Help Center/ Web Application Firewall/ Help Panel/ Tier-2 Help Panel - Website Settings/ Step 3: Test WAF
Updated on 2025-08-04 GMT+08:00
Share

Step 3: Test WAF

To ensure that WAF can forward your website requests normally, test WAF locally after you add the domain name to WAF.

Before testing WAF, ensure that the protocol, address, and port used by the origin server (for example, www.example5.com) are correct. If Client Protocol is set to HTTPS, ensure that the uploaded certificate and private key are correct.

A CNAME record is generated based on a domain name. For the same domain name, the CNAME records are the same.

Procedure

  1. Click the target domain name to go to the basic information page. In the CNAME row, click to copy the CNAME record.
  2. Ping the CNAME record and record the corresponding IP address.

    Use www.example.com as an example and WAF CNAME record is xxxxxxxdc1b71f718f233caf77.waf.huaweicloud.com.

    Open cmd in Windows or bash in Linux and run the ping xxxxxxxdc1b71f718f233caf77.waf.huaweicloud.com command to obtain the WAF access IP addresses. As shown in Figure 1, the WAF access IP address is displayed.
    Figure 1 ping cname

    If no WAF access IP addresses are returned after you ping the CNAME record, your network may be unstable. You can ping the CNAME record again when your network is stable.

  3. Add the domain name and WAF access IP addresses pointed to CNAME to the hosts file.

    1. Use a text editor to edit the hosts file. In Windows, the location of the hosts file is as follows:
      • Windows: C:\Windows\System32\drivers\etc
      • Linux: /etc/hosts
    2. Add a record for the WAF access IP address obtained in 2 and protected domain name to the hosts file.
      Figure 2 Adding a record
    3. Save the hosts file and ping the protected domain name on the local PC.
      Figure 3 Pinging the domain name

      It is expected that the resolved IP address is the access IP address of WAF obtained in 3.b. If the origin server address is returned, refresh the local DNS cache. (Run ipconfig/flushdns in Windows cmd or systemd-resolved in Linux Bash.)

  4. Clear the browser cache and enter the domain name in the address bar to check whether the website is accessible.

    If the domain name has been resolved to WAF back-to-source IP addresses and WAF configurations are correct, the website is accessible.

  5. Simulate simple web attack commands.

    1. In the Basic Web Protection configuration area, set Mode to Block. For details, see Configuring Basic Web Protection Rules.
    2. Clear the browser cache, enter the domain name in the address bar, and check whether WAF blocks the simulated SQL injection attack against the domain name.
      Figure 4 Request blocked
    3. In the navigation pane, choose Events to view test data.

Parent Topic: Tier-2 Help Panel - Website Settings