Web Application Firewall:Add a domain name

Prerequisites

• You have purchased a WAF instance, and the number of domain names that it supports does not exceed the limit.

  Note

  The total number of domain names that you can add to a WAF instance varies based on the specifications of the instance and the number of extra domain packages that you purchased. For more information, see extra domain package.

• If your website is deployed on a server in the Chinese Mainland, the domain name must have an ICP filing that remains valid while protected by WAF.

  Note

  WAF instances in the Chinese Mainland periodically check the ICP filing status of protected domain names. If an ICP filing expires, WAF stops forwarding requests for the domain name and may clear its configuration to comply with relevant laws and regulations.

  • If the website is deployed on Alibaba Cloud, you must complete the ICP filing through Alibaba Cloud.

  • If the website is not deployed on Alibaba Cloud, you can contact Alibaba Cloud or another cloud provider to complete the ICP filing.

Procedure

1. Log on to the Web Application Firewall (WAF) console. In the top menu bar, select the resource group and region for your WAF instance: Chinese Mainland or Outside Chinese Mainland.

2. In the left navigation pane, choose Asset Center > Website Access.

3. On the Domain Names tab, click Website Access.

   Note

   On the Add Domain Name page, Access Mode is set to CNAME Record by default.

4. Enter website information and click Next.

   Parameter	Description
   Domain Name	Enter the domain name that you want to protect. You can enter an exact domain name, such as www.aliyundoc.com, or a wildcard domain name, such as *.aliyundoc.com. You can enter only one domain name. Domain names that contain underscores (_) are not supported. If you are adding this domain name for the first time, you must verify its ownership before you can proceed. How to verify domain name ownership You must verify ownership of the domain name. Choose one of the following two methods: DNS record verification (Recommended): At your DNS provider, manually add the TXT record provided by WAF. File verification: Upload the WAF-provided verification file to the root directory of your origin server. This method requires access permissions to the origin server. DNS record verification In the verification section, click the Method 1: DNS Record tab. Add a TXT record at your DNS provider based on the Record Type, Hostname, and Record Value provided in the WAF console. If you use Alibaba Cloud DNS, perform the following steps. If you use another DNS provider, perform similar operations in the provider's system. Log on to the Alibaba Cloud DNS console. On the Public Zone page, find the target primary domain name and click Settings in the Actions column. Click Add Record. Enter the Record Type, Hostname, and Record Value, and then click OK. Keep the default values for other parameters. After the record is added, you can view it in the list of records. The record takes effect by default. Its Status is Enabled. If you modify an existing TXT record, the change takes effect after the TTL period, which is 10 minutes by default. Return to the WAF console and click Verify. If Verification Successful is displayed, the domain name ownership is verified. If Verification Failed is displayed, perform the following steps to troubleshoot the issue: Check the TXT record: Make sure the host record and record value match the details provided in the WAF console. If they differ, delete the incorrect record, add it again correctly, and retry the verification. Wait for DNS propagation: DNS changes can take time to propagate. We recommend waiting 10 minutes before retrying the verification. Use another verification method: If the verification still fails after multiple attempts, we recommend that you use "Method 2: File verification". File verification In the verification section, click the Method 2: Verification File tab. Click the link to download the verification file. Download the verification file (the filename format is verify_xxxx.html), upload the file to the root directory of your domain name, select the protocol type (HTTP or HTTPS), and then click Click To Verify to complete the verification. Important The verification file is valid for only three days after it is downloaded. If you do not complete the file verification within the validity period, you must download the file again. Do not perform any operations on the verification file, such as opening, editing, or renaming it. WAF accesses your origin server based on the selected protocol. Make sure that the security group or firewall rules of the origin server allow access: If you select HTTP, you must allow inbound traffic over TCP port 80 from 0.0.0.0/0. If you select HTTPS, you must allow inbound traffic over TCP port 443 from 0.0.0.0/0. Manually upload the verification file to the root directory of the origin server that is specified in the console (for example, your ECS, OSS, CVM, COS, or EC2 instance). Note If you add a wildcard domain name, such as *.aliyun.com, you must upload the verification file to the root directory of aliyun.com. After the upload is complete, you can use the following methods to check whether the verification file was successfully uploaded. Return to the WAF console and click Verify. If Verification Successful is displayed, the domain name ownership is verified. If Verification Failed is displayed, troubleshoot the issue based on the error message. Note A wildcard domain name matches all subdomains at the asterisk's immediate level. For example, *.aliyundoc.com matches www.aliyundoc.com and example.aliyundoc.com, but not www.example.aliyundoc.com. A second-level wildcard domain name does not match the corresponding apex domain. For example, *.aliyundoc.com does not match aliyundoc.com. Similarly, a multi-level wildcard domain name does not match its base domain. For example, *.example.aliyundoc.com cannot match example.aliyundoc.com. If protection is configured for both an exact domain name and a wildcard domain name that matches the exact domain name, the protection rules and forwarding configurations for the exact domain name take precedence.
   Protection Resource	Select the type of protection resource to use. The following options are available: Public Cluster: This option is selected by default. Exclusive Cluster: This option is available if you use an Exclusive Edition WAF instance. An exclusive cluster supports customized business requirements. For more information, see Best practices for exclusive clusters. Hybrid Cloud Cluster: Select this option if you use a hybrid cloud deployment. For more information, see Add a website to WAF (Hybrid Cloud WAF).
   Protocol Type	Select the protocol that the website uses. The following options are available: HTTP HTTPS Important If the website supports HTTPS encryption, select HTTPS. After you add the domain name, upload the certificate and private key file for the domain name. For more information, see Upload an HTTPS certificate. If you select HTTPS, you can also enable the following features: (Advanced settings) Enable HTTPS Routing This feature automatically redirects all client HTTP requests to HTTPS. WAF then forwards the requests to the origin server over port 443. Important You can enable this setting only if the HTTP protocol is not selected. Make sure that your website supports HTTPS before you enable this setting. After you enable this setting, some browsers are forced to use HTTPS to access the website. (Advanced settings) Enable HTTP Back-to-Origin With HTTP origin fetch, WAF forwards all requests to the origin server by using HTTP, regardless of the client's protocol. This allows you to terminate HTTPS at WAF, which can reduce the load on your origin server. Important If your website does not support origin fetch over HTTPS, you must enable this setting. (Advanced settings) Neither Enable HTTPS Routing nor Enable HTTP Back-to-Origin is enabled WAF forwards requests to the origin server by using the same protocol that the client used to access WAF (HTTP for port 80, HTTPS for port 443). Enable Origin SNI Origin Server Name Indication (SNI) allows WAF to specify the requested hostname in the TLS handshake when connecting to your origin server. Enable this if your origin server uses a single IP address to host multiple websites (virtual hosts). After you select Enable Origin SNI, you can specify the value of the SNI extension field. The following options are available: Use Domain Name in Host Header (Default): The value of the SNI extension field in the origin fetch request from WAF is the same as the value of the Host field in the request header. For example, if you configure the website domain name as *.aliyundoc.com and a client requests www.aliyundoc.com (which is the Host field value), the value of the SNI extension field in the origin fetch request from WAF is www.aliyundoc.com. Custom: You can customize the value of the SNI extension field in the origin fetch request from WAF. In most cases, you do not need to customize the SNI. You may need to do this only if your business has special requirements and you want WAF to use an SNI in the origin fetch request that is different from the Host of the actual request. HTTP2 (This option is available only after you select HTTPS.) If your website supports HTTP/2, you must enable this setting. The port for HTTP/2 is the same as the port for HTTPS. After you enable this setting, you need to only set the HTTPS port. For more information, see WAF FAQ. Note Only Enterprise, Ultimate, and Exclusive editions of WAF instances support HTTP2.
   Server Address	Specify the address of your origin server. You can specify an IP address or a Domain Name (Such as CNAME). WAF forwards filtered requests to this address. IP address: Enter the public IP address of the origin server. The IP address must be accessible over the internet. You can enter multiple IP addresses. Press the Enter key after you enter each IP address. You can add up to 20 origin IP addresses. Note If you specify multiple IP addresses, WAF automatically performs health checks and load balancing among these addresses. WAF instances Outside Chinese mainland support only IPv4 addresses. WAF instances in the Chinese mainland support the following configurations: Specify both IPv4 and IPv6 addresses If you enable Use the Same Protocol, requests from IPv6 addresses are forwarded to IPv6 origin servers, and requests from IPv4 addresses are forwarded to IPv4 origin servers. If you do not enable Use the Same Protocol, requests are forwarded to both IPv4 and IPv6 origin servers. This means that both IPv4 and IPv6 requests may be forwarded to IPv4 or IPv6 origin servers. Important If you use origin fetch over IPv6, you must make sure that the IPv6 Status of the domain name in the Website Access list is Enabled. For more information, see Enable IPv6 protection. Specify only IPv4 addresses Both IPv4 and IPv6 requests are forwarded over IPv4. WAF forwards requests to the IPv4 origin server addresses that you specify. Specify only IPv6 addresses Both IPv4 and IPv6 requests are forwarded over IPv6. WAF forwards requests to the IPv6 origin server addresses that you specify. How to specify a server IP address If the origin server is on Alibaba Cloud, enter the public IP address of the ECS instance. If a Server Load Balancer (SLB) instance is deployed in front of the ECS instance, enter the public IP address of the SLB instance. If the origin server is in a data center not hosted on Alibaba Cloud or on a third-party cloud service, we recommend that you run the PING command to query the public IP address of the domain name and then enter the public IP address. The specified IP address is not used to route traffic in transparent proxy mode. Domain Name (Such as CNAME): Enter the origin domain name of the server, such as the CNAME of an Object Storage Service (OSS) bucket. If you specify a domain name, origin fetch over IPv4 is supported. WAF forwards client requests to the IPv4 address that is resolved from the origin domain name. Important The origin domain name of the server cannot be the same as the domain name of the website that you want to protect. If the address of your origin server is an OSS domain name, you must go to the OSS console to attach a custom domain name to the OSS domain name after you add the website. For more information, see Attach a custom domain name.
   Destination server port	Add the service ports that the website uses for forwarding. WAF only accepts and forwards traffic on the ports you specify. Requests to other ports are dropped and will not reach your origin server. Important The specified Protocol Type and Destination server port must match the protocol and port your origin server is listening on. Port translation is not supported. Default ports: HTTP: Port 80 is used by default if you select the HTTP protocol. HTTPS or HTTP2: Port 443 is used by default if you select the HTTPS protocol. Custom ports: In the HTTP Port or HTTPS Port text box, enter a port and press the Enter key. Click View Port Range to query all supported ports. Note WAF Ultimate and Exclusive instances support up to 50 server ports, including ports 80, 8080, 443, and 8443. WAF Pro and Enterprise instances support up to 10 server ports. For more information about the ports that are supported by a public cluster, see Ports supported by WAF. If you want to add a website to a WAF exclusive cluster, you can select custom ports only from the Destination Server Port range that is specified on the Exclusive Cluster Configurations page. For more information, see Configure an exclusive cluster.
   Load Balancing Algorithm	If you specify multiple origin server addresses, select a load balancing algorithm. The following options are available: IP hash: Requests from the same client IP address are forwarded to the same origin server. Use this for applications that require session persistence (sticky sessions). Note that this may cause uneven load distribution. Round-robin (Default): Requests from clients are sequentially forwarded to origin servers in the list of origin servers. This algorithm is suitable for scenarios in which multiple origin servers are used and an even distribution of load among the origin servers is required. Least time: The intelligent DNS resolution feature and the upgraded least-time origin fetch algorithm are used to minimize the latency of the entire link, from when service traffic is routed to a protection node to when the traffic is forwarded to an origin server. Note The least time algorithm is available only after you enable intelligent load balancing. For more information, see Intelligent load balancing. After the settings take effect, WAF distributes origin fetch requests to multiple origin server addresses based on the specified load balancing algorithm to implement load balancing.
   Is a Layer 7 proxy such as Anti-DDoS Proxy or CDN deployed in front of WAF	If no other proxy service is used, select No This indicates that WAF receives requests directly from clients, not from other proxy services. In this case, WAF uses the IP address that establishes a connection with WAF (from the REMOTE_ADDR field of the request) as the client IP address. If another proxy service is used, select Yes This indicates that WAF receives service requests forwarded from another Layer 7 proxy instead of directly from clients. To ensure that WAF can obtain the real client IP addresses for security analysis, you must also configure the Obtain Actual IP Address of Client. The following options are available: (Default) Use the First IP Address in X-Forwarded-For Field as Actual IP Address of Client By default, WAF prioritizes reading the X-Real-IP header field of the request to identify the client IP address. If the X-Real-IP field does not exist, WAF reads the first IP address from the X-Forwarded-For (XFF) field as the client IP address. [Recommended] Use the First IP Address in Specified Header Field as Actual IP Address of Client to Prevent X-Forwarded-For Forgery If your website service is configured to place the client's originating IP address in a custom header field (such as X-Real-IP or X-Client-IP) through another proxy service, select this option and enter the corresponding header field in the Header Field box. Note We recommend that you use a custom header to store the client IP address and configure the corresponding header field in WAF. This method can prevent attackers from forging the XFF field to bypass WAF detection rules and enhance business security. You can enter multiple header fields. Press the Enter key after you enter each header field. If you set multiple headers, WAF tries to read the client IP address in order. If the first header does not exist, it reads the second, and so on. If none of the specified headers exist, WAF first tries to read the X-Real-IP field. If that also fails, it uses the first IP address in the X-Forwarded-For (XFF) header as the client IP address.
   Enable Traffic Mark	Specifies whether to enable the traffic mark feature for WAF. This feature adds a custom header to requests that WAF forwards to your origin server. This header can identify that the request was processed by WAF and can include information such as the client's originating IP address. After you select Enable Traffic Mark, you must set the mark fields. Important Do not enter standard HTTP header fields, such as User-Agent. Otherwise, the values of the standard header fields are overwritten by the custom field values. If an attacker obtains the origin IP address before the domain name is added to WAF and purchases another WAF instance to forward requests to the origin server, you can Enable Traffic Mark and set mark fields. When the origin server receives a request, we recommend that you check this field. If the specified mark field exists, access is allowed. The following types of mark fields are available: Custom Header By configuring a Header Name and a Header Value, you can enable WAF to add this header information to origin fetch requests. This marks requests that are forwarded by WAF, distinguishing them from requests that are not, which facilitates backend service analysis. For example, you can use ALIWAF-TAG: Yes to mark requests that are forwarded by WAF. In this example, ALIWAF-TAG is the header name and Yes is the header value. Originating IP Address By configuring a header name, you can instruct WAF to pass the client's originating IP address to the origin server in that header. For more information about the rules that WAF uses to determine the originating IP address of a client, see the description of the Is a Layer 7 proxy such as Anti-DDoS Proxy or CDN deployed in front of WAF parameter. Source Port By configuring a header name, you can instruct WAF to pass the client's source port to the origin server in that header. Click Add Mark to add a mark field. You can set up to five mark fields.
   Back-to-origin Timeout Configuration	Set the timeout for WAF to fetch data from the origin server Connection Timeout Period: The timeout period for WAF to establish a connection with the origin server. The default value is 5s. The value can range from 1s to 3600s. Read Connection Timeout Period: The maximum time WAF will wait for a response from the origin server after establishing a connection. The default value is 120s. The value can range from 1s to 3600s. Write Connection Timeout Period: The timeout period for WAF to send a request to the origin server. The default value is 120s. The value can range from 1s to 3600s. Note This feature is supported only by Pro, Enterprise, Ultimate, and Exclusive editions of WAF. This feature is not supported by Hybrid Cloud WAF instances. Retry on 5XX Error When enabled, WAF retries a failed request to an origin server up to three times. Origin Keep-alive If you enable this feature, you must also configure the following parameters: Max Requests per Connection: The default value is 1,000. The value can range from 60 to 1,000. Idle Timeout: The default value is 15s. The value can range from 1s to 60s. Note If you disable this feature, persistent connections for origin fetch do not support the WebSocket protocol.
   Resource Group	From the resource group list, select the resource group to which the domain name belongs. Note You can use Resource Management to create resource groups and manage cloud resources based on dimensions such as business departments and projects. For more information, see Create a resource group.

5. If the wildcard domain name corresponding to the domain name that you entered in Step 4 has been configured by another user, you must configure a TXT record according to the record type, domain name, and record value provided in the Note dialog box.

   For example, if you use Alibaba Cloud DNS, you can log on to the Alibaba Cloud DNS console and configure a TXT record based on the information in the Note dialog box. For more information, see Add a DNS record.

6. Change the DNS record.

   Follow the on-screen prompts to change the DNS record of the domain name to point it to WAF for protection. Then, click Next. For more information, see Change the DNS record of a domain name.

7. Complete the process.

   Follow the on-screen prompts to add the back-to-origin IP addresses of WAF to the allowlist. Then, click Complete. Return to Domain Name List to return to the Website Access page. For more information, see Add the back-to-origin IP addresses of WAF to an allowlist.

Upload an HTTPS certificate

If you selected HTTPS for Protocol Type in Step 4, you must upload the domain name's HTTPS certificate to the WAF console. The certificate must be correct and valid for WAF to protect HTTPS requests to your website.

You can use one of the following methods to upload an HTTPS certificate:

• Manually upload a certificate: You must prepare your website's certificate file and private key file in advance.

  The following content is required. When you upload the certificate, make sure that it has a complete certificate chain:

  • *.crt (public key file) or *.pem (certificate file)

  • *.key (private key file)

• Select an existing certificate: You can select the domain name's certificate from your existing certificates in Digital Certificate Management Service. For more information, see Digital Certificate Management Service.

• Apply for a new certificate.

1. Log on to the Web Application Firewall (WAF) console. In the top menu bar, select the resource group and region for your WAF instance: Chinese Mainland or Outside Chinese Mainland.

2. In the left navigation pane, choose Asset Center > Website Access.

3. In the Domain Names list, find the domain name that you want to manage and click the icon in the Origin Server column.

   Note

   The icon appears in the Origin Server column only if you selected HTTPS as the protocol type when you added the domain name.

4. In the Upload Certificate (or Update Certificate) dialog box, select an Upload Method and upload an HTTPS certificate.

   Note

   If you have already uploaded a certificate, the Update Certificate dialog box is displayed. The configurations in the Update Certificate dialog box are the same as those in the Upload Certificate dialog box.

   • Manual Upload: Enter a Certificate Name. Then, copy the content of the domain name's certificate file and private key file and paste the content into the Certificate File and Private Key text boxes.

     The following items describe the Certificate File parameter:

     • If the certificate is in the PEM, CER, or CRT format, you can use a text editor to open the certificate file and copy the content.

     • If the certificate is in a format other than PEM, CER, or CRT, such as PFX or P7B, you must convert the certificate file to the PEM format. Then, you can use a text editor to open the file and copy the content. For more information about how to convert certificate formats, see Convert an HTTPS certificate to the PEM format.

     • Make sure that you upload a complete certificate chain. If the domain name has multiple certificate files, you must combine the content of the files and then paste the combined content into the Certificate File text box.

   • Select Existing Certificate: From the Certificate list, select the certificate that you want to upload.

     The Certificate list displays certificates issued by Digital Certificate Management Service. You can select a certificate for the current domain name from the list. Click Digital Certificate Management Service to go to the service's console and manage your certificates.

   • Purchase Certificate: Click Purchase Now to go to the Purchase Certificate page of Digital Certificate Management Service and apply for a certificate for the domain name.

     After you follow the on-screen prompts to configure a certificate for the domain name, the certificate is automatically uploaded to WAF.

     Note

     You can apply for only paid DV certificates. If you want to apply for other types of certificates, go to the SSL certificate purchase page. For more information, see Purchase a commercial certificate.

5. Click OK.

Next steps

After you add the domain name, WAF starts protecting your website traffic. You must also complete the following configurations to enhance your website's protection.

Related operations

View and manage added domain names

After you add a domain name, you can view it in the Domain Names list on the Website Access page. From there, you can perform the following operations as needed:

• Upload an HTTPS certificate: If your domain name supports HTTPS, make sure that you upload the correct certificate and private key to WAF. This ensures that WAF can protect HTTPS traffic. In the Origin Server column, you can click to upload the HTTPS certificate and private key for the domain name.

  For more information, see Upload an HTTPS certificate.

• Enable IPv6 protection: To protect IPv6 service traffic for your website, you can turn on the IPv6 switch for the domain name in the Quick Access column.

  For more information, see Enable IPv6 protection.

• Enable Log Service: After you turn on the Log Service switch for the domain name in the Quick Access column, WAF Log Service collects the full logs of your website. You can use these logs for queries, analysis, dashboard displays, and alert configurations. For more information, see Quickly use WAF Log Service.

  Note

  Log Service is a value-added service of WAF. You must activate the service before you can use it. For more information, see Step 1: Activate WAF Log Service.

• Configure protection resources: To configure protection resources for a domain name, click the icon next to Protection Resource in the Quick Access column.

  The following types of protection resources are available:

  • Shared Cluster and Shared IP Address (default)

  • Shared Cluster and Exclusive IP Address: For more information about exclusive IP addresses, see Exclusive IP address for a domain name.

  • Shared Cluster and Intelligent Load Balancing: For more information about global load balancing, see Intelligent load balancing.

  • Exclusive Cluster: For more information about exclusive clusters, see Configure an exclusive cluster.

• View attack monitoring reports: In the Attack Monitoring column, click View Report to go to the Security Report page and view the protection reports for the domain name. For more information, see WAF security reports.

• Set protection policies: In the Actions column, click Configure Protection to go to the Website Protection page. On this page, set protection policies for the Web Security, Bot Management, and Access Control/Throttling modules. For more information, see Overview of website protection settings.

• Edit a domain name: In the Actions column, click Modify to modify website information, such as the protocol type, server address, and server port. You cannot modify the domain name.

• Delete a domain name: In the Actions column, click Delete to delete the domain name.

  Warning

  Before you delete a domain name, change its DNS record to point to the origin IP address of the server. Otherwise, WAF can no longer forward traffic for the domain name after it is deleted.

• After you add a domain name to WAF, make sure that its ICP filing information is valid. To comply with laws and regulations, WAF periodically checks the domain names added to it. If an ICP filing expires and is not renewed in time, the domain name's status changes to "not filed". In this case, WAF automatically stops forwarding traffic for the domain name. You must perform the following operations:

  1. Complete the ICP filing for the domain name.

  2. Go to the Website Access page. On the Domain Names tab, find the domain name with the completed ICP filing and click Add Again in the Actions column.

Manage ICP filings for domain names

After you add a domain name to WAF, make sure that its ICP filing information is valid. WAF periodically checks the domain names added to it. If an ICP filing expires and is not renewed in time, the domain name's status changes to "not filed". In this case, WAF automatically stops forwarding traffic for the domain name. You must perform the following operations:

1. Complete the ICP filing for the domain name.

2. Go to the Website Access page. On the Domain Names tab, find the domain name with the completed ICP filing and click Add Again in the Actions column.

DNS status of a domain

You can view the DNS status of your domain names in the list of added domain names. This helps you identify domain names with DNS resolution risks and modify DNS settings based on the causes of the exceptions displayed in the console.