Help Center/ Web Application Firewall/ Drawer/ Adding a Domain Name to WAF (Cloud Mode)/ IPv6 Protection
Updated on 2025-07-04 GMT+08:00
Share

IPv6 Protection

Description

Enable IPv6 Protection if the domain name is accessible using an IPv6 address. After you enable it, WAF assigns an IPv6 address to the domain name.

  • If you select IPv6 for Server Address, IPv6 Protection is enabled by default.
  • If you select IPv4 for Server Address and enable IPv6 Protection, WAF will assign an IPv6 address to the domain name so that the website is accessible over the IPv6 address. In this way, requests to the IPv6 address are routed by WAF to the IPv4 address of the origin server.

If an origin server uses IPv6 addresses, IPv6 protection is enabled by default. In this case, to prevent IPv6 service interruptions, IPv6 protection cannot be disabled.

FAQs

Which WAF Editions in Which Regions Support IPv6 Protection?

  • In cloud CNAME access mode, you can buy professional or enterprise edition WAF to protect IPv6 addresses.
  • In dedicated or cloud load balancer access mode, EIPs are bound to the load balancers configured for WAF instances. If the load balancers support IPv6 addresses, the corresponding WAF instances also support IPv6 addresses
  • WAF can inspect requests sent over both IPv4 and IPv6 addresses for the same domain name.
  • For web services that still use the IPv4 protocol stack, WAF uses the NAT64 mechanism to translate external IPv6 access traffic to internal IPv4 traffic. NAT64 is an IPv6 conversion mechanism that enables communication between IPv6 and IPv4 hosts using a form of network address translation (NAT).
  • For regions that support IPv6 protection, see Functions.

How Do I Know the Origin Server Address Configured in WAF Is an IPv6 Address?

Here we use www.example.com as an example. Assume that it has been added to WAF. You can query the origin server address set in WAF in the following way:

  1. Open the cmd command line tool in Windows.
  2. Run the dig AAAA www.example.com command.

    If the command output contains an IPv6 address, the configured origin server IP address is an IPv6 address.

How Does WAF Forward Traffic to an IPv6 Origin Server?

If the origin server address is an IPv6 address, WAF accesses the origin server over the IPv6 address. WAF adds IPv6 address resolution in CNAME record sets by default. IPv6 access requests are forwarded to WAF first. WAF detects and filters out malicious attack traffic, and returns normal traffic to the origin server to keep the origin server secure, stable, and available.

WAF supports the IPv6/IPv4 dual stack mode and NAT64 mechanism. The details are as follows:

  • WAF can inspect requests sent over both IPv4 and IPv6 addresses for the same domain name.
  • For web services that still use the IPv4 protocol stack, WAF uses the NAT64 mechanism to translate external IPv6 access traffic to internal IPv4 traffic. NAT64 is an IPv6 conversion mechanism that enables communication between IPv6 and IPv4 hosts using a form of network address translation (NAT).
  • For regions that support IPv6 protection, see Functions.
Parent Topic: Adding a Domain Name to WAF (Cloud Mode)