All Products
Search

This Product

    Web Application Firewall:Enable WAF protection for an NLB instance

    Document Center

    Web Application Firewall:Enable WAF protection for an NLB instance

    Last Updated:Jul 01, 2026

    Enable WAF 3.0 for public-facing NLB instances to protect them from web attacks. WAF uses a transparent proxy that requires no changes to your network architecture or DNS — configure a traffic redirection port and the system routes public traffic through WAF for inspection.

    How it works

    image

    • How it works: WAF integrates with NLB instances through a transparent proxy model. Configure a traffic redirection port, and the system routes all HTTP/HTTPS traffic on that port to WAF for inspection. WAF blocks malicious requests and forwards legitimate traffic to the NLB instance.

    • Protection scope: Protects all domains on the specified traffic redirection port, including services that use a public IP address without a domain name.

    • Supported listener protocols: Only TCP listeners are supported (not UDP or TCPSSL). WAF protects only HTTP/HTTPS traffic on the port — non-HTTP protocols such as FTP, SMTP, or database protocols are not supported.

    Prerequisites

    If your NLB instance does not meet these requirements, use CNAME access.

    Instance requirements:

    • The instance must be public-facing.

    • A TCP listener must be configured on the NLB instance.

    • The IP protocol version must be IPv4.

    Region requirements:

    • WAF for Chinese mainland: China (Chengdu), China (Beijing), China (Zhangjiakou), China (Hangzhou), China (Shanghai), China (Shenzhen), and China (Qingdao).

    • WAF for regions Outside Chinese mainland: China (Hong Kong), Malaysia (Kuala Lumpur), Indonesia (Jakarta), and Singapore.

    Important

    Adding an instance to WAF may cause a brief connection interruption lasting a few seconds. Perform this during off-peak hours and monitor your service afterward. Clients with automatic reconnection recover without business impact.

    Quick start

    1. Go to the console:

      Log on to the Web Application Firewall 3.0 console. In the top navigation bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) of your WAF instance. From the left-side navigation pane, click Onboarding. Select the Cloud Native tab, and then select Network Load Balancer (NLB) from the cloud product list.

    2. Authorize cloud service access (first-time configuration):

      If this is your first time configuring WAF, follow the on-screen instructions and click Authorize Now. You can view the created service-linked role, AliyunServiceRoleForWAF, on the Roles page in the RAM console.

    3. Onboard the NLB instance:

      1. In the list on the right, find the target NLB instance, click the image.png icon to expand its details, select the port to onboard, and then click Add Now in the Actions column.

        Note

        • Please click image.png to expand the instance details before clicking Add Now.

        • If the target instance is not listed, click Synchronize Assets in the upper-right corner. If still not found, the instance does not meet the Prerequisites.

      2. On the Configure Instance page, select a Protocol Type based on the traffic the port handles.

        HTTP

        To customize Layer 7 proxy in front of WAF (for example, CDN), X-Forwarded-Proto header control, or traffic marking, follow Obtain real client IP addresses. To customize back-to-origin timeout or back-to-origin persistent connections, follow Optimize back-to-origin connections. Otherwise, click OK to apply defaults.

        HTTPS

        1. To customize settings such as HTTP/2, TLS protocol version, cipher suites, and extension certificates (for multiple domains), follow Enhance HTTPS security. Otherwise, keep the defaults.

        2. In the Default Certificate section, select a method to upload the certificate:

          • Upload: Use this option if your certificate is not in Certificate Management Service (Original SSL Certificate).

          • Select Existing Certificate: Select a certificate that is issued by or uploaded to Certificate Management Service (Original SSL Certificate).

            Upload

            • Certificate Name: Enter a unique name for the certificate. The name cannot be the same as that of an existing certificate.

            • Certificate File: Open the certificate file in a text editor and paste the full content of the certificate in PEM, CER, or CRT format.

              Format example: -----BEGIN CERTIFICATE-----......-----END CERTIFICATE-----

              • Format conversion: If your certificate is in a format such as PFX or P7B, use a certificate tool to convert it to the PEM format.

              • Certificate chain: If an intermediate certificate is included, paste the server certificate followed by the intermediate certificate.

            • Private Key: Open the private key file in a text editor and paste the full content of the private key in PEM format.

              Format example: -----BEGIN RSA PRIVATE KEY-----......-----END RSA PRIVATE KEY-----

            Select existing certificate

            From the certificate drop-down list, select the certificate that you want to upload to WAF.

            Note

            If the WAF console displays the message "Failed to verify the integrity of the certificate chain. If you use this certificate, service access may be affected.", the certificate chain has an issue. Verify that your certificate content is correct and complete, then re-upload it on the Certificate Management Service console. Upload, sync, and share SSL certificates.

        3. To customize Layer 7 proxy in front of WAF (for example, CDN), X-Forwarded-Proto header control, or traffic marking, follow Obtain real client IP addresses. To customize back-to-origin timeout or back-to-origin persistent connections, follow Optimize back-to-origin connections. Otherwise, click OK to apply defaults.

    4. Verify that protection is active:

      After onboarding, verify that WAF is active. Access your website and append a test attack string to the URL, for example, http://yourdomain.com/alert(xss). A 405 block page confirms that WAF is intercepting attacks.

    5. View and configure protection rules:

      WAF automatically creates a protected object named InstanceID-Port-AssetType and enables the core web protection ruleset. View the object on the Protection Config > Protected Objects page. To customize rules, such as allowlisting specific IP addresses, configure them in the Protection configuration overview.

    Important

    Enhance HTTPS security

    Parameter

    Description

    HTTP/2

    Use HTTP/2 to improve page loading speed and reduce latency. Enable this only if your website supports HTTP/2. After enabling, both the listener and back-to-origin protocols use HTTP/2 on the same HTTPS port. Do not enable this if your website does not support HTTP/2 — it will become inaccessible.

    TLS protocol version

    Defines the TLS versions allowed for client-to-WAF connections. Higher versions offer stronger security but may not support older clients. For high-security requirements, select TLS 1.2 or later.

    Cipher suite

    Defines the encryption algorithms allowed for client-to-WAF connections. Strong cipher suites offer higher security but may not support older clients. For high-security requirements, select strong cipher suites.

    Extension certificates

    If an NLB instance hosts multiple HTTPS websites for different domains and a single certificate cannot cover all of them, you must upload a separate certificate for each domain.

    • HTTP/2

      On the Configure Instance page, select HTTP/2 to enable this feature.

    • TLS protocol version

      On the Configure Instance page, select an option in the TLS Version section.

      • TLS 1.0 and Later (Best Compatibility and Low Security): Allows access from all legacy clients.

      • TLS 1.1 and Later (High Compatibility and High Security): Prevents legacy clients that use TLS 1.0 from accessing the website.

      • TLS 1.2 and Later (High Compatibility and Best Security): Meets the latest security compliance requirements but prevents legacy clients that use TLS 1.0 and TLS 1.1 from accessing the website.

      • Support TLS 1.3: If your website supports TLS 1.3, select this option. By default, WAF does not accept client requests that use TLS 1.3.

    • Cipher suite

      On the Configure Instance page, select an option in the Cipher Suite section.

      • All Cipher Suites (High Compatibility and Low Security)

      • Custom Cipher Suite (Select It based on protocol version. Proceed with caution.): If your website supports only specific cipher suites, select this option and choose from the list of supported cipher suites.

        Strong cipher suites

        Weak cipher suites

        • ECDHE-ECDSA-AES128-GCM-SHA256

        • ECDHE-ECDSA-AES256-GCM-SHA384

        • ECDHE-ECDSA-AES128-SHA256

        • ECDHE-ECDSA-AES256-SHA384

        • ECDHE-RSA-AES128-GCM-SHA256

        • ECDHE-RSA-AES256-GCM-SHA384

        • ECDHE-RSA-AES128-SHA256

        • ECDHE-RSA-AES256-SHA384

        • ECDHE-ECDSA-AES128-SHA

        • ECDHE-ECDSA-AES256-SHA

        • AES128-GCM-SHA256

        • AES256-GCM-SHA384

        • AES128-SHA256

        • AES256-SHA256

        • ECDHE-RSA-AES128-SHA

        • ECDHE-RSA-AES256-SHA

        • AES128-SHA

        • AES256-SHA

        • DES-CBC3-SHA

        Note

        • Cipher suite security note: ECDHE-RSA-AES128-SHA256 and ECDHE-RSA-AES256-SHA384 cipher suites use ECDHE for key exchange, RSA for authentication, and AES-CBC encryption. Compared with cipher suites that use authenticated encryption modes such as AES-GCM, these have lower security and performance. Some security scanning tools may flag them as weak cipher suites. If this occurs, use a custom cipher suite and manually exclude these two suites.

        • Cipher suite naming conventions: WAF displays cipher suites in OpenSSL format, but some scanning tools may use IANA naming conventions. For example, ECDHE-ECDSA-AES256-SHA384 in OpenSSL corresponds to TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 in IANA. To look up the mapping, visit ciphersuite.info or use another TLS cipher suite lookup tool.

    • Extension certificates

      In the Additional Certificate section of the Configure Instance page, upload the required certificates. The upload method is the same as for the default certificate. Default certificate.

      Note

      When you add multiple extension certificates, all certificates must be valid. If any certificate is expired, the operation fails.

    Obtain real client IP addresses

    Parameter

    Description

    Layer 7 proxy (for example, Anti-DDoS or CDN) in front of WAF

    If a Layer 7 proxy such as a CDN is deployed in front of WAF, you must configure the Obtain Actual IP Address of Client. This ensures that WAF can obtain the real IP addresses of clients for security analysis, for example, for the Attacker IP Address in Security Reports.

    Enable traffic marking

    Helps the origin server distinguish WAF-proxied requests and obtain the real client IP address or source port.

    Use X-Forwarded-Proto header to get WAF listener protocol

    By default, WAF inserts the X-Forwarded-Proto header into HTTP requests to identify the protocol that is used to establish the connection between the client and the nearest Layer 7 proxy. If your web application needs to process this header, configure this option as required.

    • Is a Layer 7 proxy such as Anti-DDoS Proxy or CDN deployed in front of WAF

      On the Configure Instance page, configure the Is a Layer 7 proxy such as Anti-DDoS Proxy or CDN deployed in front of WAF setting. The following options are available:

      No other proxy

      Indicates that requests are sent directly from clients to WAF.

      Other proxies

      Indicates that requests are forwarded to WAF from another layer 7 proxy. You must also specify the Obtain Actual IP Address of Client.

      • Use the First IP Address in X-Forwarded-For Field as Actual IP Address of Client

        If you select this option, WAF obtains the source IP in the following order of precedence:

        1. The value of the X-Real-IP request header.

        2. If the X-Real-IP header does not exist, the first IP address in the X-Forwarded-For (XFF) header.

      • [Recommended] Use the First IP Address in Specified Header Field as Actual IP Address of Client to Prevent X-Forwarded-For Forgery

        Note

        We recommend that you configure the upstream proxy service to write the source IP address to a specified header field, such as X-Real-IP or X-Client-IP. Using a specified header prevents attackers from bypassing WAF by spoofing the XFF header.

        In the Header Field box, enter one or more header fields. Press Enter after each field. WAF obtains the source IP in the following order of precedence:

        1. The specified Header Field, in the order entered.

        2. If none of the specified headers exist, the value of the X-Real-IP header.

        3. If the X-Real-IP header also does not exist, the first IP address in the XFF header.

      • Use the Client IP from the Proxy Protocol header as the client's source IP.: If an upstream proxy has Proxy Protocol enabled, you can select this option to extract the original client IP. This method transmits the source IP at the transport layer, so it cannot be spoofed at the HTTP layer. This method is ideal for scenarios that require a high degree of trust in the source IP. If the Proxy Protocol does not contain the client IP, WAF uses the IP address of the upstream proxy as the source IP.

    • Enable Traffic Tagging

      On the Configure Instance page, expand Advanced Settings, select Enable Traffic Tagging, and then configure the following types of marking fields:

      • Custom Header: By configuring a Header Name and Header Value, you can have WAF add this header to back-to-origin requests to identify those that have passed through WAF. For example, you can configure the tag WAF-TAG: Yes, where WAF-TAG is the header name and Yes is the header value. Your origin server can then use this header for validation or access control, which enhances security and request identification.

        Important

        Do not use standard HTTP header field names such as User-Agent. Otherwise, the content of the standard header field is overwritten by the custom value.

      • Originating IP Address: Specify the header field name that contains the real client source IP address. WAF records this header and passes it to the origin server. For details on how WAF determines the real client IP, see the Layer 7 proxy (for example, Anti-DDoS or CDN) in front of WAF setting.

      • Source Port: Specify the header field name that contains the real client source port. WAF records this header and passes it to the origin server.

    • Retrieve client protocol from the X-Forwarded-Proto header

      On the Configure Instance page, expand Advanced Settings and select Retrieve client protocol from the X-Forwarded-Proto header as required.

    Optimize back-to-origin connections

    Parameter

    Description

    Set read/write connection timeouts

    Configure WAF read and write connection timeouts to prevent issues when the origin server takes too long to respond.

    Back-to-origin persistent connections

    Maintain long-lived connections between WAF and the origin server. If you experience intermittent 502 errors after onboarding, check these parameters. Set WAF persistent connection values to be less than or equal to the corresponding origin server values.

    • Set read/write connection timeouts

      On the Configure Instance page, expand Advanced Settings and configure the following parameters:

      • Read Timeout: The timeout for waiting for a response from the origin server. Increase this value for time-consuming operations such as report exports or batch data processing. Default value: 120s. Value range: 1s to 3,600s.

      • Write Timeout: The timeout for WAF to send requests to the origin server. Increase this value only if your origin server processes requests slowly under heavy load. Default value: 120s. Value range: 1s to 3,600s.

    • Origin Keep-alive

      Important

      If you disable this feature, the WebSocket protocol is not supported for back-to-origin connections.

      On the Configure Instance page, expand Advanced Settings, enable this feature in the Origin Keep-alive section, and then configure the following settings:

      • Max Requests per Connection: The default value is 1,000. The value can range from 60 to 1,000. If your origin server uses Nginx, this corresponds to the keepalive_requests parameter. Nginx documentation.

      • Idle Timeout: The default value is 3,600s. The value can range from 10s to 3,600s. If your origin server uses Nginx, this corresponds to the keepalive_timeout parameter.

    Control file upload size

    Max Body Size (Ultimate Edition only)

    • Description: By default, WAF supports a maximum upload size of 2 GB. WAF Ultimate Edition allows increasing this limit for large file uploads.

    • Procedure: On the Add Now page, expand Advanced Settings and configure the Max Body Size. The default value is 2 GB, and the maximum value is 10 GB. After you configure this parameter, you must also increase the values of Read Timeout and Write Timeout.

    Improve resource management efficiency

    Resource Group

    • Description: Resource groups simplify resource management and permission configuration. If you do not specify a resource group, the instance is added to the Default Resource Group. Resource groups.

    • Procedure: On the Configure Instance page, in the Resource Group section, select the resource group to which the instance belongs from the drop-down list.

    Routine maintenance

    Update traffic redirection port certificate

    If a certificate is about to expire or has been revoked, update the certificate bound to the traffic redirection port.

    Purchase on Alibaba Cloud

    1. In the Certificate Management Service (Original SSL Certificate) console, renew the SSL certificate. Renew an SSL certificate.

    2. On the Cloud Native tab, select the Network Load Balancer (NLB) tab. Find the target instance, click the image.png icon, and then click Modify in the Actions column for the target port.

    3. In the Default Certificate section, select Select Existing Certificate and select the new certificate.

    From another provider

    1. Download the certificate file from the platform where you purchased it.

    2. On the Cloud Native tab, select the Network Load Balancer (NLB) tab. Find the target instance, click the image.png icon, and then click Modify in the Actions column for the target port.

    3. In the Default Certificate section, select Manual Upload, provide the new certificate information as described in the previous section, and then click OK.

      • Certificate Name: Enter a unique name for the certificate. The name cannot be the same as that of an existing certificate.

      • Certificate File: Open the certificate file with a text editor and paste the content of the certificate in PEM, CER, or CRT format.

        Example format: -----BEGIN CERTIFICATE-----......-----END CERTIFICATE-----

        • Certificate chain: If an intermediate certificate is included, concatenate the server certificate and the intermediate certificate in that order before you paste the content.

        • Format conversion: If your certificate is in a format such as PFX or P7B, use a certificate tool to convert it to the PEM format.

      • Private Key: Open the private key file with a text editor and paste the content of the private key in PEM format.

        Example format: -----BEGIN RSA PRIVATE KEY-----......-----END RSA PRIVATE KEY-----.

    Note

    • If a certificate expires in less than 30 days, WAF displays an image.png icon in the list of domains to indicate that it is about to expire. Update the certificate promptly to avoid service disruptions.

    • You can set up notifications for SSL certificates to receive expiration alerts by email, SMS, and other methods. For more information, see Set up message notifications for SSL certificates.

    • To prevent service disruptions from an expired certificate, enable the certificate hosting service in Alibaba Cloud's Certificate Management Service (Original SSL Certificate). This service automatically applies for certificates before they expire. For more information, see What is Certificate Hosting Service?.

    Disable or remove WAF protection

    • Temporarily disable WAF protection: If you encounter issues such as excessive false positives after onboarding, temporarily disable WAF. Go to the Protected Objects page in the WAF console and turn off the WAF Protection Status switch. Disable WAF protection with one click.

    • Remove protection: To remove WAF protection from an NLB instance:

      On the Cloud Native tab, select the Network Load Balancer (NLB) tab. Find the target instance, click the image.png icon, and then click Remove. In the Remove dialog box, click OK.

    Important

    • Service impact: Removing an instance from WAF may cause a brief connection interruption lasting a few seconds. Perform this during off-peak hours. Clients with automatic reconnection recover without business impact.

    • Re-adding protection: After removal, traffic is no longer protected. Click Add Now to reconfigure the traffic forwarding port.

    • Billing reminder: For pay-as-you-go WAF instances, charges include the instance, protection rules, and request processing fees. To stop billing, Disable WAF.

    Re-onboard instance after changes

    WAF protects your traffic through the traffic redirection port of an NLB instance. If the NLB instance changes due to one of the following operations, the traffic redirection port configuration becomes invalid and traffic bypasses WAF:

    • The NLB instance is released.

    • The listener port that has been added to WAF is deleted.

    To restore protection, re-onboard the modified NLB instance in the WAF console.

    Production best practices

    For security and stability in production, follow these best practices when onboarding a production NLB instance.

    • HTTPS configuration: Configure a traffic redirection port of the HTTPS type with the following settings to manage certificates efficiently.

    • Canary release strategy: Onboard a non-production NLB instance during off-peak hours first. After confirming that services run as expected, onboard the production NLB instance.

    • Verify your services: After onboarding, use the following methods to confirm services are running as expected.

      • Check logs: Check for significant fluctuations in status code 200 response rates and sudden changes in QPS. If WAF log service is enabled, check WAF logs.

      • Monitor business metrics: Verify that business-side functions such as user access and transactions work correctly.

    • Ongoing maintenance: After onboarding a production instance, continuously monitor for attacks and false positives.

    Quotas and limits

    • Number of onboarded ports: The total number of configured traffic redirection ports cannot exceed the limit of your WAF instance edition.

      • Subscription WAF instance: Basic Edition supports up to 300 ports, Pro Edition up to 600, Enterprise Edition up to 2,500, and Ultimate Edition up to 10,000.

      • Pay-as-you-go WAF instance: up to 10,000 ports.

    • NLB instance requirements:

      • When you onboard an NLB instance that uses HTTPS, the certificate that you upload in the WAF console must not be expired. SM-series certificates and mutual authentication are not supported.

      • You cannot onboard listener ports of an NLB instance for which the all-port feature is enabled.

    • Propagation delay for NLB public IP changes: If an NLB instance has more than 50 listener ports and its elastic IP address is updated due to a zone or vSwitch change, a propagation delay of several minutes may occur before WAF routes traffic to the new IP address.

    FAQ

    Cannot find an NLB instance

    First, click Synchronize Assets in the upper-right corner of the Onboarding page.

    If the instance is still not found, it does not meet the Prerequisites. For example, to onboard an NLB instance in a region outside the Chinese mainland by using the Cloud Native mode, you must purchase a WAF instance in a region outside the Chinese mainland. Alternatively, you can use CNAME access.

    Onboard a single domain with multiple NLBs

    • Use Cloud Native onboarding: You must onboard each of these NLB instances to ensure that WAF directs traffic to all target instances.

    • Use CNAME access: Onboard the domain using CNAME access and add the addresses of the multiple NLB instances as origin servers.

    Onboard multiple domains with a single NLB

    • Use Cloud Native onboarding: After onboarding the NLB instance, all domains on it are protected by the default WAF policy. To configure different protection rules for each domain, manually add each domain as a separate protected object. Manually add a protected object.

    • Use CNAME access: Onboard each domain individually.