Help Center/ Web Application Firewall/ Drawer/ Adding a Domain Name to WAF (Cloud Mode)/ Use Layer 7 Proxy
Updated on 2025-07-04 GMT+08:00
Share

Use Layer 7 Proxy

Description

  • Yes: Layer-7 web proxy products, such as anti-DDoS, CDN, and other cloud acceleration services, are used.
  • No: No layer-7 proxy products are used.

If you select Yes, WAF obtains the actual IP address of the user from the related field in the configured header. For details, see Configuring Header Field Forwarding.

FAQs

How Does WAF Forward Requests When A Proxy Is or Is Not Used?

  • Proxy used

    If your website has used proxies, such as anti-DDoS, Content Delivery Network (CDN), or cloud acceleration, Figure 1 shows how WAF works.

    • If your website is not connected to WAF, DNS resolves the domain name to the proxy IP address. Then, the proxy routes the traffic back to the origin server.
    • After you connect your website to WAF, change the back-to-source address of the proxy to the CNAME record of WAF. In this way, the proxy forwards the traffic to WAF. WAF then filters out illegitimate traffic and only routes legitimate traffic back to the origin server.
      1. Change the back-to-source IP address of the proxy to the CNAME record of WAF.
      2. (Optional) Add a WAF subdomain name and TXT record at your DNS provider.
    Figure 1 A proxy used
  • No proxies used

    If no proxy is used before the website is connected to WAF, Figure 2 shows how WAF works.

    • If your website is not connected to WAF, DNS resolves your domain name to the origin server IP address. Therefore, web visitors can directly access the origin server.
    • If your website is connected to WAF, DNS resolves your domain name to the CNAME record of WAF. In this way, the traffic passes through WAF. WAF then filters out illegitimate traffic and only routes legitimate traffic back to the origin server.
    Figure 2 No proxies used
Parent Topic: Adding a Domain Name to WAF (Cloud Mode)