Web Application Firewall:Website onboarding

Prerequisites

• You have purchased a WAF instance, and the number of domain names that it supports does not exceed the limit.

  Note

  The total number of domain names that you can add to a WAF instance varies based on the specifications of the instance and the number of extra domain packages that you purchased. For more information, see extra domain package.

• If you purchased a WAF instance for the Chinese mainland, you must complete ICP filing for your domain name before you add the domain name to WAF. Otherwise, WAF cannot protect your website, and you may receive an error message that prompts you to complete ICP filing.

• You have deployed an on-premises WAF protection node cluster with public network connectivity. For more information, see Deploy a hybrid cloud WAF protection cluster.

Limitations

If you use hybrid cloud WAF protection nodes to protect internal network services, clients cannot use IP addresses in the 172.16.0.0/16 CIDR block to access these services.

Hybrid cloud website onboarding

1. Log on to the Web Application Firewall (WAF) console. In the top menu bar, select the resource group and region for your WAF instance: Chinese Mainland or Outside Chinese Mainland.

2. In the left navigation pane, choose Asset Center > Website Access.

3. On the Domain Names tab, click Website Access.

   Note

   On the Add Domain Name page, the Access Mode is set to CNAME Record by default.

4. Enter the website information and click Next.

   Parameter	Description
   Domain Name	Enter the domain name that you want to protect. You can enter a specific domain name, such as www.aliyundoc.com, or a wildcard domain name, such as *.aliyundoc.com. You can enter only one domain name. If this is the first time you are adding this domain name, you must verify your domain name ownership before you can proceed. How to verify domain name ownership To proceed, you must verify your ownership of the domain name. You can choose one of the following two methods: DNS verification: Manually add the TXT record provided by WAF at your DNS provider. This method is recommended. File verification: Upload the verification file provided by WAF to the specified root directory of the domain name's origin server. You must have permissions to access the origin server. DNS verification In the verification section, click the Method 1: DNS Record tab. Add a TXT record at your DNS provider by using the Record Type, Hostname, and Record Value provided in the WAF console. If you use Alibaba Cloud DNS, follow these steps. If you use another DNS provider, follow the equivalent steps for that service. Log on to the Alibaba Cloud DNS console. On the Public Zone page, find the target primary domain name and click Settings in the Actions column. Click Add Record. Enter the Record Type, Hostname, and Record Value, and then click OK. Leave the other parameters at their default values. After the record is added, you can view it in the record list. The record takes effect by default, and its Status is Enabled. Wait for the TXT record to take effect. A new TXT record takes effect immediately. However, if you modify a TXT record, the change typically takes about 10 minutes to propagate, depending on the TTL setting of your DNS record (the default TTL is 10 minutes). Return to the WAF console and click Verify. If Verification successful is displayed, your domain name ownership is verified. If Verification failed is displayed, follow these steps to troubleshoot: Check the TXT record: Ensure the host record and record value match the information provided in the WAF console. If they are different, delete the incorrect record, add it again, and retry the verification. Wait for DNS propagation: DNS records may not take effect immediately. The propagation time depends on the TTL cache time set on your DNS server. We recommend waiting 10 minutes before you try to verify again. Change the verification method: If verification continues to fail after multiple attempts, we recommend using "Method 2: File Verification". File verification In the verification section, click the Method 2: Verification File tab. Download the verification file by clicking the provided link. Upload the file to the root directory of your domain name's origin server. In the WAF console, select the protocol type (HTTP or HTTPS), confirm the access path is correct, check the Uploaded box, and then click Click To Verify. Important The verification file expires three days after it is downloaded. If you do not complete the verification within this period, you must download a new file. Do not open, edit, rename, or perform any other operations on the verification file. WAF accesses your origin server based on the protocol type you select. Make sure that the corresponding security group or firewall rules are configured on the origin server: If you select HTTP, you must allow inbound traffic on TCP port 80 from 0.0.0.0/0. If you select HTTPS, you must allow inbound traffic on TCP port 443 from 0.0.0.0/0. Manually upload the verification file to the web root directory of your domain name's origin server, such as an Elastic Compute Service (ECS) instance, Object Storage Service (OSS) bucket, CVM, COS, or EC2 instance. Note If you add a wildcard domain name, such as *.aliyun.com, you must upload the verification file to the root directory of aliyun.com. Nginx server default root directory: /usr/share/nginx/html IIS server default root directory: C:\inetpub\wwwroot Return to the WAF console and click Verify. If Verification successful is displayed, your domain name ownership is verified. If Verification failed is displayed, troubleshoot the issue based on the error message. Note A wildcard domain name can match subdomains at the same level and at different levels. For example, *.aliyundoc.com can match multi-level domain names such as www.aliyundoc.com, example.aliyundoc.com, and www.example.aliyundoc.com. A second-level wildcard domain name can match the corresponding second-level primary domain name. For example, *.aliyundoc.com can match aliyundoc.com. A third-level wildcard domain name cannot match the corresponding third-level primary domain name. For example, *.example.aliyundoc.com cannot match example.aliyundoc.com. If a protected object contains both a specific domain name and a wildcard domain name that can match the specific domain name, the protection rules and forwarding configurations of the specific domain name take precedence.
   Protection Resource	Select the type of resource that WAF will protect. In this case, select Hybrid Cloud Cluster.
   Protocol Type	Select the protocol that your website uses. Options include: HTTP HTTPS Important If your website supports HTTPS encryption, select HTTPS. After you add the domain name, you must upload its SSL certificate and private key. For more information, see Upload an HTTPS certificate. After you select HTTPS, you can also enable the following features: (Advanced) Enable HTTPS Routing This feature automatically redirects client HTTP requests to HTTPS. When enabled, any client request made over HTTP is redirected to HTTPS (port 443). WAF then forwards the secure request to the origin server over port 443. Enable this feature to enforce HTTPS for enhanced security. Important You can enable this setting only if the HTTP protocol is not selected. Ensure your website supports HTTPS before enabling this setting. After you enable it, some browsers will be forced to use HTTPS to access the website. (Advanced) Enable HTTP Back-to-Origin HTTP origin fetch means WAF uses the HTTP protocol to forward requests to the origin server, typically on port 80. When this feature is enabled, WAF forwards requests to the origin server over port 80, regardless of whether clients access WAF over port 80 or 443. This allows you to implement HTTPS access through WAF without modifying your origin server, which offloads SSL/TLS processing from your origin server. Important If your website does not support HTTPS for origin fetch, you must enable this setting. (Advanced) Neither Enable HTTPS Routing nor Enable HTTP Back-to-Origin is enabled If a client accesses WAF over port 80, WAF forwards the request to the origin server over port 80. If a client accesses WAF over port 443, WAF forwards the request to the origin server over port 443. Enable Origin SNI Origin SNI (Server Name Indication) allows WAF to specify the hostname for the TLS handshake with the origin server. This is necessary if your origin server hosts multiple virtual sites (each with a different domain name) on a single IP address. After you select Enable Origin SNI, you can specify the value for the SNI field. Options include: Use Domain Name in Host Header (Default): WAF uses the value of the Host header from the client request as the SNI value in its request to the origin server. For example, if you configure the website domain name as *.aliyundoc.com and a client requests www.aliyundoc.com (that is, the value of the Host header), the SNI value in the WAF origin fetch request will be www.aliyundoc.com. Custom: Specify a custom SNI value for WAF to use in its request to the origin server. You typically do not need to customize the SNI unless your service has special configuration requirements where the SNI must be different from the actual request Host header. HTTP2 (This option is available only if HTTPS is selected.) Enable this setting if your website supports the HTTP/2 protocol. The port for HTTP/2 is the same as the port for HTTPS. After you enable this setting, you only need to set the HTTPS port. For more information, see WAF FAQ. Note Only the Enterprise, Ultimate, and Exclusive editions of WAF support HTTP2.
   Node Settings	Select a Name of Protected Node Group. If your website is deployed on multiple protection nodes, you can click Add Node for Protection next to Node Settings to add all nodes to WAF for protection.
   Server Address	Specify the address of your origin server. You can specify an IP address or a Domain Name (Such as CNAME). WAF forwards filtered requests to this address. IP address: Enter the public IP address of the origin server. The IP address must be accessible over the internet. You can enter multiple IP addresses. Press the Enter key after you enter each IP address. You can add up to 20 origin IP addresses. Note If you specify multiple IP addresses, WAF automatically performs health checks and load balancing among these addresses. WAF instances Outside Chinese mainland support only IPv4 addresses. WAF instances in the Chinese mainland support the following configurations: Specify both IPv4 and IPv6 addresses If you enable Use the Same Protocol, requests from IPv6 addresses are forwarded to IPv6 origin servers, and requests from IPv4 addresses are forwarded to IPv4 origin servers. If you do not enable Use the Same Protocol, requests are forwarded to both IPv4 and IPv6 origin servers. This means that both IPv4 and IPv6 requests may be forwarded to IPv4 or IPv6 origin servers. Important If you use origin fetch over IPv6, you must make sure that the IPv6 Status of the domain name in the Website Access list is Enabled. For more information, see Enable IPv6 protection. Specify only IPv4 addresses Both IPv4 and IPv6 requests are forwarded over IPv4. WAF forwards requests to the IPv4 origin server addresses that you specify. Specify only IPv6 addresses Both IPv4 and IPv6 requests are forwarded over IPv6. WAF forwards requests to the IPv6 origin server addresses that you specify. How to specify a server IP address If the origin server is on Alibaba Cloud, enter the public IP address of the ECS instance. If a Server Load Balancer (SLB) instance is deployed in front of the ECS instance, enter the public IP address of the SLB instance. If the origin server is in a data center not hosted on Alibaba Cloud or on a third-party cloud service, we recommend that you run the PING command to query the public IP address of the domain name and then enter the public IP address. The specified IP address is not used to route traffic in transparent proxy mode. Domain Name (Such as CNAME): Enter the origin domain name of the server, such as the CNAME of an Object Storage Service (OSS) bucket. If you specify a domain name, origin fetch over IPv4 is supported. WAF forwards client requests to the IPv4 address that is resolved from the origin domain name. Important The origin domain name of the server cannot be the same as the domain name of the website that you want to protect. If the address of your origin server is an OSS domain name, you must go to the OSS console to attach a custom domain name to the OSS domain name after you add the website. For more information, see Attach a custom domain name.
   Destination server port	Add the forwarding service ports that the website uses. Note Currently, this can be configured only by Alibaba Cloud technical support. The ports must be within the range of enabled ports for the hybrid cloud cluster. By default, ports 80, 8080, 443, and 8443 are enabled for a hybrid cloud cluster. You can specify a custom port range when you create a hybrid cloud cluster. For more information, see Configure basic information for a hybrid cloud cluster. WAF uses the ports added here to receive and forward traffic for the website. Traffic for the domain name is forwarded only through these added ports. Requests to other ports are not forwarded to the origin server, which prevents them from posing a security threat. Important The Protocol Type and destination server port must match the protocol and port that your origin server uses for its web service. Port mapping is not supported. For example, if your origin server provides web services over HTTP on port 80, the domain name configuration must also be set to HTTP on port 80. If you set a different port, requests cannot be forwarded correctly. Default ports: If you set Protocol Type to HTTP, the server port defaults to HTTP 80. If you set Protocol Type to HTTPS, the server port defaults to HTTPS 443. Note The port for HTTP/2 is the same as the port for HTTPS. Custom ports: Click Custom and specify the ports for HTTP or HTTPS. Separate multiple ports with commas (,). Click View Port Range to see all available ports.
   Load Balancing Algorithm	If you specify multiple origin server addresses, select a load balancing algorithm. The following options are available: IP hash: Requests from the same client IP address are forwarded to the same origin server. Use this for applications that require session persistence (sticky sessions). Note that this may cause uneven load distribution. Round-robin (Default): Requests from clients are sequentially forwarded to origin servers in the list of origin servers. This algorithm is suitable for scenarios in which multiple origin servers are used and an even distribution of load among the origin servers is required. Least time: The intelligent DNS resolution feature and the upgraded least-time origin fetch algorithm are used to minimize the latency of the entire link, from when service traffic is routed to a protection node to when the traffic is forwarded to an origin server. Note The least time algorithm is available only after you enable intelligent load balancing. For more information, see Intelligent load balancing. After the settings take effect, WAF distributes origin fetch requests to multiple origin server addresses based on the specified load balancing algorithm to implement load balancing.
   Is a Layer 7 proxy such as Anti-DDoS Proxy or CDN deployed in front of WAF	No other proxy service. Select No (default). This indicates that the business requests received by WAF are directly initiated by clients, not forwarded by other proxy services. In this scenario, WAF directly obtains the IP address that establishes the connection with WAF (from the REMOTE_ADDR field of the request) as the client IP address. Another proxy service exists. Select Yes. This indicates that the business requests received by WAF are forwarded from other Layer 7 proxy services, not directly initiated by clients. To ensure that WAF can obtain the real client IP addresses for security analytics, you must further set the Obtain Source IP Address. Options: (Default) Use the First IP Address in X-Forwarded-For Field as Actual IP Address of Client By default, WAF preferentially reads the X-Real-IP request header field as the client IP address. If the X-Real-IP field does not exist, WAF reads the first IP address in the X-Forwarded-For (XFF) field as the client IP address. [Recommended] Use the First IP Address in Specified Header Field as Actual IP Address of Client to Prevent X-Forwarded-For Forgery If your website service is configured through other proxy services to place the originating IP address of the client in a custom header field (such as X-Real-IP or X-Client-IP), you must select this option and enter the corresponding header field in the Header Field box. Note We recommend that you use a custom header to store client IP addresses in your service and configure the corresponding header field in WAF. This method can prevent attackers from forging the XFF field to evade WAF detection rules and improve the security of your business. You can enter multiple header fields. Press the Enter key after you enter each header field. If you set multiple headers, WAF attempts to read the client IP address in sequence. If the first header does not exist, WAF reads the second, and so on. If none of the specified headers exist, WAF first attempts to read the X-Real-IP field. If no result is found, WAF uses the first IP address in the X-Forwarded-For (XFF) header as the client IP address.
   Enable Traffic Mark	Enable Traffic Tagging Enabling traffic marking helps your origin server identify requests that have passed through WAF and obtain the originating client IP or port. You can configure the following types of marking fields: Custom Header By configuring a Header Name and Header Value, you can have WAF add this header to its requests to the origin server. This allows you to mark requests that have passed through WAF, which is useful for backend traffic analysis. For example, you can use ALIWAF-TAG: Yes to mark requests, where ALIWAF-TAG is the header name and Yes is the header value. Originating IP Address By specifying a header name, you can instruct WAF to record the originating client IP in that header and forward it to the origin server. For details on how WAF determines the originating client IP, see the description for the Is a Layer 7 proxy such as Anti-DDoS Proxy or CDN deployed in front of WAF parameter. Source Port By specifying a header name, you can instruct WAF to record the originating client port in that header and forward it to the origin server. Important Do not use standard HTTP header fields such as User-Agent. If you do, the custom value will overwrite the original header's content. Click Add Tag to add another marking field. You can add up to five marking fields.
   Resource Group	From the resource group list, select the resource group to which the domain name belongs. Note You can use Resource Management to create resource groups and manage cloud resources based on dimensions such as business departments and projects. For more information, see Create a resource group.

5. Modify your local hosts file to point the domain name to the on-premises WAF's load balancer, then test to verify that traffic is correctly routed through WAF.

   Note

   Currently, this operation can be performed only by Alibaba Cloud technical support.

6. Update the DNS record of the domain name to point to the on-premises load balancing server.

7. Click Complete. Return to Domain Name List.

   Your domain name is now protected by hybrid cloud WAF.