Web Application Firewall (WAF)WAF supports protection for both standard and non-standard ports. After you add the server port for your website in the WAF console, WAF receives client traffic through that port. This topic describes the standard and non-standard ports that WAF supports.
Supported standard ports
HTTP protocol ports: 80 and 8080
HTTPS protocol ports: 443 and 8443
Supported non-standard ports
Cloud native access
When you use cloud native access to connect to WAF, you can protect any non-standard port in the range of 1 to 65535.
CNAME access
The support varies based on the WAF edition that you purchase:
Subscription Basic Edition and Pro Edition: Only standard ports are supported. Non-standard ports are not supported.
Subscription Enterprise Edition, Ultimate Edition, and pay-as-you-go edition:
For the IPv4 protocol, you can protect any non-standard port in the range of 1 to 65535, except the following specific system ports:
9, 20, 21, 22, 23, 25, 42, 53, 67, 68, 69, 110, 135, 137, 138, 139, 143, 161, 389, 445, 593, 1434, 1521, 3127, 3306, 3389, 4444, 5554, 5800, 5900, 6379, 9996, 11211, 27017, 27018, 50030, 50070, 61613, 61616, and 61617.
If IPv6 is enabled, only the following HTTP protocol ports are supported:
81, 82, 83, 84, 86, 87, 88, 89, 97, 800, 808, 1000, 1090, 3333, 3501, 3601, 5000, 5222, 6001, 6666, 7000, 7001, 7002, 7003, 7004, 7005, 7006, 7009, 7010, 7011, 7012, 7013, 7014, 7015, 7016, 7018, 7019, 7020, 7021, 7022, 7023, 7024, 7025, 7026, 7070, 7081, 7082, 7083, 7088, 7097, 7510, 7777, 7800, 8000, 8001, 8002, 8003, 8008, 8009, 8020, 8021, 8022, 8025, 8026, 8077, 8078, 8081, 8082, 8083, 8084, 8085, 8086, 8087, 8088, 8089, 8090, 8091, 8106, 8181, 8334, 8336, 8686, 8800, 8888, 8889, 8999, 9000, 9001, 9002, 9003, 9021, 9023, 9027, 9037, 9080, 9081, 9082, 9180, 9200, 9201, 9205, 9207, 9208, 9209, 9210, 9211, 9212, 9213, 9898, 9908, 9916, 9918, 9919, 9928, 9929, 9939, 9999, 10000, 10001, 10080, 12601, 28080, 33702, and 48800.
If IPv6 is enabled, only the following HTTPS protocol ports are supported:
4443, 5443, 6443, 7443, 9443, 8553, 8663, 9553, 9663, and 18980.
Billing notes: For the pay-as-you-go edition of WAF, additional fees are incurred when you configure non-standard ports for CNAME access. For more information, see Billing overview.
Maximum number of non-standard ports: You can configure up to 50 non-standard ports for the Enterprise Edition and up to 100 non-standard ports for the Ultimate Edition and the pay-as-you-go edition.
You can also view the supported port ranges in the console by performing the following steps:
Log on to the Web Application Firewall 3.0 console. In the top navigation bar, select the resource group and region of your WAF instance (Chinese Mainland or Outside Chinese Mainland).
In the left-side navigation pane, click Onboarding.
On the CNAME Record tab, find the domain name for which you want to view ports and click Edit in the Actions column.
In the Edit Domain Name panel, select the HTTP or HTTPS protocol, and then click View Port Range on the right.
FAQ
How do I specify the port when I connect a resource in the WAF console?
Connect an ECS instance by using cloud native access
When you add an ECS instance by using cloud native access in the WAF console, you must select the corresponding protocol and port based on the actual access address of your website.
If your website is accessed through
http://yourdomain.com, use the HTTP protocol with port 80.If your website is accessed through
http://yourdomain.com:8080, use the HTTP protocol with port 8080.If your website is accessed through
https://yourdomain.com, use the HTTPS protocol with port 443.If your website is accessed through
https://yourdomain.com:8443, use the HTTPS protocol with port 8443.
For more information, see Enable WAF protection for ECS instances.
To ensure accuracy, we recommend that you check the configuration file of your web server (such as Nginx or Apache, for example, nginx.conf) to obtain the most accurate port information.
Use CNAME access
When you configure a domain name by using CNAME access in the WAF console, you must complete the following two steps for port configuration:
Step 1: configure listener (HTTP Port or HTTPS Port, that is, the listening port)
The listening port is the protocol and port that users use to access your service. You must determine the listening port based on the actual access address:
If accessed through
http://yourdomain.com, use the HTTP protocol, and set HTTP Port to 80.If accessed through
http://yourdomain.com:8080, use the HTTP protocol, and set HTTP Port to 8080.If accessed through
https://yourdomain.com, use the HTTPS protocol, and set HTTPS Port to 443.If accessed through
https://yourdomain.com:8443, use the HTTPS protocol, and set HTTPS Port to 8443.
To ensure accuracy, we recommend that you check the configuration file of your web server (such as Nginx or Apache, for example, nginx.conf) to obtain the most accurate port information.
Step 2: configure forwarding (Origin Port)
The Origin Port is the port that WAF uses to forward requests to your origin server. It must match the actual port that your origin server uses to provide services.
The listening port and the origin port can be different. However, the origin port must accurately match the port that your origin server actually uses. Otherwise, the service will become unavailable.
