How Do I Whitelist Back-to-Source IP Addresses of Cloud WAF?

If your origin server is deployed on a Huawei Cloud ECS, perform the following steps to configure a security group rule to allow only the WAF back-to-source IP addresses to access the origin server.

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Compute > Elastic Cloud Server.
4. Locate the row containing the ECS hosting your website. In the Name/ID column, click the ECS name to go to the ECS details page.
5. Click the Security Groups tab. Then, click Change Security Group.
6. Click the security group name to view the details.
7. Click the Inbound Rules tab and click Add Rule. Then, specify parameters in the Add Inbound Rule dialog box. For details, see Table 1. Figure 4 shows an example.
   Figure 4 Add Inbound Rule
   

   Table 1 Inbound rule parameters

   Parameter	Description
   Protocol & Port	Protocol and port for which the security group rule takes effect. If you select TCP (Custom ports), enter the origin server port number in the text box below the TCP box.
   Source	Add all WAF back-to-source IP addresses copied in Step 6 one by one. NOTE: One inbound rule can contain only one IP address. To configure an inbound rule for each IP address, click Add Rule to add more rules. A maximum of 10 rules can be configured.

8. Click OK.

   Then, the security group rules allow all inbound traffic from the WAF back-to-source IP addresses.

If your origin server is deployed on backend servers of a Huawei Cloud ELB load balancer, perform the following steps to configure an access control list to allow only the WAF back-to-source IP addresses to access the origin server.

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Networking > Elastic Load Balance.
4. Locate the load balancer you want. In the Listener column, click the listener name to go to the details page.
5. In the Access Control row of the target listener, click Configure.
   Figure 5 Listener list
   

6. In the displayed dialog box, select Whitelist for Access Control.
   1. Click Create IP Address Group and add the dedicated WAF instance IP addresses obtained in Step 6 to the group being created.
   2. Select the IP address group created in 6.a from the IP Address Group drop-down list.

7. Click OK.