Using CFW and EIP to Control Public Network Access to Cloud Desktops

Scenarios

This section explains how to enforce network access control for cloud desktops to manage both Layer 4 (IP address and port) and Layer 7 (application and domain name) traffic on the public network.

Procedure

1. Log in to the console.
2. Enable Internet access for cloud desktops based on service requirements. For details, see Enabling Enhanced Internet Access (NAT Gateway+EIP).
3. Purchase a CFW instance (standard edition in this example) by referring to Purchasing and Modifying CFW. For details about the differences between different specifications, see CFW Functions.
4. In the navigation pane, choose Assets > EIPs. The EIPs page is displayed. The EIP information (both IPv4 and IPv6) is automatically updated to the list.
5. Locate the EIP created in 2 and click Enable Protection in the Operation column.

   

6. In the navigation pane, choose Access Control > Internet Border Protection Rules.
7. On the Protection Rules page, click Add. In the displayed Add Rule dialog box, enter the protection information and configure the protection rule based on the actual service deployment.
   

   The following steps illustrate how to configure a rule to deny access to the Internet and allow access only to Huawei Cloud websites.

8. Configure a rule to block all traffic destined for the public network.
   Figure 2 Configuring a rule
   

   Table 1 Rule parameters

   Parameter	Example	Description
   Direction	Inbound	Direction of the protected traffic.
   Source	Any	Origin of network traffic.
   Destination	Any	Receiver of network traffic.
   Service	Any	Protocol, source port, and destination port of network traffic.
   Application	Any	Protection policy for application layer protocols.
   Protection Action	Blocked	Action taken when traffic passes through the firewall.

9. Add another rule to allow access to all Huawei Cloud websites.
   Figure 3 Configuring a rule
   

   Table 2 Rule parameters

   Parameter	Example	Description
   Direction	Outbound	Direction of the protected traffic.
   Source	Any	Origin of network traffic.
   Destination	Select Application Domain Name from the drop-down list and enter *.huaweicloud.com,huaweicloud.com,*.myhuaweicloud.com,*.hc-cdn.com,*.hc-cdn.cn.	Receiver of network traffic. Note: You can use application domain name groups for centralized management.
   Service	Service: Service Protocol: TCP Source Port: 1-65535 Destination Port: 1-65535	Protocol, source port, and destination port of network traffic.
   Application	Select Application and choose HTTP and HTTPS from the drop-down list.	Protection policy for application layer protocols.
   Protection Action	Allowed	Action taken when traffic passes through the firewall.

10. View the rule hits in access control logs. In the navigation pane, choose Log Audit > Log Query. Click the Access Control Logs tab.
    

    In the rows where Destination IP is a domain name matching huaweicloud.com, the corresponding Action is Allowed. For other traffic, the Action is Blocked.

    Figure 4 Viewing logs