can be set from 1 to N, where N is the number of existing policies. A smaller number indicates a higher priority. When you change a policy's priority, the priorities of lower-ranked policies are adjusted automatically.

Important

When a policy is deleted, its associated traffic is no longer managed by Cloud Firewall's access control. Delete policies with caution.

FAQ

What are the best practices for configuring inbound policies?

Most network attacks originate from the public network. Configure security policies that meet your business needs. We recommend using a whitelist. Set a low-priority, catch-all policy to drop all traffic. Then, add specific allow policies with higher priority.

Configuration recommendations:

Rule order: Always place whitelist rules before the catch-all rule. Before you deploy, add allow rules for your production services above the drop policy.
Grayscale validation: Initially, set the action of the catch-all policy to Monitor. Analyze the traffic using Log Audit and adjust the policy to allow only trusted traffic. After a full trial run, change the action to Drop.
Environment isolation: You can enable the catch-all policy for your entire staging environment. For your production environment, if you cannot create a complete whitelist right away, limit the source address of the catch-all policy to your test IP segment. This prevents disruption to your production services.

Why is the policy to drop foreign IPs not working?

If your policy to drop international IP addresses is not working, check the following scenarios:

Scenario 1: Your service uses a WAF CNAME
When traffic passes through Web Application Firewall (WAF) to your origin server, Cloud Firewall detects the source IP of the WAF origin fetch node instead of the original client IP. This makes location-based blocking policies ineffective.
Recommendation: Configure geo-blocking rules in the WAF console. This blocks requests from outside your specified regions at the traffic entry point.
Scenario 2: The public IP address of the test client is not what you expect
If you test from a corporate network, VPN, or proxy server, Cloud Firewall detects the public IP of the gateway or proxy. It does not detect the real IP of your test device. This can cause the detected location to differ from your policy settings.
Recommendation: You can test by directly accessing the target public IP from an independent public network, such as a mobile data network or home broadband.
Scenario 3: The policy parameters are incorrect
Verify that the following key configuration items are set correctly:
- Source Type: For an inbound policy, the Source Type must be set to Location. Then, specify "International" or select specific countries or regions.
- Action: The policy Action must be set to Drop.
- Priority: Ensure that this block policy has a higher priority than any allow policies for the same destination. This prevents a high-priority whitelist rule from overriding it.

Can a policy with a drop action reduce Cloud Firewall traffic fees?

A policy with a Drop action does not reduce your Cloud Firewall traffic fees. This policy blocks traffic from reaching your backend services and reduces the load on your origin server. However, because the traffic has already been inspected by Cloud Firewall, it is still included in your billable traffic.

When a private ECS instance accesses the public network through an Internet NAT Gateway, should I configure an Internet firewall or a NAT firewall?

Configure a NAT firewall when a private ECS instance accesses the public network through an Internet NAT Gateway.

If you only use the NAT Gateway for outbound access and do not expose any public IPs or other public assets, the Internet firewall does not apply to the NAT traffic. Outbound traffic is not managed by Internet firewall policies, so you do not receive targeted security protection.

When WAF uses the cloud native mode, does Cloud Firewall detect the real client IP for inbound traffic?

Yes, it does. When you connect your assets using the WAF cloud native mode, Cloud Firewall detects the real client IP as the source IP for inbound traffic. This mode uses a transparent proxy or an SDK integration. It does not forward traffic from a WAF origin fetch IP. Therefore, it can directly obtain and pass the original client IP.