Allowing Outbound Traffic from Cloud Resources Only to a Specified Domain Name

Application Scenarios

To prevent sensitive data leakage or external attacks, you need to restrict the Internet domain names that can be accessed by cloud resources.

Use CFW to implement refined management and control on cloud resources and allow access traffic from all EIPs to a specified domain name. (Wildcard domain name *.example.com is used as an example).

Configuring CFW to Allow Cloud Resources to Access a Specified Domain Name

1. For details about how to purchase the standard or professional edition of CFW, see Purchasing CFW.
2. (Optional) Switch to another firewall instance: Select a firewall from the drop-down list in the upper left corner of the CFW console.
3. Enable protection for an EIP.
   1. In the navigation pane, choose Assets > EIPs. The EIPs page is displayed. The EIP information (both IPv4 and IPv6) is automatically updated to the list.
   2. In the row of the EIP, click Enable Protection in the Operation column. In the displayed dialog box, confirm the information and click Bind and Enable.

4. Configure protection rules.
   1. In the navigation pane, choose Access Control > Internet Border Protection Rules.
   2. On the Protection Rules > EIP tab page, click Add Rule. On the Add Rule page, configure protection information and set other parameters as needed.
      Configure the following protection rules:

      • One of the rules blocks all traffic, as shown in Figure 1. The priority is the lowest.
        Figure 1 Blocking all traffic

        

        Table 1 Blocking all traffic

        Parameter	Example Value	Description
        Direction	Inbound	Direction of the protected traffic.
        Source	Any	Origin of network traffic.
        Destination	Any	Receiver of network traffic.
        Service	Any	Protocol, source port, and destination port of network traffic.
        Application	Any	Protection policy for application layer protocols.
        Action	Block	Action taken when traffic passes through the firewall.

      • The other rule allows the access traffic to *.example.com and has the highest priority.
        Figure 2 Allowing the access traffic to a domain name
        

        Table 2 Allowing the access traffic to a domain name

        Parameter	Example Value	Description
        Direction	Outbound	Direction of the protected traffic.
        Source	Any	Origin of network traffic.
        Destination	Select IP Address/IP address group/Countries and regions/Domain name/Domain name group, select Application Domain Name from the drop-down list, and enter *.example.com.	Receiver of network traffic.
        Service	Select Service/Service group and select Service from the drop-down list. Set Protocol to TCP, Source Port to 1-65535, and Destination Port to 1-65535.	Protocol, source port, and destination port of network traffic.
        Application	Select Application and choose HTTP and HTTPS from the drop-down list.	Protection policy for application layer protocols.
        Action	Allow	Action taken when traffic passes through the firewall.

5. View the rule hits in access control logs.

   In the navigation pane on the left, choose Log Audit > Log Query. The Attack Event Logs page will be displayed by default. Click the Access Control Logs tab page. The Internet Border Firewall tab will be displayed by default.

   

   In the rows where Destination IP is a domain name matching example.com, the corresponding Action is Allow. For other traffic, the Action is Block.

References

• For details about how to configure a domain name group, see Allowing Traffic from a Service to a Platform.
• For details about how to add other protection rules, see the parameter description in Adding a Protection Rule.
• For details about how to allow cloud resources to access specified domain names through the NAT gateway, see Configuring a Protection Rule to Protect SNAT Traffic.