All Products
Search

This Product

    Web Application Firewall:Configure origin server protection

    Document Center

    Web Application Firewall:Configure origin server protection

    Last Updated:Jun 08, 2026

    If the origin server IP address is exposed, attackers can bypass WAF and reach the origin directly. Configure access control on the origin server to allow only WAF back-to-origin CIDR blocks.

    This topic uses an Elastic Compute Service (ECS) instance behind a Server Load Balancer (SLB) instance as an example.

    Note

    • Traffic forwarding starts when the website is added to WAF, regardless of origin server protection settings.

    • If the ECS and SLB instances are added to WAF in Transparent Proxy Mode, all redirection port traffic routes through WAF automatically, making origin server protection unnecessary.

    Risks of origin server access control

    Incorrect access control policies can disrupt services:

    • All hosted domains must be added to WAF. Any unprotected domain on the ECS or SLB instance can be exploited to bypass WAF and compromise other domains on the same server.

    • WAF cluster failover bypasses access control. During failover, traffic goes directly to the origin. If security group rules or SLB whitelists allow only WAF traffic, the origin becomes unreachable.

    • Back-to-origin CIDR blocks change over time. WAF periodically updates its back-to-origin CIDR blocks. If new blocks are not added to security group rules or SLB whitelists, HTTP 5XX errors may occur. Check the WAF console regularly and update policies accordingly.

    • Remove access control policies before decommissioning WAF. Delete all origin server access control policies before switching traffic back to the origin. Otherwise, traffic cannot reach the origin.

    Prerequisites

    Ensure the following:

    Check if the origin server IP is exposed

    From a non-Alibaba Cloud host, use Telnet to connect to the origin server's public IP on its service port.

    • Connection succeeds: The IP address is exposed. Attackers can bypass WAF and access the origin directly.

    • Connection fails: The IP address is not exposed.

    Example: Test connectivity on ports 80 and 8080. If both connections succeed, the IP is exposed.

    Check port connectivity

    Get the WAF back-to-origin CIDR blocks

    Important

    WAF back-to-origin CIDR blocks change periodically. Add new blocks to security group rules and whitelists promptly to prevent service disruptions.

    1. Log on to the WAF console. In the top navigation bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) of the WAF instance.

    2. In the left-side navigation pane, click Onboarding.

    3. On the CNAME Record tab, click Back-to-origin CIDR Blocks.

    4. In the Back-to-origin CIDR Block dialog, click Copy.

    Configure ECS security group rules

    Create two security group rules: one to allow inbound WAF back-to-origin traffic, and one to deny all other inbound traffic.

    Open the security group settings

    1. Log on to the ECS console.

    2. In the left-side navigation pane, choose Network & Security > Security groups.

    3. In the upper-left corner of the top navigation bar, select the region of the ECS instance.

    4. Find the target security group and click Manage Rules in the Operation column.

    5. Select a rule direction:

      • Virtual Private Cloud (VPC): Click the Inbound or Outbound tab.

      • Classic network: Click the Inbound, Outbound, Internet Ingress, or Internet Egress tab.

    Add an allow rule for WAF traffic

    1. On the Inbound tab, click Add Rule.

    2. Configure the following parameters and click Save.

      Parameter

      Description

      Authorization policy

      Select Allow.

      Priority

      Enter 1 (highest priority).

      Protocol Type

      Select Custom TCP.

      Port number range

      Select HTTP (80) and HTTPS (443).

      Authorization Object

      Paste the WAF back-to-origin CIDR blocks.

      Description

      Example: Allow inbound traffic from WAF back-to-origin CIDR blocks.
    Important

    If the origin server communicates with other applications on IP addresses and ports outside WAF back-to-origin CIDR blocks and standard HTTP/HTTPS ports, add those addresses and ports to the security group rules as well.

    The allow rule has the highest priority, so all inbound traffic from WAF back-to-origin CIDR blocks is permitted.

    Warning

    Make sure all WAF back-to-origin CIDR blocks are included. Missing CIDR blocks cause access failures.

    Add a deny rule for all other traffic

    1. On the Inbound tab, click Add Rule.

    2. Configure the following parameters and click Save.

      Parameter

      Description

      Authorization policy

      Select Deny.

      Priority

      Enter 100 (lowest priority).

      Protocol Type

      Select Custom TCP.

      Port number range

      Select HTTP (80) and HTTPS (443).

      Authorization Object

      Enter 0.0.0.0/0. This matches all CIDR blocks.

      Description

      Example: Block all inbound traffic.

    After both rules are in place, the ECS instance accepts only inbound traffic from WAF back-to-origin CIDR blocks. All service traffic must pass through WAF.

    Configure SLB access control policies

    If the origin is behind an SLB instance, configure a listener whitelist to allow only WAF traffic.

    This example uses a Classic Load Balancer (CLB) instance. For Application Load Balancer (ALB), follow the Access control instructions instead.

    Create an access control list

    1. Log on to the CLB console.

    2. In the top navigation bar, select the region of the CLB instance.

    3. In the left-side navigation pane, choose Classic Load Balancer (CLB) > Access Control.

    4. On the Access Control page, click Create ACL.

    5. In the Create ACL panel, configure the following parameters and click Create.

      Parameter

      Description

      ACL Name

      Enter a name. Example: WAF back-to-origin CIDR blocks.

      Add Multiple Addresses/CIDR Blocks and Descriptions

      Paste all WAF back-to-origin CIDR blocks, one per line. Replace the commas in the copied list with line breaks before pasting.

    Configure listener whitelists

    1. In the left-side navigation pane, choose CLB > Instances.

    2. On the Instances page, find the target instance and click its ID.

    3. On the Listener tab, find the listener to configure. Click the More icon icon in the Operation column, then click Configure ACL. Select the listener based on the services protected by WAF:

      • HTTP services: Select the HTTP listener.

      • HTTPS services: Select the HTTPS listener.

      • Both HTTP and HTTPS services: Select both listeners.

    4. In the Configure Access Control panel, turn on Enable Access Control and configure the following parameters.

      Parameter

      Description

      Access Control Mode

      Select Whitelist: Allows Specified IP Addresses to Access the ALB Instance to allow only specific IP addresses.

      Select ACL

      Select the ACL created for WAF back-to-origin CIDR blocks.

    After the whitelist is applied, the CLB instance accepts only inbound traffic from WAF back-to-origin CIDR blocks.

    Verify the configuration

    Verify the configuration:

    1. From a non-Alibaba Cloud host, use Telnet to connect to the origin on ports 80 and 8080.

    2. Check the result:

      • Cannot connect on port 80 or 8080, but the service runs normally: Configuration is effective. Direct origin access is blocked and all traffic routes through WAF.

      • Can still connect: Check security group rules and SLB whitelists for missing entries.

    References