This topic describes Web Application Firewall (WAF)how the exclusive IP address feature works for domain names in CNAME connection mode, including its working principle, application scenarios, configuration method, and billing rules.
What are shared IP addresses and exclusive IP addresses
In CNAME Record mode, after a domain name is added to WAF, the system assigns an independent virtual IP address (VIP) to receive business requests. This VIP is not shared with other tenants. Alibaba Cloud WAF instances provide highly available protection services. This VIP is not bound to a specific physical device but belongs to the Alibaba Cloud WAF cluster resources. Under the same WAF instance:
-
When the exclusive IP address or Intelligent load balancing feature is not enabled for a domain name, all domain names share one VIP.
-
After the exclusive IP address feature is enabled, each domain name is assigned an independent VIP.
However, this IP address is not fixed. To ensure maximum service stability, strictly follow the steps in CNAME Record to modify the DNS resolution settings for the domain name. For more information, see Can I modify DNS resolution to point to a WAF VIP?
Value of exclusive IP addresses
Enabling an exclusive IP address effectively isolates DDoS attack risks. When a domain name is under a high-traffic DDoS attack and the WAF VIP enters blackhole status, other domain names that share the same VIP also become inaccessible. By enabling an exclusive IP address for critical domain names, you can prevent important business services from being affected when a shared IP address is blackholed.
Enable an exclusive IP address
The exclusive IP address feature can be enabled only in CNAME Record mode. To enable an exclusive IP address for a domain name, perform the following steps:
-
On the Onboarding page of Web Application Firewall 3.0 console, click the Add button on the CNAME Record tab to open the Add Domain Name configuration wizard.
-
In the Configure Listener task, click to enable the feature.
For more information about additional configuration, see Improve service availability and performance.
If the exclusive IP address feature is disabled, it switches to a shared IP address.
Billing
The exclusive IP address is a billable feature. You are billed based on the number of domain names for which this feature is enabled:
-
The more domain names for which you enable the exclusive IP address, the higher the cost.
-
For specific billing standards, see Pay-as-you-go billing and Subscription billing.
FAQ
What is the difference between a WAF VIP (exclusive IP address or shared IP address) and a WAF origin IP address range?
-
WAF VIP
-
The WAF VIP is the entry IP address of WAF and the actual destination address that clients connect to when accessing your website.
-
All requests from clients first reach this VIP, where WAF performs security detection and filtering.
-
It can be either a shared IP address (used by multiple domain names) or an exclusive IP address (dedicated to a single domain name).
-
-
WAF origin IP address range
-
The WAF origin IP address range is the IP address range used by WAF to send origin requests to the origin server after security detection is complete.
-
From the perspective of the origin server, all requests from WAF originate from these origin IP addresses.
-
The security policies of the origin server, such as firewalls or security groups, must allow traffic from the WAF origin IP address range. Otherwise, origin fetches will fail.
-
How do I view the specific IP address of a WAF VIP?
The WAF VIP (that is, the exclusive IP address or shared IP address) cannot be directly viewed in the console. You need to use the ping or nslookup command on the client to query the domain name that has been added to WAF.
ping example.com #Replace with the domain name added to WAF.Can I modify DNS resolution to point to a WAF VIP?
No. When you add a domain to WAF by using a CNAME record, you must point your DNS record to the CNAME address provided by WAF, not to the WAF VIP address. This is because the VIP address may change, for example, when you enable or disable an exclusive IP or intelligent load balancing, or in extreme cases of a WAF failure. Pointing your domain directly to the VIP address can cause service interruptions. Using a CNAME record ensures that the backend IP address is automatically switched to guarantee business continuity.
Why does port scanning show high-risk ports that are not actually open? Is there a risk?
When you use a tool like Nmap to scan a domain added to WAF by using a CNAME record, the scan may report ports as open that are closed on your origin server. This is expected behavior because the domain resolves to the WAF VIP. The scan targets the WAF VIP's ports, not your origin server's.
WAF forwards traffic only for the ports that you configure in the console. On unconfigured ports, WAF completes the TCP three-way handshake but then immediately terminates the connection with an RST packet without forwarding any data. Therefore, these ports pose no security risk. VIP ports cannot be closed manually. For more information, see Explanation of non-standard ports in WAF.
How do I set the default SSL or TLS policy to make the VIP compliant?
To meet compliance requirements, you can customize the SSL certificates and TLS policies for your WAF VIPs. Before you run a compliance scan on a WAF VIP, follow these steps to upload a compliant HTTPS certificate and enable or disable specific TLS protocol versions and cipher suites.
Above the list of added domains, click Default SSL/TLS Settings.
In the Default SSL/TLS Settings dialog box, configure the following settings and click OK.
Parameter
Description
HTTPS Upload Type
Upload an SSL certificate. The procedure is the same as for uploading a domain certificate. For details, see Upload a certificate.
TLS Version
Valid values:
TLS 1.0 and Later (Best Compatibility and Low Security)
TLS 1.1 and Later (High Compatibility and High Security): Prevents legacy clients that use the TLS 1.0 protocol from accessing your website.
TLS 1.2 and Later (High Compatibility and Best Security): Meets the latest security compliance requirements but prevents legacy clients that use the TLS 1.0 and 1.1 protocols from accessing your website.
Support TLS 1.3: Select this option if your website supports the TLS 1.3 protocol.
HTTPS Cipher Suite
Select the cipher suite that you want to enable. Valid values:
All Cipher Suites (High Compatibility and Low Security)
Custom Cipher Suite (Select It based on protocol version. Proceed with caution.): Select this option if your website supports only specific cipher suites. Proceed with caution to avoid disrupting your services. For more information about the supported custom cipher suites, see WAF-supported cipher suites.