:Configure traffic redirection ports

Usage notes

• Traffic redirection applies to a specific combination of a server instance and a port. After you configure traffic redirection for a port on a server instance, all traffic on that port is sent to WAF for protection.

  If multiple domain names share a server port, redirecting traffic for any of those domain names redirects traffic to WAF for all domain names on that port. WAF does not support redirecting traffic for only a subset of domain names on a shared port.

  For example, assume that both domain name A and domain name B serve traffic through port 80 on your ECS instance. If you configure traffic redirection for domain name A, traffic for domain name B is also automatically protected by WAF. When you later configure traffic redirection for domain name B, you will find that port 80 is already selected by default from the configuration for domain name A. You can confirm this setting without making changes.

• When you configure a traffic redirection port for an HTTPS website that runs on a Layer 4 SLB instance or an ECS instance, you must upload all SSL certificates associated with the instance and port. Failure to do so may cause service disruptions.

  • If the port uses only one SSL certificate, you must upload only the default certificate.

  • If the port uses multiple SSL certificates, you must upload the default certificate and all extended certificates.

Configuration examples

The following examples describe how to configure traffic redirection ports for different domain names in these scenarios: a single server with multiple domain names that use separate ports, a single server with multiple domain names that use a shared port, and multiple servers with multiple domain names that use a shared port.

• Scenario 1: You have one server instance (server1) and two domain names (domain1 and domain2). Port 80 on server1 listens for traffic to domain1, and port 443 on server1 listens for traffic to domain2.

  In this case, you can configure traffic redirection for each domain name by following these steps:

  1. Add domain1 for WAF protection. In the traffic redirection port configuration, select port 80.

     After the configuration is complete, WAF protects web traffic for domain1 on port 80 of server1.

  2. Add domain2 for WAF protection. In the traffic redirection port configuration, select port 443.

     Note

     Port 80 is selected by default because it was configured for domain1. Do not change this selection.

     After the configuration is complete, WAF also protects web traffic for domain2 on port 443 of server1.

• Scenario 2: You have one server instance (server1) and two domain names (domain1 and domain2). Port 80 on server1 listens for traffic to both domain1 and domain2.

  In this case, you can configure traffic redirection for each domain name by following these steps:

  1. Add domain1 for WAF protection. In the traffic redirection port configuration, select port 80.

     After the configuration is complete, WAF protects all web traffic for both domain1 and domain2 on port 80 of server1.

     At this point, only domain1 appears in the domain name list. You can then configure specific protection policies for domain1 and view its related data. Traffic for domain2 is protected only by the default WAF protection policy.

  2. Add domain2 for WAF protection. In the traffic redirection port configuration, port 80 is selected by default. You can confirm the setting without making any changes.

     After the configuration is complete, domain2 appears in the domain name list. You can now configure specific protection policies for domain2 and view its related data.

• Scenario 3: You have two server instances (server1 and server2) and three domain names (domain1, domain2, and domain3). Port 80 on server1 listens for traffic to domain1 and domain2. Port 80 on server2 listens for traffic to domain2 and domain3.

  If you want to configure traffic redirection for domain2, you must select port 80 on server1 and port 80 on server2 in the traffic redirection port configuration.

  After the configuration is complete, WAF protects web traffic on port 80 of server1 (which includes all traffic for domain1 and some traffic for domain2) and web traffic on port 80 of server2 (which includes the rest of the traffic for domain2 and all traffic for domain3).

  At this point, only domain2 appears in the domain name list. This allows you to configure specific protection policies for domain2 and view its related data. The default WAF protection policy protects traffic for domain1 on port 80 of server1 and traffic for domain3 on port 80 of server2.

  If you proceed to add domain1 and domain3 for WAF protection, port 80 on both server1 and server2 are selected by default in the traffic redirection port configuration. You can confirm the settings without making any changes.

  Note

  The pre-selected ports indicate that web traffic for domain2 is already protected by WAF. Do not change this selection.

  After the configuration is complete, domain1 and domain3 appear in the domain name list.

ALB port redirection

Recommended scenario: You have deployed an Application Load Balancer (ALB) instance as the entry point for your web services and want to enable WAF protection for traffic on the instance's listeners.

Prerequisites: In the port configuration section, click the SLB-based Domains tab.

Layer 7 SLB port redirection

Recommended scenario: You have deployed an SLB instance with a Layer 7 HTTP or HTTPS listener as the entry point for your web services and want to enable WAF protection for traffic on the instance's listeners.

Prerequisites: In the port configuration section, click the Layer 7 SLB-based Domains tab.

Enable WAF protection for a listener port: In the WAF console, on the Layer 7 SLB-based Domains tab, select the desired port from the Port Number column. This column lists the available HTTP and HTTPS listener ports.

If the Port Number column displays No Ports Available, no HTTP or HTTPS listeners are created for the instance. You must first go to the SLB console to create an HTTP or HTTPS listener for the instance. Then, you can return to the WAF console to enable WAF protection for the port. For more information, see Add an HTTP listener and Add an HTTPS listener.

Layer 4 SLB port redirection

Recommended scenario: You have deployed an SLB instance with a Layer 4 TCP listener as the entry point for your web services and want to enable WAF protection for traffic on the instance's listeners.

Prerequisites: In the port configuration section, click the Layer 4 SLB-based Domains tab.

Procedure

In this scenario, you must first add the active listener port to WAF before you can enable protection for the port. Follow these steps:

1. Add the existing TCP listener port to WAF.

   Important

   Before you can add a TCP listener port to the WAF console, you must create a TCP listener for the SLB instance in the SLB console. For more information, see Add a TCP listener.

   1. In the WAF console, on the Layer 4 SLB-based Domains tab, click Add in the Port Number column.

   2. In the Add Port dialog box, select an active TCP Port Number and its associated application protocol (HTTP or HTTPS).

   3. Optional: If you select HTTP, skip this step. If you select HTTPS, upload the corresponding default certificate and extended certificates as prompted. You can add up to three extended certificates.

      The certificates are described as follows:

      • Default Certificate: The certificate that the server returns to a client by default when it receives an HTTPS request. If your server uses only one SSL certificate, you must upload only the default certificate.

      • Extended Certificate: The certificate that a server returns to a client after a successful match with the Server Name Indication (SNI) field in the client's HTTPS request. The server checks whether the domain name in the SNI extension matches the domain name of an extended certificate. If no match is found, the server returns the default certificate.

        SNI is an extension to the SSL/TLS protocols that allows a single server to host multiple domain names with different certificates. The client sends the hostname it wants to access before establishing the SSL connection. The server then uses this hostname to return the appropriate certificate.

      You can upload a certificate by using one of the following methods:

      • Manual Upload: You must manually enter the Certificate Name, Certificate File content, and Private Key File content.

      • Select Existing Certificate: Select a certificate from the list of existing certificates in the SSL Certificates Service console.

        If your certificate is not in the list, click SSL Certificates Service to upload it for centralized management. Then, you can select it from the list.

2. Enable protection for the added port. In the WAF console, on the Layer 4 SLB-based Domains tab, select the port from the list of added ports in the Port Number column.

   Once you select a port, its traffic is redirected to WAF for inspection and protection. Traffic on unselected ports goes directly from clients to the origin server, bypassing WAF.

   Important

   If a single port listens for traffic for multiple domain names, selecting that port enables WAF protection for all of those domain names by default. You cannot enable protection for only a specific domain name on that port.

ECS port redirection

Recommended scenario: You use an ECS instance as the entry point for your web services and want to enable WAF protection for its HTTP or HTTPS traffic.

Prerequisites: In the port configuration section, click the ECS-based Domains tab.

Procedure

In this scenario, you must add the port to WAF before you can enable its protection. Follow these steps:

1. Add the port that you want to protect to WAF.

   1. In the WAF console, on the ECS-based Domains tab, click Add in the Port Number column.

   2. In the Add Port dialog box, set Port Number to the HTTP or HTTPS application port on the origin ECS instance, and select the corresponding protocol (HTTP or HTTPS).

   3. Optional: If you select HTTP, skip this step. If you select HTTPS, upload the corresponding default certificate and extended certificates as prompted. You can add up to three extended certificates.

      The certificates are described as follows:

      • Default Certificate: The certificate that the server returns to a client by default when it receives an HTTPS request. If your server uses only one SSL certificate, you must upload only the default certificate.

      • Extended Certificate: The certificate that a server returns to a client after a successful match with the Server Name Indication (SNI) field in the client's HTTPS request. The server checks whether the domain name in the SNI extension matches the domain name of an extended certificate. If no match is found, the server returns the default certificate.

        SNI is an extension to the SSL/TLS protocols that allows a single server to host multiple domain names with different certificates. The client sends the hostname it wants to access before establishing the SSL connection. The server then uses this hostname to return the appropriate certificate.

      You can upload a certificate by using one of the following methods:

      • Manual Upload: You must manually enter the Certificate Name, Certificate File content, and Private Key File content.

      • Select Existing Certificate: Select a certificate from the list of existing certificates in the SSL Certificates Service console.

        If your certificate is not in the list, click SSL Certificates Service to upload it for centralized management. Then, you can select it from the list.

2. Enable protection for the added port. In the WAF console, on the ECS-based Domains tab, select the port from the list of added ports in the Port Number column.

   Once you select a port, its traffic is redirected to WAF for inspection and protection. Traffic on unselected ports goes directly from clients to the origin server, bypassing WAF.

   Important

   If a single port listens for traffic for multiple domain names, selecting that port enables WAF protection for all of those domain names by default. You cannot enable protection for only a specific domain name on that port.