Enable WAF protection for Anti-DDoS Proxy domain names - Web Application Firewall

To protect domain names that are added to Anti-DDoS Proxy from web attacks, you can enable Web Application Firewall (WAF) protection for the domain names. This solution provides low-latency, highly available web security protection without changing the existing network architecture or DNS configurations.

How it works

When a cloud service is added to an Anti-DDoS Proxy domain name, the integration is implemented through SDK integration. The SDK is embedded in the cloud service and is responsible for traffic extraction, detection, and protection. WAF does not participate in traffic forwarding, which avoids compatibility and stability issues caused by introducing additional forwarding layers.

Limitations

If the Anti-DDoS Proxy domain name does not meet the following requirements, use CNAME access.

Account requirement: The Anti-DDoS Proxy domain name and the WAF instance must belong to the same Alibaba Cloud account (except for accounts with multi-account management for enterprises configured).
Domain requirement: The Anti-DDoS Proxy domain name has been associated with an Anti-DDoS Proxy instance.

Procedure

Go to the console:

Log on to the Web Application Firewall 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance (Chinese Mainland). In the left-side navigation pane, click Onboarding. Click the Cloud Native tab. In the cloud service type list on the left side, select Anti-DDoS.
Authorize the cloud service (only for users who have not completed authorization):

Follow the page instructions and click Authorize Now to complete cloud service authorization. You can view the created service-linked role AliyunServiceRoleForWAF on the Identities > Roles page in the RAM console.
Synchronize assets:

If the domain names that are added to Anti-DDoS Proxy are not displayed on the page, click Synchronize Assets in the upper-right corner. If the domain names are still not displayed after synchronization, the domain names do not meet the Limitations.
Configure WAF traffic redirection:

By default, after a domain name that is added to Anti-DDoS Proxy is added to WAF, the system performs security detection on all traffic of the domain name. If you do not need to detect all traffic, click Redirection Configuration in the upper-right corner and select an appropriate traffic redirection mode:
- All-traffic Redirection: Redirects all traffic to WAF, and you can manually exclude specific traffic. This mode is suitable for scenarios where most traffic needs WAF detection.
- Specific-traffic Redirection: Redirects only specified traffic to WAF for detection. This mode is suitable for scenarios where only specific traffic needs to be detected.
After you select a traffic redirection mode, click Add Exception Rule (All-traffic Redirection) or Add Redirection Policy (Specific-traffic Redirection). In the Matching Logic section, Exact Match and Regex Match are supported.
- Exact Match: The Redirection Domain Name/URL must be in the format of "Domain name/IP address + URL", for example, www.example.com/abc or 127.0.0.1/abc.
- Regex Match: The Redirection Domain Name/URL must be a standard regular expression.
Add domain names:

Find the domain name that you want to add to WAF, and click Add Now in the Actions column. When the WAF Protection Status shows Full Protection, the domain name is added.
Verify the protection effect:

Enter your domain name and a web attack code in the browser address bar for verification (for example, <Your domain name>/alert(xss), where alert(xss) is the cross-site scripting attack code used for testing). If the 405 block page is returned, the attack is blocked and WAF protection is in effect.

What to do next

After the domain name is added, WAF automatically creates a protected object with the -ddos suffix and enables protection rules of modules such as basic web protection rules by default for the protected object. You can view the protected object on the Protection Config > Protected Objects page. If the default protection rules do not meet your business requirements, you can create or edit protection rules. For more information, see Overview.

Routine O&M

Rollback (cancel access)

Temporarily disable WAF protection: If issues occur after access, such as a large number of false positives, and you need to temporarily disable WAF protection, you can turn off the WAF Protection Status switch on the Protected Objects page in the WAF console. For more information, see Disable WAF protection.
Cancel access: If you no longer want to use WAF to protect the Anti-DDoS Proxy domain name, you can go to the Cloud Native tab, select Anti-DDoS from the cloud service type list on the left side, find the target domain name in the domain name list, and click Remove in the Actions column. In the dialog box that appears, click OK.
Important
- After you cancel access, business traffic is no longer protected by WAF, and the security reports no longer include protection data of the relevant business traffic.
- If your WAF instance uses the pay-as-you-go billing method, no request processing fees are incurred after you cancel access. However, because the WAF instance and other protection rules still exist, feature fees are still incurred. If you no longer want to use WAF and want to stop WAF billing, see Terminate the WAF service.

Add and manage WAF protection on the DDoS side

In addition to the access and management methods provided in this topic, you can also log on to the Anti-DDoS Proxy console and go to the Domain Name Access page to enable WAF protection for domain names on the DDoS side. For more information, see Protect website services.