Allowing Internet Traffic Only to a Specified Port

Application Scenarios

For security purposes, you need to allow traffic only from certain ports (such as ports 80 and 443) to access cloud resources.

This section describes how to configure CFW for refined management and control on cloud resources, allowing all EIPs to access port 80 of an EIP (xx.xx.xx.1).

Configuring CFW to Allow the Access Traffic from the Internet to a Specified Port

1. For details about how to purchase the standard or professional edition of CFW, see Purchasing CFW.
2. (Optional) Switch to another firewall instance: Select a firewall from the drop-down list in the upper left corner of the CFW console.
3. Enable protection for the EIP (xx.xx.xx.1).
   1. In the navigation pane on the left, choose Assets > EIPs. The EIPs page is displayed.
   2. In the row of the EIP (xx.xx.xx.1), click Enable Protection in the Operation column. In the displayed dialog box, confirm the information and click Bind and Enable.

4. Configure protection rules.
   1. In the navigation pane of the CFW console, choose Protection Policies > Access Control > Internet Border Protection Rules. The Internet Border Protection Rules page is displayed.
   2. On the Protection Rules > EIP tab page, click Add Rule. On the Add Rule page, configure protection information and set other parameters as needed.
      Configure the following protection rules:

      • One of the rules blocks all traffic, as shown in Figure 1. The priority is the lowest.
        Figure 1 Blocking all traffic

        

        Table 1 Blocking all traffic

        Parameter	Example Value	Description
        Direction	Inbound	Direction of the protected traffic.
        Source	Any	Origin of network traffic.
        Destination	Any	Receiver of network traffic.
        Service	Any	Protocol, source port, and destination port of network traffic.
        Application	Any	Protection policy for application layer protocols.
        Protection Action	Blocked	Action taken when traffic passes through the firewall.

      • The other rule allows the traffic to port 80 of EIP (xx.xx.xx.1) and has the highest priority.
        Figure 2 Allowing access traffic to port 80 of xx.xx.xx.1
        

        Table 2 Allowing access traffic to port 80 of xx.xx.xx.1

        Parameter	Example Value	Description
        Direction	Inbound	Direction of the protected traffic.
        Source	Any	Origin of network traffic.
        Destination	Select IP address/IP address group. Select IP address from the drop-down list, and enter an IP address (xx.xx.xx.1) in the address text box.	Receiver of network traffic.
        Service	Select Service/Service group. Select Service from the drop-down list. Set Protocol to TCP, Source Port to 1-65535, and Destination Port to 80.	Protocol, source port, and destination port of network traffic.
        Application	Any	Protection policy for application layer protocols.
        Protection Action	Allowed	Action taken when traffic passes through the firewall.

5. View the rule hits in access control logs.

   In the navigation pane, choose O&M Analysis > Log Query. On the displayed page, click the Access Control Logs tab.

   

   In the rows where Destination IP is xx.xx.xx.1, the corresponding Action is Allow.

References

For details about how to add other protection rules, see the parameter description in Adding a Protection Rule.