Connecting Your Website to WAF Using Cloud CNAME Access

Step 1. Add Your Domain Name to WAF

1. Log in to the WAF console.
2. Click in the upper left corner and select a region or project.
3. (Optional) If you have enabled the enterprise project function, in the upper part of the navigation pane on the left, select your enterprise project from the Filter by enterprise project drop-down list. Then, WAF will display the related security data in the enterprise project on the page.

   You cannot add websites to all projects.

4. In the navigation pane on the left, choose Access Management.

   Before adding a website to WAF, you can click Usage Guide in the upper right corner of the page to learn about the access process.

5. On the Access Management page, click the Cloud CNAME tab and click Add Website.

   If only one access mode is enabled, click Add Website.

6. On the Add Website panel, configure Basic Settings.
   Figure 4 Configuring basic information
   

   Table 1 Parameter description

   Parameter		Description	Example Value
   Protected Domain Name		The domain name you want to add to WAF for protection. You can add the following types of domain names: Single domain names, such as top-level domain name example.com or second-level domain name www.example.com. Wildcard domain names, such as *.example.com The starter edition does not support adding wildcard domain names to WAF. If the server IP address of each subdomain name is the same, enter a wildcard domain name. For example, if subdomain names a.example.com, b.example.com, and c.example.com have the same server IP address, you can add wildcard domain name *.example.com to WAF to protect all three. If the server IP addresses of subdomain names are different, add subdomain names as single domain names one by one. Each domain name must have a valid certificate associated. A wildcard domain name can only use a wildcard domain certificate. If you only have single-domain certificates, you need to add domain names to WAF one by one. If a domain name uses different ports, each combination of the domain name plus a port is a unique protection object. For example, if you add www.example.com:8080 and www.example.com:8081 to WAF, they are considered as two domain names and counted towards two domain names in your quota. If your origin server is located in the Chinese mainland, the associated domain name must have a valid Internet Content Provider (ICP) filing. WAF checks the ICP filing of domain names you want to add to WAF. If a domain name does not have an ICP filing, it cannot be added to WAF. You can click Quick Add Domain Names Hosted on this Cloud and select a domain name used in Huawei Cloud. The domain name must be a public domain name on DNS. If no domain name is available, go to Domain Name Service (DNS) to add one.	www.example.com
   Website Name (Optional)		Website name you specify.	WAF
   Website Remarks (Optional)		Remarks of the website.	waftest
   Protected Port		Port to be protected. Only one port can be added for a protected domain name. If you want to protect more ports for a domain name, add the domain name and each port to WAF by referring to Step 1. Add Your Domain Name to WAF. To protect port 80 or 443, select Standard port from the drop-down list. To protect other ports, choose one from the drop-down list. Click View Ports You Can Use to view the HTTP and HTTPS ports supported by WAF. For more information, see Ports Supported by WAF. If a port other than 80 or 443 is configured, the visitors need to add the non-standard port to the end of the website address when they access the website. Otherwise, a 404 error will occur. If a 404 error occurs, see How Do I Troubleshoot 404/502/504 Errors?	Standard ports
   Server Configuration		Configure the origin server information, including: Client Protocol: protocol used by a client to access the website server. The options are as follows: HTTP: If you select Standard port for Protected Port, port 80 is protected by default for HTTP. HTTPS: If you select Standard port for Protected Port, port 443 is protected by default for HTTPS. Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP). In HTTPS, the communication protocol is encrypted using Transport Layer Security (TLS) or, formerly, Secure Sockets Layer (SSL). HTTPS is widely used to protect privacy and integrity of data in transit and to authenticate website identities. So, if HTTPS is selected, you need to configure a certificate. If you select HTTPS, you can enable HTTP/2. For details, see Enabling the HTTP/2 Protocol. Server Protocol: protocol used by WAF to forward requests to the website server. You can select HTTP or HTTPS. If the client protocol is different from the origin server protocol, WAF forcibly uses the origin server protocol to forward client requests. Server Address: the public IP address or domain name of your website server that the client accesses. The public IP address typically maps to the A record of your domain name hosted in the DNS platform. The following IP address formats are supported: IPv4 address, for example, XXX.XXX.1.1 IPv6 address, for example, fe80:0000:0000:0000:0000:0000:0000:0000. Only professional and enterprise editions support IPv6. The domain name typically maps to the CNAME record of your domain name in the DNS platform. Server Port: service port over which the WAF instance forwards client requests to the origin server. Weight: Requests are distributed across backend origin servers based on the load balancing algorithm you select and the weight you assign to each server. This function is only supported in professional and enterprise editions for cloud mode. If you select the weighted round robin algorithm, requests are distributed across origin servers in turn based on the weight you assign to each origin server. If you select the source IP hash or session hash algorithm, the weight only determines whether traffic is distributed. If the Weight is 0, traffic is not distributed. If the Weight is not 0, traffic is distributed. Weight range: 0 to 65,536. A larger weight indicates more requests distributed to the server. If the weight is set to 0, the origin server will not accept new requests if multiple origin servers are configured. If only one origin server is configured, all requests are distributed to the origin server. Remarks (Optional): Enter remarks about the server.	Client Protocol: HTTP Server Protocol: HTTP Server Address: XXX.XXX.1.1 Server Port: 80
   Certificate		If you select HTTPS for Client Protocol, you need to select the certificate associated with the website. International websites are supported. Each domain name must have a valid certificate associated. A wildcard domain name can only use a wildcard domain certificate. If you only have single-domain certificates, you need to add domain names to WAF one by one. If your website certificate is about to expire, purchase a new certificate before the expiration date and update the certificate associated with the website in WAF. WAF can send notifications if a certificate expires. You can configure such notifications on the Notifications page. For details, see Enabling Alarm Notifications. You can import a new certificate, select an SCM certificate, or select an existing certificate. Importing a certificate: If you have not created a certificate, click Import New Certificate. In the Import New Certificate dialog box, set certificate parameters. For more details, see Uploading a Certificate. Only .pem certificates can be used in WAF. If the certificate is not in PEM format, convert it into PEM first. For details, see How Do I Convert a Certificate into PEM Format? The newly imported certificates will be listed on the Certificates page as well. Selecting an existing certificate: If you have created a certificate in WAF, click the drop-down arrow, select Existing certificates, and select a correct and valid certificate from the list. Selecting an SCM certificate: If you have used a CCM certificate under the same account, you can select an SSL certificate from the drop-down list. The name of the SSL certificate you select must be the same as that in CCM. Currently, certificates purchased in Huawei Cloud SCM can be pushed only to the default enterprise project. For other enterprise projects, SSL certificates pushed by SCM cannot be used. A record is automatically generated for the selected SSL certificate on the Certificates page. You can change the certificate name on this page, but the certificate name displayed in CCM will not be changed accordingly.	-
   Minimum TLS Version and Cipher Suite		After selecting a certificate, you need to select the minimum TLS version and cipher suite. For more details, see Configuring PCI DSS/3DS Compliance Check and TLS. Minimum TLS Version: To be compatible with most service scenarios, the default minimum TLS version is TLS v1.0. You can select a more secure TLS version by referring to Table 1. You can select TLS v1.0, TLS v1.1, or TLS v1.2. Later versions are more secure than earlier ones. Cipher Suite: To balance security and compatibility, the default cipher suite is Secure cipher suite. You can select a more secure cipher suite by referring to Table 2.	Minimum TLS version: TLS v1.0 Cipher suite: Secure cipher suite
   IP Tag		After a website is connected to WAF, Use Layer-7 Proxy is set to Yes by default. In this scenario, WAF is unable to directly obtain the real IP address of the client. This makes IP address-based protection rules become invalid. You can select an IP tag to specify how WAF identifies client IP addresses. This enables WAF to obtain real client IP addresses. $remote_sockaddr: If there is no other proxy in front of WAF, the packet contains the TCP Option Address (TOA), but you do not want WAF to use the TOA as the client IP address, select this option. With this tag configured, WAF uses the Layer 3 source IP address of the packet as the real client IP address. $remote_addr: If there is a layer-4 proxy in front of WAF, WAF uses the TCP connection IP address as the real client IP address. x-forwarded-for: If there is a layer-7 proxy in front of WAF, WAF uses the first IP address in the X-Forwarded-For (XFF) header as the real client IP address. Custom: If there is a layer-7 proxy in front of WAF, WAF preferentially obtains the real client IP address from the configured field. If multiple fields are configured, WAF reads the real client IP address from left to right. If WAF does not obtain the real client IP address from the custom field, it reads the CDN-Src-Ip, X-Real-Ip, X-Forwarded-For, and $remote_addr fields in sequence to obtain the real client IP address.	$remote_sockaddr

7. Complete Advanced Settings.
   Figure 5 Advanced Settings
   

   Table 2 Advanced settings

   Parameter	Description	Example Value
   Load Balancing Algorithm	If there are multiple origin server addresses, you need to select a load balancing algorithm for the origin servers so that WAF can forward requests to the corresponding server. For details, see Modifying the Load Balancing Algorithm. WAF supports the following algorithms: Origin server IP hash: Requests from the same IP address are routed to the same backend server. Weighted round robin: All requests are distributed across origin servers in turn based on weights set to each origin server. The origin server with a larger weight receives more requests than others. Session hash: Requests with the same session tag are routed to the same origin server. To enable this algorithm, configure traffic identifiers for known attack sources, or Session hash algorithm cannot take effect.	Weighted round robin
   IPv6 Protection	If the domain name is accessible using an IPv6 address, enable IPv6 Protection. After you enable it, WAF assigns an IPv6 address to the domain name. Only professional and enterprise editions support IPv6 protection. For details, see Enabling IPv6 Protection. If you select IPv6 for Server Address, IPv6 Protection will be enabled by default. If the origin server uses IPv6 addresses, IPv6 protection is enabled by default. To prevent IPv6 service from interruption, keep the IPv6 protection enabled. If IPv6 protection is not needed, edit the server configuration and delete IPv6 configuration from the origin server first. For details, see Editing Server Information. If you select IPv4 for Server Address and enable IPv6 Protection, WAF will assign an IPv6 address to the domain name so that the website is accessible over the IPv6 address. In this way, requests to the IPv6 address are routed by WAF to the IPv4 address of the origin server. For details, see How Does WAF Forward Traffic to an IPv6 Origin Server?	Enabled
   HTTP/2	HTTP/2 cannot be configured unless you set Client Protocol to HTTPS for at least one origin server address record in Server Configuration. Only professional and enterprise editions support HTTP/2. HTTP/2 is only used for communication between clients and WAF. You can enable this function if your website needs to support HTTP/2 access. After HTTP/2 is enabled, ensure that the client supports TLS 1.2. Otherwise, HTTP/2 does not take effect.	Use
   Policy	Select the protection policy you want to use for the website. System-generated policy (default): For details, see Table 3. If the number of added protection policies reaches the quota, this option will be grayed out. A protection policy created manually: a custom policy you create based on your security requirements. Only the standard, professional, and enterprise editions support manually created protection policies. For more information, see Configuring Protection Policies.	System-generated policy

   Table 3 Parameters for system-generated policies

   Policy	Description
   Basic Web Protection: General Check is enabled by default. Rule Set: Default rule set (medium) is selected. Protective Action: Log only is selected. It means WAF only logs detected attacks but does not block them.	The basic web protection defends against attacks such as SQL injections, XSS, remote overflow vulnerabilities, file inclusions, Bash vulnerabilities, remote command execution, directory traversal, sensitive file access, and command/code injections.
   Anti-Crawler: By default, Scanner detection is enabled, and Protective Action is set to Log only. WAF only logs detected attacks but does not block them.	WAF only logs web scanning tasks, such as vulnerability scanning and virus scanning, such as crawling behavior of OpenVAS and Nmap.

8. Click Next and complete the following operations as prompted in Test WAF:
   Figure 6 Domain name added
   
   1. Whitelist WAF Back-to-Source IP Addresses on Your Origin Servers
   2. Testing WAF
   3. Modifying DNS Records for a Domain Name

Step 2: Whitelist Back-to-Source IP Addresses on Your Origin Server

A back-to-source IP address is a source IP address used by WAF to forward client requests to origin servers. To origin servers, all access IP addresses are WAF back-to-source IP addresses. Real client IP addresses are encapsulated into the HTTP X-Forwarded-For (XFF) header field.

If the origin server uses other firewalls, network ACLs, security groups, or antivirus software, they are more likely to block WAF back-to-source IP address as malicious ones. So if the origin server's IP address is exposed, attackers can then bypass WAF and directly attack the origin server using that address. To prevent this, configure an access control policy on the origin server to allow only traffic from WAF back-to-source IP addresses on all ports.

• There will be more WAF IP addresses due to scale-out or new clusters. For your legacy domain names, WAF IP addresses usually fall into several class C IP addresses (192.0.0.0 to 223.255.255.255) of two to four clusters.
• Generally, these IP addresses do not change unless clusters in use are changed due to DR switchovers or other scheduling switchovers. Even when WAF cluster is switched over on the WAF background, WAF will check the security group configuration on the origin server to prevent service interruptions.

1. Obtain WAF back-to-source IP addresses.
   After finishing Step 1. Add Your Domain Name to WAF, expand Step 1: (Optional) Whitelist WAF back-to-source IP addresses and click to copy all back-to-origin IP addresses. Alternatively, go to the Access Management page, locate the target domain name, and click Whitelist WAF in the Access Status column. Then, click to copy all back-to-origin IP addresses.

   Figure 7 Copying the back-to-source IP addresses
   

2. Open the security software on the origin server and add the copied IP addresses to the whitelist.
   • If origin servers are deployed on ECSs, see Whitelisting WAF Back-to-Source IP Addresses on Origin Servers That Are Deployed on ECSs.
   • If origin servers are added to backend servers of an ELB load balancer, see Whitelisting WAF Back-to-Source IP Addresses on Origin Servers That Use Load Balancers.
   • If you also use Cloud Firewall (CFW) on Huawei Cloud, refer to Adding a Protection Rule.
   • If your website is deployed on servers on other cloud vendors, whitelist the WAF back-to-source IP addresses in the corresponding security group and access control rules.
   • If only the personal antivirus software is installed on the origin server, the software does not have the interface for whitelisting IP addresses. If the origin server provides external web services, install the enterprise security software on or use Huawei Cloud Host Security Service (HSS) for the server. These products identify the sockets of some IP addresses with a large number of requests and occasionally disconnect the connections. Generally, the IP addresses of WAF are not blocked.

3. After the preceding operations are complete, click Whitelist configured.

Step 3: Test WAF

After adding a domain name to WAF and whitelisting WAF back-to-source IP addresses, you still need to point the domain name resolution to the IP address of WAF. To this end, you need to modify the hosts file on the local computer and configure domain name resolution mappings, which are DNS resolution records that take effect only on the local computer. After that, access the protected domain name through the local computer to check whether access settings of the domain name are valid. This prevents website access exceptions caused by abnormal domain name access configuration.

Before performing this operation, ensure that:

• The protocol, address, and port used by the origin server are correctly configured when adding a domain name to WAF (for example, www.example.com). If you set Client Protocol to HTTPS, ensure that the uploaded certificate and private key are correct.
• Operations in Step 2: Whitelist Back-to-Source IP Addresses on Your Origin Server have been finished.

1. Obtain the CNAME record.
   • Method 1: After finishing Step 2: Whitelist WAF back-to-source IP addresses, expand Step 2: Test WAF and copy CNAME record on the displayed page. Alternatively, go to the Access Management page, click Test WAF in the Access Status column, and copy the CNAME record on the displayed page.
   • Method 2: Choose Assets > Protected Objects. Click a domain name. On the basic information page that is displayed, click under CNAME to copy its value.

2. Ping the CNAME record and record the corresponding IP address.

   Use www.example.com as an example and the WAF CNAME record is xxxxxxxdc1b71f718f233caf77.waf.huaweicloud.com.

   Open cmd in Windows or bash in Linux and run the ping xxxxxxxdc1b71f718f233caf77.waf.huaweicloud.com command to obtain the WAF access IP addresses. As shown in Figure 8, the WAF access IP address is displayed.

   Figure 8 ping cname
   
   

   If no WAF access IP addresses are returned after you ping the CNAME record, your network may be unstable. You can ping the CNAME record again when your network is stable.

3. Add the domain name and WAF access IP addresses pointed to CNAME to the hosts file.
   1. Use a text editor to edit the hosts file. In Windows, the location of the hosts file is as follows:
      • Windows: C:\Windows\System32\drivers\etc
      • Linux: /etc/hosts
   2. Add a record like Figure 9 to the hosts file. The IP address is the WAF access IP address obtained in 2 and the domain name is the protected domain name.
      Figure 9 Adding a record
      
   3. Save the changes and then test the connectivity of the protected domain name through the CLI.
      Figure 10 Pinging the domain name
      

      It is expected that the resolved IP address is the access IP address of WAF obtained in 3.b. If the origin server address is returned, refresh the local DNS cache. (Run ipconfig/flushdns in Windows cmd or systemd-resolved in Linux Bash.)

4. Verify the access.
   1. Clear the browser cache and enter the domain name in the address bar to check whether the website is accessible.

      If the domain name has been resolved to WAF back-to-source IP addresses and WAF configurations are correct, the website is accessible.

   2. Manually simulate simple web attack commands (for example, <Protected domain name>/?id=1 and 1=1, where id=1 and 1=1 is the SQL injection attack code used for testing) to see if web attack requests can be blocked.
      1. Set the mode of Basic Web Protection to Block. For details, see Enabling Basic Web Protection.
      2. Clear the browser cache, enter the test domain name (for example, <Protected domain name>/?id=1 and 1=1) in the browser to simulate a web attack, and check whether WAF blocks the attack. Figure 11 shows an example.
         Figure 11 Request blocked
         
      3. In the navigation pane on the left, choose Events to view test data.

5. Verify that the preceding steps are complete and click Finished.

Step 4: Modify the DNS Records of the Domain Name

After a domain name is added to WAF, WAF functions as a reverse proxy between the client and server. The real IP address of the server is hidden, and only the IP address of WAF is visible to web visitors. You must point the DNS resolution of the domain name to the CNAME record provided by WAF. In this way, access requests can be resolved to WAF. After your website connectivity with WAF is tested locally, you can go to the DNS platform hosting your domain name and resolve the domain name to WAF. Then WAF protection can work.

Before modifying the DNS records of a domain name, ensure that:

• You have the permission to modify domain name resolution settings on the DNS platform hosting your domain name.

The DNS configurations vary depending on whether a proxy is used before WAF.

Step 5: Verify Website Access

• Verifying the access status
  After the access configurations are finished, WAF automatically checks the access status of new or updated domain names every 30 minutes based on the following conditions: If the domain name was created more than two weeks ago and has not been modified in the past two weeks, you can click in the Access Status column to manually refresh the access status.

  • Check whether a CNAME record or TXT record is configured for the website domain name if proxies are used.
  • Check whether there is traffic passing through the website. You can check whether the number of access requests to the website in the past day reaches 50. For example, if the website was successfully connected to WAF at 14:50, there were at least 50 requests to the website within the last day (from 14:50 the previous day to 14:50 the current day).

  Figure 17 shows the logic for checking the access status.

  Figure 17 Access status check logic
  
  You can check the domain name access status on the Cloud CNAME tab.

  • Accessible: The domain name has been connected to WAF. A CNAME record or a TXT record has been configured for the domain name, and the website has traffic.
  • Inaccessible: The domain name has not been connected to WAF. No CNAME or TXT record has been configured for the website domain name, and no traffic passes through the website. You can allow the back-to-source IP addresses, test WAF, or modify the DNS resolution based on the access status. If the domain name is still Inaccessible after you manually refresh the access status, connect the domain name to WAF again by referring to Why Is My Domain Name or IP Address Inaccessible?
  • DNS error: The website domain name has a TXT record, but the website does not have traffic. You can access the website more than 50 times within the last day, manually refresh the access status, and check whether the access status is updated to Accessible.
• Protection Verification

  Manually simulate simple web attack commands (for example, <Protected domain name>/?id=1 and 1=1, where id=1 and 1=1 is the SQL injection attack code used for testing) to verify that WAF protection works.