Help Center/ Cloud Firewall/ User Guide/ Configuring Access Control Policies to Control Traffic/ Adding Blacklist or Whitelist Items to Block or Allow Traffic
Updated on 2024-11-04 GMT+08:00

Adding Blacklist or Whitelist Items to Block or Allow Traffic

After protection is enabled, CFW allows all traffic by default. You can configure the blacklist to block access requests from IP addresses or configure the whitelist to allow them.

This topic describes how to add a single blacklist or whitelist item. For details about how to add items in batches, see Importing and Exporting Protection Policies.

If your IP address is a back-to-source WAF IP address, you are advised to configure a protection rule or the whitelist to allow its access. Exercise caution when configuring the blacklist, which may affect your services.

Specification Limitations

Impact on the System

CFW directly allows whitelisted IP addresses and segments and blocks blacklisted ones without checking. To check the access and traffic statistics of these IP addresses, search for them by following the instructions in Querying Logs.

Adding Blacklist or Whitelist Items to Block or Allow Traffic

  1. Log in to the management console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. In the navigation pane on the left, click and choose Security & Compliance > Cloud Firewall. The Dashboard page will be displayed.
  4. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click View in the Operation column of a firewall to go to its details page.
  5. In the navigation pane, choose Access Control > Access Policies. Click the tab of a protected object, and then click the Blacklist or Whitelist tab.
  6. Click Add. Set the address direction, IP address, protocol type, and port number. For details, see Table 1.

    Table 1 Blacklist and whitelist parameters

    Parameter

    Description

    Direction

    You can select Source or Destination.

    • Source: The IP address or IP address group that sends data packets.
    • Destination: The destination IP address or IP address group that receives data packets.

    Protocol Type

    Its value can be TCP, UDP, ICMP, or Any.

    Port

    If Protocol Type is set to TCP or UDP, set the ports to be allowed or blocked.

    NOTE:
    • To specify all the ports of an IP address, set Port to 1-65535.
    • You can specify a single port. For example, to allow or block the access from port 22 of an IP address, set Port to 22.
    • To set a port range, use a hyphen (-) between the starting and ending ports. For example, to allow or block the access from ports 80-443 of an IP address, set Port to 80-443.

    Description

    Description of the blacklist or whitelist

  7. Click OK.

Related Operations