Cloud Firewall:Configure access control policies

Configure an access control policy for the Internet firewall

In Cloud Firewall, inbound and outbound traffic is also referred to as north-south traffic and Internet traffic. You can configure access control policies in the Cloud Firewall console to manage north-south traffic. After you create access control policies, Cloud Firewall performs precise access control to ensure network security. For more information about the parameters of an access control policy that you can configure for the Internet firewall, see Create inbound and outbound access control policies for the Internet firewall.

Configure an inbound policy to allow Internet traffic destined for a specified port

For example, you want to create an inbound policy to allow Internet traffic that is destined only for TCP port 80 of an Elastic Compute Service (ECS) instance. The IP address of the ECS instance is 10.1.XX.XX, and the elastic IP address (EIP) is 200.2.XX.XX/32.

1. Log on to the Cloud Firewall console.

2. In the left-side navigation pane, choose Access Control > Internet Border.

3. On the Inbound tab, click Create Policy. In the Create Inbound Policy panel, click the Create Policy tab and configure a policy.

   1. Configure a policy to allow Internet traffic from all sources to the ECS instance and click OK.

      The following table describes the parameters.

      Parameter	Description	Example
      Source Type	The initiator of network traffic. You must select a source type and enter source addresses from which network traffic is initiated based on the selected source type. If you set Source Type to IP, specify one or more CIDR blocks, such as 192.168.0.0/16. You can specify up to 2,000 CIDR blocks. Separate multiple CIDR blocks with commas (,). If you enter multiple CIDR blocks at a time, Cloud Firewall automatically creates an address book that includes the entered CIDR blocks. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book. If you set Source Type to Address Book, make sure that an IPv4 or IPv6 address book is configured. For more information about how to create an address book, see Manage address books. If you set Source Type to Region, select one or more regions of traffic sources for Source. You can select one or more regions in or outside China.	IP
      Source		0.0.0.0/0 Note The value 0.0.0.0/0 specifies all public IP addresses.
      Destination Type	The receiver of network traffic. You must select a destination type and enter destination addresses to which network traffic is sent based on the selected destination type. If you set Source Type to IP, specify one or more CIDR blocks, such as 192.168.0.0/16. You can specify up to 2,000 CIDR blocks. Separate multiple CIDR blocks with commas (,). If you enter multiple CIDR blocks at a time, Cloud Firewall automatically creates an address book that includes the entered CIDR blocks. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book. If you set Source Type to Address Book, make sure that an IPv4 or IPv6 address book is configured. For more information about how to create an address book, see Manage address books.	IP
      Destination		200.2.XX.XX/32
      Protocol Type	The transport layer protocol. Valid values: TCP, UDP, ICMP, and ANY. If you do not know the protocol type, select ANY.	TCP
      Port Type	The port type and port number of the destination. If you set Port Type to Port, enter port ranges. Specify a port range in the Port number/Port number format. Examples: 22/22 or 80/88. Separate multiple port ranges with commas (,). You can enter up to 2,000 port ranges. If you enter multiple port ranges, Cloud Firewall automatically creates an address book that includes the entered port ranges. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book. If you set Port Type to Address Book, make sure that a port address book is configured. For more information about how to create an address book, see Manage address books.	Port
      Port		80/80
      Application	The application type of the traffic. If you set Protocol Type to TCP, you can select HTTP, HTTPS, SMTP, SMTPS, SSL, and FTP for Application. If you set Protocol Type to UDP, ICMP, or ANY, you can select only ANY for Application. If you select Domain Name or Address Book for Destination Type, you can select only HTTP, HTTPS, SMTP, SMTPS, or SSL for Application. Note Cloud Firewall identifies application types based on packet characteristics instead of port numbers. If Cloud Firewall cannot identify the application type in a packet, Cloud Firewall allows the packet. If you want to block the traffic whose application type is unknown, we recommend that you enable the strict mode for the Internet firewall. For more information, see Configure the strict mode of the Internet firewall.	ANY
      Action	The action on the traffic if the traffic meets the preceding conditions that you specify for the access control policy. Allow: The traffic is allowed. Deny: The traffic is denied, and no notifications are sent. Monitor: The traffic is recorded and allowed. You can observe the traffic for a period of time and change the policy action to Allow or Deny based on your business requirements.	Allow
      Priority	The priority of the access control policy. Default value:Lowest. Valid values: Highest: The access control policy has the highest priority. Lowest: The access control policy has the lowest priority.	Highest
      Status	Specifies whether to enable the policy. If you turn off Status when you create an access control policy, you can enable the policy in the list of access control policies.	Enabled

   2. Configure a policy to deny Internet traffic destined for all ECS instances and click OK.

      Configure the Deny policy based on the descriptions for the preceding Allow policy. The following list describes the parameters:

      • Destination: Enter 0.0.0.0/0.

        Note

        The value 0.0.0.0/0 specifies the IP addresses of all ECS instances.

      • Protocol Type: Select ANY.

      • Port: Enter 0/0.

        Note

        The value 0/0 specifies all ports of the ECS instance.

      • Application: Select ANY.

      • Action: Select Deny.

      • Priority: Select Lowest.

   After you complete the configurations, make sure that the priority of the Allow policy is higher than that of the Deny policy.

Configure an outbound policy to allow an ECS instance to access a specified domain name

For example, you want to create an outbound policy to allow an ECS instance to access www.aliyundoc.com. The IP address of the ECS instance is 10.1.XX.XX, and the EIP is 47.100.XX.XX/32.

1. Log on to the Cloud Firewall console

2. In the left-side navigation pane, choose Access Control > Internet Border.

3. On the Outbound tab, click Create Policy. In the Create Outbound Policy panel, click the Create Policy tab and configure a policy.

   1. Configure a policy to allow the ECS instance to access www.aliyundoc.com and click OK.

      The following table describes the parameters.

      Parameter	Description	Example
      Source Type	The initiator of network traffic. You must select a source type and enter source addresses from which network traffic is initiated based on the selected source type. If you set Source Type to IP, specify one or more CIDR blocks, such as 192.168.0.0/16. You can specify up to 2,000 CIDR blocks. Separate multiple CIDR blocks with commas (,). If you enter multiple CIDR blocks at a time, Cloud Firewall automatically creates an address book that includes the entered CIDR blocks. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book. If you set Source Type to Address Book, make sure that an IPv4 or IPv6 address book is configured. For more information about how to create an address book, see Manage address books.	IP
      Source		47.100.X.X/32
      Destination Type	The receiver of network traffic. You must select a destination type and enter destination addresses to which network traffic is sent based on the selected destination type. If you set Source Type to IP, specify one or more CIDR blocks, such as 192.168.0.0/16. You can specify up to 2,000 CIDR blocks. Separate multiple CIDR blocks with commas (,). If you enter multiple CIDR blocks at a time, Cloud Firewall automatically creates an address book that includes the entered CIDR blocks. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book. If you set Source Type to Address Book, make sure that an IPv4 or IPv6 address book is configured. For more information about how to create an address book, see Manage address books. If you set Destination Type to Domain Name, enter a domain name for Destination. Cloud Firewall automatically resolves the domain name and performs access control. If you set Destination Type to Region, select one or more regions of traffic destinations for Destination. You can select one or more regions in or outside China.	Domain Name
      Destination		www.aliyundoc.com Note You can also resolve the domain name to an IP address.
      Protocol Type	The transport layer protocol. Valid values: TCP, UDP, ICMP, and ANY. If you do not know the protocol type, select ANY.	TCP
      Port Type	The port type and port number of the destination. If you set Port Type to Port, enter port ranges. Specify a port range in the Port number/Port number format. Examples: 22/22 or 80/88. Separate multiple port ranges with commas (,). You can enter up to 2,000 port ranges. If you enter multiple port ranges, Cloud Firewall automatically creates an address book that includes the entered port ranges. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book. If you set Port Type to Address Book, make sure that a port address book is configured. For more information about how to create an address book, see Manage address books.	Port
      Port		0/0 Note The value 0/0 specifies all ports.
      Application	The application type of the traffic. If you set Protocol Type to TCP, you can select HTTP, HTTPS, SMTP, SMTPS, SSL, and FTP for Application. If you set Protocol Type to UDP, ICMP, or ANY, you can select only ANY for Application. If you select Domain Name or Address Book for Destination Type, you can select only HTTP, HTTPS, SMTP, SMTPS, or SSL for Application. Note Cloud Firewall identifies application types based on packet characteristics instead of port numbers. If Cloud Firewall cannot identify the application type in a packet, Cloud Firewall allows the packet. If you want to block the traffic whose application type is unknown, we recommend that you enable the strict mode for the Internet firewall. For more information, see Configure the strict mode of the Internet firewall.	ANY
      Action	The action on the traffic if the traffic meets the preceding conditions that you specify for the access control policy. Allow: The traffic is allowed. Deny: The traffic is denied, and no notifications are sent. Monitor: The traffic is recorded and allowed. You can observe the traffic for a period of time and change the policy action to Allow or Deny based on your business requirements.	Allow
      Priority	The priority of the access control policy. Default value:Lowest. Valid values: Highest: The access control policy has the highest priority. Lowest: The access control policy has the lowest priority.	Highest
      Status	Specifies whether to enable the policy. If you turn off Status when you create an access control policy, you can enable the policy in the list of access control policies.	Enabled

   2. Configure a policy to deny access from the ECS instance to all ECS instances on the Internet and click OK.

      Configure the Deny policy based on the descriptions for the preceding Allow policy. The following list describes the parameters:

      • Source: Enter 47.100.X.X/32.

      • Destination: Enter 0.0.0.0/0.

        Note

        The value 0.0.0.0/0 specifies the IP addresses of all ECS instances.

      • Protocol Type: Select ANY.

      • Port: Enter 0/0.

        Note

        The value 0/0 specifies all ports of the ECS instance.

      • Application: Select ANY.

      • Policy Action: Select Deny.

      • Priority: Select Lowest.

   After you complete the configurations, make sure that the priority of the Allow policy is higher than that of the Deny policy.

Configure an inbound policy to deny traffic destined for an ECS instance from regions outside China

For example, you want to create an inbound policy to deny traffic destined for an ECS instance from regions outside China. The IP address of the ECS instance is 10.1.XX.XX, and the EIP is 47.100.XX.XX.

1. Log on to the Cloud Firewall console

2. In the left-side navigation pane, choose Access Control > Internet Border.

3. On the Inbound tab, click Create Policy. In the Create Inbound Policy panel, click the Create Policy tab and configure a policy.

   The following table describes the parameters.

   Parameter	Description	Example
   Source Type	The initiator of network traffic. You must select a source type and enter source addresses from which network traffic is initiated based on the selected source type. If you set Source Type to IP, specify one or more CIDR blocks, such as 192.168.0.0/16. You can specify up to 2,000 CIDR blocks. Separate multiple CIDR blocks with commas (,). If you enter multiple CIDR blocks at a time, Cloud Firewall automatically creates an address book that includes the entered CIDR blocks. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book. If you set Source Type to Address Book, make sure that an IPv4 or IPv6 address book is configured. For more information about how to create an address book, see Manage address books. If you set Source Type to Region, select one or more regions of traffic sources for Source. You can select one or more regions in or outside China.	Region
   Source		Regions outside China
   Destination Type	The receiver of network traffic. You must select a destination type and enter destination addresses to which network traffic is sent based on the selected destination type. If you set Source Type to IP, specify one or more CIDR blocks, such as 192.168.0.0/16. You can specify up to 2,000 CIDR blocks. Separate multiple CIDR blocks with commas (,). If you enter multiple CIDR blocks at a time, Cloud Firewall automatically creates an address book that includes the entered CIDR blocks. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book. If you set Source Type to Address Book, make sure that an IPv4 or IPv6 address book is configured. For more information about how to create an address book, see Manage address books.	IP
   Destination		47.100.XX.XX
   Protocol Type	The transport layer protocol. Valid values: TCP, UDP, ICMP, and ANY. If you do not know the protocol type, select ANY.	ANY
   Port Type	The port type and port number of the destination. If you set Port Type to Port, enter port ranges. Specify a port range in the Port number/Port number format. Examples: 22/22 or 80/88. Separate multiple port ranges with commas (,). You can enter up to 2,000 port ranges. If you enter multiple port ranges, Cloud Firewall automatically creates an address book that includes the entered port ranges. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book. If you set Port Type to Address Book, make sure that a port address book is configured. For more information about how to create an address book, see Manage address books.	Port
   Port		0/0 Note The value 0/0 specifies all ports.
   Application	The port type and port number of the destination. If you set Port Type to Port, enter port ranges. Specify a port range in the Port number/Port number format. Examples: 22/22 or 80/88. Separate multiple port ranges with commas (,). You can enter up to 2,000 port ranges. If you enter multiple port ranges, Cloud Firewall automatically creates an address book that includes the entered port ranges. When you save the access control policy, Cloud Firewall prompts you to specify a name for this address book. If you set Port Type to Address Book, make sure that a port address book is configured. For more information about how to create an address book, see Manage address books.	ANY
   Action	The action on the traffic if the traffic meets the preceding conditions that you specify for the access control policy. Allow: The traffic is allowed. Deny: The traffic is denied, and no notifications are sent. Monitor: The traffic is recorded and allowed. You can observe the traffic for a period of time and change the policy action to Allow or Deny based on your business requirements.	Deny
   Priority	The priority of the access control policy. Default value:Lowest. Valid values: Highest: The access control policy has the highest priority. Lowest: The access control policy has the lowest priority.	Highest
   Status	Specifies whether to enable the policy. If you turn off Status when you create an access control policy, you can enable the policy in the list of access control policies.	Enabled

Configure an access control policy for a VPC firewall

A VPC firewall can monitor and control traffic between two VPCs. The traffic is also referred to as east-west traffic. If you want to manage traffic between two VPCs, you can create an access control policy to deny traffic from suspicious or malicious sources. You can also allow traffic from trusted sources and deny traffic from other sources. For more information about the parameters of an access control policy that you can configure for a VPC firewall, see Create an access control policy for a VPC firewall.

Deny traffic between ECS instances that reside in different VPCs

For example, you want to deny access from ECS 1 to ECS 2. ECS 1 resides in VPC 1, and ECS 2 resides in VPC 2. The VPCs are attached to the same CEN instance. The IP address of ECS 1 is 10.33.XX.XX/32, and the IP address of ECS 2 is 10.66.XX.XX/32.

1. Log on to the Cloud Firewall console

2. In the left-side navigation pane, choose Access Control > VPC Border.

3. On the VPC Border page, click Create Policy.

4. In the Create VPC Firewall Policy dialog box, configure the parameters and click Confirm.

   The following table describes the parameters.

   Parameter	Description	Example
   Source Type	Select the type of the traffic source. Valid values: IP: If you select this option, enter a CIDR block for Source. Address Book: If you select this option, select a preconfigured address book. Note You can add multiple CIDR blocks to an address book. This way, you can configure access control for multiple IP addresses in an efficient manner.	IP
   Source	Specify the address of the traffic source. If you set Source Type to IP, specify a CIDR block for Source. Note You can enter only one CIDR block. If you set Source Type to Address Book, select a preconfigured address book. Note You can select only one address book at a time. If you want to use multiple address books, you must create multiple policies. To create a policy, click Create Policy.	10.33.XX.XX/32
   Destination Type	Select the type of the traffic destination. Valid values: IP: If you select this option, enter an IP address for Destination. Address Book: If you select this option, select an address book. Domain Name: If you select this option, enter a domain name for Destination. You can enter a wildcard domain name. Example: *.aliyun.com.	IP
   Destination	Specify the address of the traffic destination. If you set Destination Type to IP, enter a CIDR block. Note You can enter only one CIDR block. If you set Destination Type to Address Book, find the required address book and click Select in the Actions column. Note You can select only one address book at a time. If you want to use multiple address books, you can create multiple policies. To create a policy, click Create Policy. If you set Destination Type to Domain Name, enter a domain name for Destination. You can enter a wildcard domain name. Example: *.aliyun.com.	10.66.XX.XX/32
   Protocol Type	Select the protocol type of the traffic. Valid values: ANY: any protocol TCP UDP ICMP	TCP
   Port Type	Select the type of the port. Valid values: Ports: If you select this option, you can enter only one port range for Ports. Address Book: If you select this option, you need to only select a preconfigured port address book. A port address book contains multiple ports. This allows you to configure access control for multiple ports in an efficient manner.	Port
   Port	Specify the port ranges on which you want to manage traffic. If you set Port Type to Port, enter a port range. If you set Port Type to Address Book, specify the Port Address Book parameter and click Select. You can select only one address book at a time. If you want to use multiple address books, you can create multiple policies. To create a policy, click Create Policy. If you set Protocol to ICMP, the destination ports you specify do not take effect. If you set Protocol to ANY, the destination ports that you specify do not take effect in ICMP traffic control.	0/0
   Application	Select the application type of the traffic. Valid values: ANY, HTTP, HTTPS, Memcache, MongoDB, MQTT, MySQL, RDP, Redis, SMTP, SMTPS, SSH, and VNC. If you set Protocol to TCP, you can use all the valid values of Application. If you set Protocol to a value other than TCP, you can set Application only to ANY. Note Cloud Firewall identifies applications based on packet characteristics, instead of port numbers. If Cloud Firewall fails to identify the application for a packet, Cloud Firewall allows the packet.	ANY
   Action	Select the action on the traffic. Valid values: Allow: If traffic meets the conditions that you specify for the policy, the traffic is allowed. Note By default, a VPC firewall allows all traffic. Deny: If traffic meets the conditions that you specify for the policy, the traffic is denied, and no notifications are sent. Monitor: If traffic meets the conditions that you specify for the policy, the traffic is recorded and allowed. After you observe the traffic for a period of time, you can change the policy action to Allow or Deny based on your business requirements.	Deny

Configure an access control policy for an internal firewall

An internal firewall can manage inbound and outbound traffic between ECS instances to block unauthorized access. The access control policies that you configure and publish for an internal firewall in the Cloud Firewall console are synchronized to ECS security groups. For more information about the parameters of an access control policy that you can configure for an internal firewall, see Create an access control policy for an internal firewall between ECS instances.

Allow traffic between ECS instances in the same policy group

For example, you want to allow traffic between ECS 1 and ECS 2 that reside in the sg-test policy group. The IP address of ECS 1 is 10.33.XX.XX, and the IP address of ECS 2 is 10.66.XX.XX.

1. Log on to the Cloud Firewall console.

2. In the left-side navigation pane, choose Access Control > Internal Border.

3. On the Internal Border page, find the required policy group and click Configure Policy in the Actions column.

4. On the Inbound tab, click Create Policy.

   The following table describes the parameters of an inbound policy.

   Parameter	Description	Example
   Policy Type:	Select the type of the policy. Valid values: Allow: allows traffic that hits the policy. Deny: denies traffic that hits the policy. If the traffic is denied, data packets are discarded without responses. If two policies have the same configurations but different policy types, the policy whose type is Deny takes effect.Allow Note Enterprise policy groups do not support the Deny policy type.	Allow
   Protocol Type	Select the protocol type of the traffic.	TCP
   Port Range	Specify the port ranges on which you want to manage traffic.	0/0
   Source Type and Source	Specify the address of the traffic source. If you set Direction to Inbound, you must configure these parameters. You can configure Source based on the value of Source Type. Valid source types: CIDR Block If you select this type, you must enter a source CIDR block in Source. You can enter only one CIDR block. Policy Group If you select this type, you must select a policy group from the Source drop-down list. Traffic from all ECS instances in the policy group is managed. Note Enterprise policy groups do not support the Policy Group type. Prefix List If you select this type, you must select a prefix list from the Source drop-down list. Traffic of all ECS instances in the security groups with which the prefix list is associated is managed.	Source Type: Policy Group Source: sg-test
   Destination	Specify the address of the traffic destination. If you set Direction to Inbound, you must configure this parameter. Valid values: All ECS Instances: all ECS instances specified in the current policy group. CIDR Block: If you select this option, you must enter a destination CIDR block. The ECS instances that correspond to this CIDR block are the destination of traffic.	CIDR Block: 10.66.XX.XX Note If you want all ECS instances in the policy group to communicate with each other, set Destination to All ECS Instances. If you want specific ECS instances in the policy group to communicate with each other, set Destination to CIDR Block and enter the CIDR blocks of the peer ECS instances.

5. Configure an outbound policy. This step is required if you use an advanced security group.

   By default, a basic security group allows outbound traffic. If you use a basic security group, you do not need to configure an outbound policy.

   Configure the outbound policy based on the descriptions for the inbound policy. The following list describes the parameters:

   • Source Type: IP

   • Source: 10.66.XX.XX

   • CIDR Block: 10.33.XX.XX

Allow traffic between ECS instances in different policy groups

For example, you want to allow traffic between ECS 1 and ECS 2 that reside in different policy groups of an internal firewall. The IP address of ECS 1 is 10.33.XX.XX, and the IP address of ECS 2 is 10.66.XX.XX.

1. Log on to the Cloud Firewall console.

2. In the left-side navigation pane, choose Access Control > Internal Border.

3. On the Internal Border page, find the policy group in which ECS 1 resides and click Configure Policy in the Actions column.

4. On the Inbound tab, click Create Policy.

   The following table describes the parameters of an inbound policy.

   Parameter	Description	Example
   Policy Type	Select the type of the policy. Valid values: Allow: allows traffic that hits the policy. Deny: denies traffic that hits the policy. If the traffic is denied, data packets are discarded without responses. If two policies have the same configuration but different policy types, the policy whose type is Deny takes effect. Note Enterprise policy groups do not support the Deny policy type.	Allow
   Protocol Type	Select the protocol type of the traffic.	TCP
   Port Range	Specify the port ranges on which you want to manage traffic.	0/0
   Source Type and Source	Specify the address of the traffic source. If you set Direction to Inbound, you must configure this parameter. You can configure Source based on the value of Source Type. Valid source types: CIDR Block If you select this type, you must enter a source CIDR block in Source. You can enter only one CIDR block. Policy Group If you select this type, you must select a policy group from the Source drop-down list as the traffic source. Traffic from all ECS instances in the policy group is controlled. Note Enterprise policy groups do not support the Policy Group type. Prefix List If you select this type, you must select a prefix list from the Source drop-down list. Traffic of all ECS instances in the security groups with which the prefix list is associated is managed. For more information about prefix lists, see Use prefix lists to simplify management of security group rules.	Source Type: IP Source: 10.66.XX.XX
   Destination	Specify the address of the traffic destination. If you set Direction to Inbound, you must configure this parameter. Valid values: All ECS Instances: all ECS instances specified in the current policy group. CIDR Block: If you select this option, you must enter a destination CIDR block. The ECS instances that correspond to this CIDR block are the destination of traffic.	CIDR Block: 10.33.XX.XX Note If you want the ECS instances in the sg-test2 policy group to access all ECS instances in the sg-test1 policy group, set Destination to All ECS Instances. If you want the ECS instances in the sg-test2 policy group to access specific ECS instances in the sg-test1 policy group, set Destination to CIDR block and enter the CIDR blocks of the specific ECS instances in the sg-test1 policy group.

5. Configure an outbound policy. This step is required if you use an advanced security group.

   By default, a basic security group allows outbound traffic. If you use a basic security group, you do not need to configure an outbound policy.

   Configure the outbound policy based on the descriptions for the inbound policy. The following list describes the parameters:

   • Source Type: IP

   • Source: 10.33.XX.XX

   • CIDR Block: 10.66.XX.XX

6. Configure the inbound and outbound policies to allow traffic of ECS 2 based on the preceding configurations.