Web Application Firewall:Hybrid cloud access

Install vagent

1. Log on to the local server.Web Application Firewall 3.0 console

2. Get the latest vagent RPM package. Submit a ticketticketticketticketticketticketticket to request the download from a product technical expert.

3. Install the package.

   sudo rpm -ivh t-yundun-vagent-xxxxxxx.xxxxx.rpm

   Replace xxxxxxx.xxxxx with the version number of the downloaded file.

4. Verify the installed version.

   rpm -qa | grep vagent

   The output displays the installed vagent version. Confirm it matches the package you downloaded.

5. Configure the vagent connection. Open the configuration file.

   Important

   Express Connect mode requires an active Express Connect circuit. For the Chinese mainland, VPC-connected instances in China (Hangzhou), China (Shanghai), and China (Beijing) are supported. For other regions, submit a ticketticketticketticketticketticketticket. For regions outside the Chinese mainland, submit a ticketticketticketticketticketticketticket.

   WAF region	Connection method	Endpoint
   Chinese mainland	Internet	wafopenapi.cn-hangzhou.aliyuncs.com
   Chinese mainland	Express Connect (private)	wafopenapi.vpc-proxy.aliyuncs.com
   Outside the Chinese mainland	Internet	wafopenapi.ap-southeast-1.aliyuncs.com
   Outside the Chinese mainland	Express Connect (private)	wafopenapi-intl.vpc-proxy.aliyuncs.com

   sudo vi /home/admin/vagent/conf/vagent.toml

   Press i to enter edit mode, then set the following fields:

   domain="<endpoint>"            # Hybrid Cloud WAF service endpoint (see table below)
   access_key_id="<your-ak-id>"   # Alibaba Cloud AccessKey ID
   access_key_secret="<your-ak-secret>"  # Alibaba Cloud AccessKey secret

   Select the endpoint based on your WAF region and connection method: Press Esc, then type :wq and press Enter to save and exit.

6. Start vagent.

   sudo systemctl start vagent
   sudo systemctl enable vagent

   After enabling auto-start, you see the following confirmation:

   Created symlink from /etc/systemd/system/multi-user.target.wants/vagent.service
   to /usr/lib/systemd/system/vagent.service.

7. Verify the installation.

   ps aux | grep AliYunDunWaf

   If the AliYunDunWaf process appears in the output, vagent is running and has established a connection with the Alibaba Cloud WAF server. The server is ready to be added as a cluster node. If the process does not appear, check that each installation step completed successfully, then reinstall and restart vagent. If the issue persists, submit a ticketticketticketticketticketticketticket.

Manage vagent

Repeat this step on every server that will host a cluster node.

Reverse proxy mode

1. Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region.

2. In the left navigation pane, click Onboarding.

3. On the Hybrid Cloud tab, click Reverse Proxy, then click Add.

4. In the Configure listener step, set the following parameters and click Next. Additional HTTPS settings (optional):

   • HTTP/2: Enable if your website supports the HTTP/2 protocol. HTTP/2 uses the same port as HTTPS.

   • Enable HTTPS routing: Forces HTTP requests to redirect to HTTPS (port 443 by default) and enables HSTS. Available only when HTTP is not selected.

   • TLS version: The minimum TLS version WAF accepts. Higher versions improve security but reduce compatibility. Options: TLS 1.0 and later (default), TLS 1.1 and later, TLS 1.2 and later. To support TLS 1.3, select Support TLS 1.3.

   • Cipher suite: The cipher suites WAF accepts. Defaults to all supported suites. Select Custom cipher suite only if your backend requires specific cipher suites. See Supported WAF cipher suites for the full list.

   Parameter	Description
   Domain name/IP address	The domain name or IP address to protect. For domain names: exact-match (e.g., www.aliyundoc.com) or wildcard (e.g., *.aliyundoc.com). A wildcard domain matches all subdomains at the same level but does not match the primary domain or subdomains at different levels. If both an exact-match and a wildcard domain can match the same host, the exact-match domain's rules take precedence. For IP addresses: enter the IP address directly (e.g., 192.168.XX.XX).
   Protocol type	Select HTTP or HTTPS and enter the port number. The port must be within the cluster's listener port range. To add a port, see Step 2. For HTTPS, upload the SSL certificate (see certificate options below).
   Layer 7 proxy	Select No if WAF receives requests directly from clients. Select Yes if another proxy (such as Anti-DDoS or CDN) sits in front of WAF, then configure Obtain source IP address to identify the real client IP.
   Resource group	The resource group for this domain. Defaults to Default Resource Group.

   HTTPS certificate options:

   Option	When to use
   Upload	Paste the certificate file content and private key directly. Supported input format: PEM. Convert other formats (PFX, P7B, CER, CRT) to PEM first using the Certificate Management Service format conversion tool. If the domain uses a certificate chain, concatenate all certificate files before uploading.
   Select existing certificate	Use a certificate issued by Alibaba Cloud Certificate Management Service, or a third-party certificate already uploaded there.
   Purchase certificate	Apply for a paid DV (Domain Validation) certificate directly. The certificate is automatically uploaded to WAF after issuance. For other certificate types, purchase through Certificate Management Service.

5. In the Configure forwarding rule step, set the following parameters and click Submit.

   Parameter	Description
   Node settings	Select a Protection node group and enter the origin server address (the IP address or domain name WAF forwards traffic to after inspection). Add up to 20 IP addresses — WAF automatically load-balances across them. Configure IPv4 only, IPv6 only, or both. If only IPv4 addresses are configured, all requests (including from IPv6 clients) are forwarded over IPv4. If only IPv6 addresses are configured, all requests are forwarded over IPv6. If you enter a domain name (such as a CNAME), only origin fetch over IPv4 is supported — WAF resolves and forwards to the IPv4 address only. To add multiple protection node groups, click Add protection node.
   Public cloud disaster recovery	When enabled, traffic can fail over to the public cloud link if the hybrid cloud link fails. Point the DNS CNAME record to the public cloud CNAME before switching. Add an origin server address for the disaster recovery link.
   Load balancing algorithm	Round-robin: distributes requests evenly across origin servers. IP hash: routes requests from the same client IP to the same origin server, which maintains session consistency but may cause uneven distribution.
   Advanced HTTPS settings	Enable HTTP routing: sets the back-to-origin port (default: 80). Origin SNI: set to Same as the actual request host to use the Host header value, or Custom to specify a fixed SNI value.
   Other advanced settings	X-Forwarded-Proto header: WAF automatically inserts this header to identify the protocol used between the client and WAF. Disable if your application cannot handle this header. Enable traffic tag: adds a custom header to requests that pass through WAF, so your origin server can distinguish WAF-inspected traffic. Timeout settings: connection timeout (default: 5s, range: 1–3600s), read timeout (default: 120s), write timeout (default: 120s). Retry back-to-origin requests: when enabled, WAF retries each origin server up to three times after a failed origin fetch. Origin keep-alive: when enabled, set max requests per connection (default: 1,000; range: 60–1,000) and idle timeout (default: 15s; range: 10–3,600s). Disabling keep-alive also disables WebSocket support.

6. Update the DNS record for your domain. If you use Alibaba Cloud DNS, see Change DNS settings.

   • Change the DNS A record to point the domain to the protection node group IP address.

   • If you enabled Public cloud disaster recovery, also add a DNS CNAME record pointing to the public cloud CNAME (for use when switching to the disaster recovery link).

   Important

   Before changing DNS, verify that WAF forwarding is working correctly by running a local verification test. Changing DNS before forwarding takes effect will interrupt your service. See Local verification.

   DNS changes are required only when adding a domain name. Skip this step when adding an IP address.

After the service is added, WAF automatically creates a protected object and enables web core protection rules for it. Go to Protection Configuration > Protected Objects to view the protected object and configure mitigation policies. See Overview of mitigation settings.

SDK integration mode

In SDK integration mode, deploy an SDK plugin on your unified access gateway. The plugin mirrors service traffic to the WAF bypass cluster for inspection without affecting traffic forwarding.

To set up SDK integration, submit a ticketticketticketticketticketticketticket to get assistance from a product technical expert.

After the SDK and cluster are deployed:

• View forwarding node status: Log on to the WAF 3.0 console, click Onboarding in the left navigation pane, then click SDK Integration on the Hybrid Cloud tab. The provisioning list shows the mapping between each forwarding node IP address and its cluster and protection node group, along with the node status.

• Add a protected object: WAF does not automatically add protected objects in SDK integration mode. Go to the Protected Objects page in the WAF console and add the domain name or URL as a protected object. See Configure protected objects and protected object groups.

• Configure mitigation policies: After adding the protected object, configure the mitigation policies for it. See Overview of mitigation settings.