WAF uses specific back-to-origin CIDR blocks to forward traffic that passes protection engine checks to the origin server of your website. After your website is added to WAF, you must add the back-to-origin CIDR blocks to the whitelist of the security software on the origin server. This topic describes how to allow access from the back-to-origin CIDR blocks of WAF.
Procedure
-
Log on to the Web Application Firewall (WAF) console. In the top menu bar, select the resource group and region for your WAF instance: Chinese Mainland or Outside Chinese Mainland.
-
In the left navigation pane, choose .
On the Service Information page, find the Back-to-origin CIDR Block section in the lower-right corner and click Copy All IP Addresses.
The Back-to-origin CIDR Block section displays the back-to-origin CIDR blocks of WAF in real time.
Add the back-to-origin CIDR blocks to the whitelist of the security software on the origin server.
WarningIf you do not allow access from the back-to-origin CIDR blocks of WAF on your origin server, normal business requests that WAF forwards to the origin server may be blocked. This may interrupt your business.
What to do next
For security purposes, we recommend that you configure an access control policy on your origin server to allow only inbound traffic from the back-to-origin CIDR blocks of WAF. This prevents attackers from bypassing WAF to directly attack your origin server. For more information, see Configure origin server protection.
FAQ
What are the back-to-origin CIDR blocks of WAF?
The back-to-origin CIDR blocks are the IP address ranges that WAF uses to request your origin server on behalf of clients. After your website is added to WAF, the origin server considers all requests to come from the back-to-origin IP addresses of WAF. The actual client IP address is added to the X-Forwarded-For (XFF) field in the HTTP header.
Why do I need to allow access from the back-to-origin CIDR blocks of WAF?
After your website is added to WAF, request source IP addresses become more concentrated and requests become more frequent. The firewall or security software on your origin server may consider the back-to-origin IP addresses malicious and block them. If the back-to-origin CIDR blocks of WAF are blocked, requests from WAF cannot receive normal responses from the origin server. Therefore, after your website is added to WAF, make sure that your origin server allows all back-to-origin IP addresses of WAF. To allow the IP addresses, add them to the whitelist. Otherwise, your website may fail to open or may open very slowly.