Connecting a Website to WAF (Dedicated Mode)

After purchasing a dedicated WAF instance, you need to connect the domain name or IP address you want to protect to the instance so that the website traffic can go through WAF. WAF detects and filters out attack traffic and forwards normal traffic to the origin server IP address. In this way, WAF keeps the origin server IP address secure, stable, and available.

Flowchart of connecting a domain name to a dedicated WAF instance

Figure 1 Process of connecting a website to a dedicated WAF instance

Procedure

1. In the navigation pane on the left, choose Website Settings.
2. Click Add Website.
3. Select Dedicated and add the website to WAF.
   

   If the server IP address of each subdomain name is the same, enter a wildcard domain name to be protected. For example, if the subdomain names a.example.com, b.example.com, and c.example.com have the same server IP address, you can add the wildcard domain name *.example.com to WAF to protect all three.

4. Configure a load balancer.

   Configure a load balancer and enable the health check for your dedicated WAF instances to ensure reliability and stability of your dedicated WAF.

5. Bind an EIP to the load balancer.

   Unbind an elastic IP address (EIP) from the origin server and bind the EIP to the load balancer configured for the dedicated WAF instance. The request traffic then goes to the dedicated WAF instance for attack detection first and then go to the origin server, ensuring the security, stability, and availability of the origin server.

6. Whitelist back-to-source IP addresses of the dedicated WAF instance.

   After you connect a domain name or IP address to a dedicated WAF instance, uninstall other security software from the origin server or allow only the IP addresses of the dedicated WAF instance to access the origin server. This ensures normal access while defending attacks against real IP addresses of origin servers.

7. Verify that the domain name or IP address has been connected to WAF.

   If the Access Status of the domain name or IP address is Accessible, the domain name or IP address has been connected to WAF, and WAF starts protecting it. After a domain name or IP address is connected to WAF, WAF automatically enables protection.

   

   WAF automatically checks the access status of protected websites every hour. If WAF confirms that a protected website has received 20 access requests within 5 minutes, it considers that the website has been successfully connected to WAF.