Adding Blacklist or Whitelist Items to Block or Allow Traffic

Specification Limitations

• CFW supports up to 2,000 blacklist items and 2,000 whitelist items. If there are too many IP addresses to be specified, you can put them in an IP address group and select the IP address group when configuring protection rules.
  • For details about how to add an IP address group, see Adding User-defined IP Addresses and Address Groups.
  • For details about how to add a protection rule, see Adding Protection Rules to Block or Allow Traffic.
• To protect private IP addresses, use the professional edition firewall and enable VPC border firewall protection.

Impact on the System

CFW directly allows whitelisted IP addresses and segments and blocks blacklisted ones without checking. To check the access and traffic statistics of these IP addresses, search for them by following the instructions in Querying Logs.

Adding Blacklist or Whitelist Items to Block or Allow Traffic

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. In the navigation pane on the left, click and choose Security & Compliance > Cloud Firewall. The Dashboard page will be displayed.
4. (Optional) Switch firewall instance: Select a firewall from the drop-down list in the upper left corner of the page.
5. In the navigation pane, choose Access Control > Access Policies. Click the tab of a protected object, and then click the Blacklist or Whitelist tab.
6. Click Add. Set the address direction, IP address, protocol type, and port number. For details, see Table 1.

   Table 1 Blacklist and whitelist parameters

   Parameter	Description
   Direction	You can select Source or Destination. Source: The IP address or IP address group that sends data packets. Destination: The destination IP address or IP address group that receives data packets.
   Protocol Type	Its value can be TCP, UDP, ICMP, or Any.
   Port	If Protocol Type is set to TCP or UDP, set the ports to be allowed or blocked. NOTE: To specify all the ports of an IP address, set Port to 1-65535. You can specify a single port. For example, to allow or block the access from port 22 of an IP address, set Port to 22. To set a port range, use a hyphen (-) between the starting and ending ports. For example, to allow or block the access from ports 80-443 of an IP address, set Port to 80-443.
   Description	Description of the blacklist or whitelist
   IP Addresses	User-defined IP address: Enter one or more IP addresses in the text box and click Parse to add the IP addresses to the list. Pre-defined address group: Click Add Pre-defined IP Address Group. In the dialog box that is displayed, select an address group. For more information, see Viewing a Predefined Address Group. CAUTION: After WAF_Back-to-Source_IP_Addresses is added to the blacklist or whitelist, if a back-to-source IP address changes, you need to manually update it in the blacklist or whitelist.

7. Click OK.

Related Operations

• For details about how to edit and remove blacklist or whitelist items, see Managing the Blacklist and the Whitelist.
• For details about how to add blacklist or whitelist items in batches, see Importing and Exporting Protection Policies.